r1(config)#crypto isakmp enable   开启VPN功能
r1(config)#crypto isakmp key 0 cisco add 211.81.1.2 对端IP

r1(config)#cry isa policy 1
r1(config-isakmp)#hash md5   对端也是一样的配置
r1(config-isakmp)#encry des
r1(config-isakmp)#auth pre-share
r1(config-isakmp)#lifetime 86400
r1(config-isakmp)#group 1

r1(config)#cryp ipsec transform-set tran1 esp-des
r1(cfg-crypto-trans)#mode tunnel   还有种模式是trans

r1(config)#acc 100 p ip 192.168.0.0 0.0.255.255 172.16.0.0 0.0.255.255

r1(config)#crypto map vpn 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
r1(config-crypto-map)#set peer 211.81.1.2
r1(config-crypto-map)#set transform-set tran1
r1(config-crypto-map)#match add 100

r1(config)#int s1/1
r1(config-if)#crypto map vpn
r1(config-if)#exit

---------------

r2#
r2#sh run

interface Serial1/0
ip address 202.102.48.66 255.255.255.252

interface Serial1/1
ip address 211.64.135.33 255.255.255.252

-------------------

r3#
!
crypto isakmp policy 2
 hash md5
 authentication pre-share
crypto isakmp key cisco address 211.1.1.2
!
crypto ipsec transform-set tran1 esp-des
!
crypto map vpn 10 ipsec-isakmp
 set peer 211.1.1.2
 set transform-set tran1
 match address 100
!
interface FastEthernet0/0
 ip address 172.16.1.1 255.255.255.0
!
interface Serial1/0
 ip address 211.81.1.2 255.255.255.0
 crypto map vpn
!
interface FastEthernet2/0
 ip address 172.16.2.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 211.81.1.1
!
access-list 100 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255

----------------------