Cisco
IPsec（アグレッシブモード）のコンフィグ
IPsec+PPPoE+NAT+ACLのコンフィグでは、RT-1とRT-2はメインモードでIPsecを設定していますが、ここではRT-1のグローバルIPアドレス（11.11.11.11）は動的、RT-2（22.22.22.22）は静的になっていると想定してアグレッシブモードで設定したコンフィグを記載します。
構成図
コンフィグについて
メインモードで対向機器を識別するIDデータはグローバルIPアドレスを使用していましたが、アグレッシブモードで動的IPアドレスの機器（RT-1）はIPアドレスではなく文字列での識別になります。文字列は一致すれば何でも良く、ホスト名やFQDNである必要はありません。コンフィグで"Hoge"と設定してる箇所です。
RT-1のグローバルIPアドレスは動的と想定しているため、アクセスリスト"Internet-ACL"（インターネットからのアクセス制限）がRT-1とRT-2ともに脆弱になっています。RT-1のグローバルIPアドレス（11.11.11.11）で制限していた箇所をanyに変更しています。
RT-1コンフィグ
（動的グローバルIPアドレス）
RT-2コンフィグ
（静的グローバルIPアドレス）
※黄色文字はPPPoE+NAT+ACLのコンフィグからの変更箇所です。
RT-1#show run version 15.3 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service sequence-numbers no service dhcp ! hostname RT-1 ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 512000 enable secret 5 $1$UZ.d$263eCd7jDVJHAqwgfcFNL0 ! no aaa new-model clock timezone JST 9 0 ! ! ! no ip bootp server no ip domain lookup ip domain name free-ne.com ip inspect name CBAC tcp ip inspect name CBAC udp ip inspect name CBAC icmp ip cef no ipv6 cef ! ! ! multilink bundle-name authenticated ! ! ! no spanning-tree vlan 1 username admin secret 5 $1$ztjJ$yET4V3rcbtkvdA9yjTJin. ! ! ! ip ssh version 2 ! ! crypto isakmp policy 110 encr aes hash sha256 authentication pre-share group 2 lifetime 1800 ! crypto isakmp keepalive 30 periodic ! crypto isakmp peer address 22.22.22.22 set aggressive-mode password PS-key set aggressive-mode client-endpoint fqdn Hoge ! crypto ipsec transform-set TS-name esp-aes esp-sha256-hmac mode tunnel ! ! ! crypto map MAP-name 160 ipsec-isakmp set peer 22.22.22.22 set security-association lifetime seconds 1200 set transform-set TS-name set pfs group14 match address IPsec ! ! ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface FastEthernet0 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0 no ip address ! interface GigabitEthernet1 no ip address ! interface GigabitEthernet2 no ip address ! interface GigabitEthernet3 no ip address ! interface GigabitEthernet4 no ip address ! interface GigabitEthernet5 no ip address ! interface GigabitEthernet6 no ip address ! interface GigabitEthernet7 no ip address ! interface GigabitEthernet8 no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface Vlan1 ip address 10.1.1.11 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1350 ! interface Async3 no ip address encapsulation slip ! interface Dialer1 ip address negotiated ip access-group Internet-ACL in ip mtu 1492 ip nat outside ip inspect CBAC out ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 10 ppp authentication chap callin ppp chap hostname user1 ppp chap password 0 cisco no cdp enable crypto map MAP-name ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source list Internet-PAT interface Dialer1 overload ! ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list standard SSH-ACL permit 10.1.1.0 0.0.0.255 ! ! ip access-list extended IPsec permit ip 10.1.1.0 0.0.0.255 10.2.1.0 0.0.0.255 ip access-list extended Internet-ACL permit udp host 9.9.9.1 eq ntp any eq ntp permit icmp any any permit udp host 22.22.22.22 eq isakmp any eq isakmp permit esp host 22.22.22.22 any ! ip access-list extended Internet-PAT deny ip 10.1.1.0 0.0.0.255 10.2.1.0 0.0.0.255 permit ip 10.1.1.0 0.0.0.255 any ! dialer-list 10 protocol ip permit no cdp run ! ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! line con 0 exec-timeout 60 0 logging synchronous no modem enable line aux 0 line 3 modem InOut speed 115200 flowcontrol hardware line vty 0 4 access-class SSH-ACL in exec-timeout 60 0 logging synchronous login local transport input ssh ! scheduler allocate 20000 1000 ntp server 9.9.9.1 ! end
RT-2#show run version 15.3 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service sequence-numbers no service dhcp ! hostname RT-2 ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 512000 enable secret 5 $1$RBil$/zAAQLKQrekcrMgQIHCwW1 ! no aaa new-model clock timezone JST 9 0 ! ! ! no ip bootp server no ip domain lookup ip domain name free-ne.com ip inspect name CBAC tcp ip inspect name CBAC udp ip inspect name CBAC icmp ip cef no ipv6 cef ! ! ! multilink bundle-name authenticated ! ! ! no spanning-tree vlan 1 username admin secret 5 $1$hwGG$LTC0VpW218k/mT9dMrcO.0 ! ! ! ip ssh version 2 ! ! crypto isakmp policy 110 encr aes hash sha256 authentication pre-share group 2 lifetime 1800 crypto isakmp key PS-key hostname Hoge crypto isakmp keepalive 30 periodic ! ! ! ! ! crypto ipsec transform-set TS-name esp-aes esp-sha256-hmac mode tunnel ! ! ! crypto dynamic-map DMAP-name 210 set security-association lifetime seconds 1200 set transform-set TS-name set pfs group14 match address IPsec ! ! crypto map MAP-name 160 ipsec-isakmp dynamic DMAP-name ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface FastEthernet0 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0 no ip address ! interface GigabitEthernet1 no ip address ! interface GigabitEthernet2 no ip address ! interface GigabitEthernet3 no ip address ! interface GigabitEthernet4 no ip address ! interface GigabitEthernet5 no ip address ! interface GigabitEthernet6 no ip address ! interface GigabitEthernet7 no ip address ! interface GigabitEthernet8 no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface Vlan1 ip address 10.2.1.22 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1350 ! interface Async3 no ip address encapsulation slip ! interface Dialer1 ip address negotiated ip access-group Internet-ACL in ip mtu 1492 ip nat outside ip inspect CBAC out ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 10 ppp authentication chap callin ppp chap hostname user1 ppp chap password 0 cisco no cdp enable crypto map MAP-name ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source list Internet-PAT interface Dialer1 overload ip nat inside source static tcp 10.2.1.2 80 22.22.22.22 80 extendable ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list standard SSH-ACL permit 10.2.1.0 0.0.0.255 permit 10.1.1.0 0.0.0.255 ! ip access-list extended IPsec permit ip 10.2.1.0 0.0.0.255 10.1.1.0 0.0.0.255 ip access-list extended Internet-ACL permit udp host 9.9.9.1 eq ntp host 22.22.22.22 eq ntp permit icmp any host 22.22.22.22 permit tcp any host 22.22.22.22 eq www permit udp any eq isakmp host 22.22.22.22 eq isakmp permit esp any host 22.22.22.22 ip access-list extended Internet-PAT deny ip 10.2.1.0 0.0.0.255 10.1.1.0 0.0.0.255 permit ip 10.2.1.0 0.0.0.255 any ! dialer-list 10 protocol ip permit no cdp run ! ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! line con 0 exec-timeout 60 0 logging synchronous no modem enable line aux 0 line 3 modem InOut speed 115200 flowcontrol hardware line vty 0 4 access-class SSH-ACL in exec-timeout 60 0 logging synchronous login local transport input ssh ! scheduler allocate 20000 1000 ntp server 9.9.9.1 ! end