2023年7月10日发(作者：)
1 简介
2 配置前提
3 使用iNode客户端基于证书认证的L2TP over IPsec功能配置举例
3.1 组网需求
3.2 配置思路
3.3 使用版本
3.4 配置步骤
3.4.1 Device的配置
3.4.2 Host的配置
3.5 验证配置
3.6 配置文件
4 IPsec over GRE的典型配置举例
4.1 组网需求
4.2 配置思路
4.3 使用版本
4.4 配置步骤
4.4.1 Device A的配置
4.4.2 Device B的配置
4.5 验证配置
4.6 配置文件
5 GRE over IPsec的典型配置举例
5.1 组网需求
5.2 配置思路
5.3 使用版本
5.4 配置步骤
5.4.1 Device A的配置
5.4.2 Device B的配置
5.5 验证配置
5.6 配置文件
6 IPsec同流双隧道的典型配置举例
6.1 组网需求
6.2 使用版本
6.3 配置步骤
6.3.1 Device A的配置
6.3.2 Device B的配置
6.4 验证配置
6.5 配置文件
7 相关资料
1 简介
本文档介绍IPsec的典型配置举例。
2 配置前提
本文档适用于使用Comware V7软件版本的MSR系列路由器，如果使用过程中与产品实际情况有差异，请参考相关产品手册，或以设备实际情况为准。
本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。
本文档假设您已了解IPsec特性。
3 使用iNode客户端基于证书认证的L2TP over IPsec功能配置举例
3.1 组网需求
如图1所示，PPP用户Host与Device建立L2TP隧道，Windows server 2003作为CA服务器，要求：
• 通过L2TP隧道访问Corporate network。
• 用IPsec对L2TP隧道进行数据加密。
• 采用RSA证书认证方式建立IPsec隧道。
图1 基于证书认证的L2TP over IPsec配置组网图
3.2 配置思路
由于使用证书认证方式建立IPsec隧道，所以需要在ike profile中配置local-identity为dn，指定从本端证书中的主题字段取得本端身份。
3.3 使用版本
本举例是在R0106版本上进行配置和验证的。
3.4 配置步骤
3.4.1 Device的配置
(1) 配置各接口IP地址 # 配置接口GigabitEthernet2/0/1的IP地址。
[Device] interface gigabitethernet 2/0/1
[Device-GigabitEthernet2/0/1] ip address 192.168.100.50 24
[Device-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[Device] interface gigabitethernet 2/0/2
[Device-GigabitEthernet2/0/2] ip address 102.168.1.11 24
[Device-GigabitEthernet2/0/2] quit
# 配置接口GigabitEthernet2/0/3的IP地址。
[Device] interface gigabitethernet 2/0/3
[Device-GigabitEthernet2/0/3] ip address 192.168.1.1 24
[Device-GigabitEthernet2/0/3] quit
(2) 配置L2TP
# 创建本地PPP用户l2tpuser，设置密码为hello。
[Device] local-user l2tpuser class network
[Device-luser-network-l2tpuser] password simple hello
[Device-luser-network-l2tpuser] service-type ppp
[Device-luser-network-l2tpuser] quit
#
配置ISP域system对PPP用户采用本地验证。
[Device] domain system
[Device-isp-system] authentication ppp local
[Device-isp-system] quit
# 启用L2TP服务。
[Device] l2tp enable
# 创建接口Virtual-Template0，配置接口的IP地址为172.16.0.1/24。
[Device] interface virtual-template 0
[Device-Virtual-Template0] ip address 172.16.0.1 255.255.255.0
# 配置PPP认证方式为PAP。
[Device-Virtual-Template0] ppp authentication-mode pap
# 配置为PPP用户分配的IP地址为172.16.0.2。
[Device-Virtual-Template0] remote address 172.16.0.2
[Device-Virtual-Template0] quit
# 创建LNS模式的L2TP组1。
[Device] l2tp-group 1 mode lns
# 配置LNS侧本端名称为lns。
[Device-l2tp1] tunnel name lns
# 关闭L2TP隧道验证功能。
[Device-l2tp1] undo tunnel authentication
# 指定接收呼叫的虚拟模板接口为VT0。
[Device-l2tp1] allow l2tp virtual-template 0
[Device-l2tp1] quit
(3) 配置PKI证书
# 配置PKI实体 security。 [Device] pki entity security
[Device-pki-entity-security] common-name device
[Device-pki-entity-security] quit
# 新建PKI域。
[Device] pki domain headgate
[Device-pki-domain-headgate] ca identifier LYQ
[Device-pki-domain-headgate] certificate request url 192.168.1.51/certsrv/mscep/
[Device-pki-domain-headgate] certificate request from ra
[Device-pki-domain-headgate] certificate request entity security
[Device-pki-domain-headgate] undo crl check enable
[Device-pki-domain-headgate] public-key rsa general name abc length 1024
[Device-pki-domain-headgate] quit
# 生成RSA算法的本地密钥对。
[Device] public-key local create rsa name abc
The range of public key modulus is (512 ~ 2048).
If the key modulus is greater than 512,it will take a few minutes.
Press CTRL+C to abort.
Input the modulus length [default = 1024]:
..........................++++++
.++++++
Create the key pair successfully.
# 获取CA证书并下载至本地。
[Device] pki retrieve-certificate domain headgate ca
The trusted CA's finger print is:
MD5 fingerprint:8649 7A4B EAD5 42CF 5031 4C99 BFS3 2A99
SHA1 fingerprint:61A9 6034 181E 6502 12FA 5A5F BA12 0EA0 5187 031C
Is the finger print correct?(Y/N):y
Retrieved the certificates successfully.
# 手工申请本地证书。
[Device] pki request-certificate domain headgate
Start to request general certificate ...
Certificate requested successfully.
(4) 配置IPsec隧道
# 创建IKE安全提议。
[Device] ike proposal 1
[Device-ike-proposal-1] authentication-method rsa-signature
[Device-ike-proposal-1] encryption-algorithm 3des-cbc
[Device-ike-proposal-1] dh group2
[Device-ike-proposal-1] quit
# 配置IPsec安全提议。
[Device] ipsec transform-set tran1
[Device-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[Device-ipsec-transform-set-tran1] esp encryption-algorithm 3des [Device-ipsec-transform-set-tran1] quit
# 配置IKE profile。
[Device] ike profile profile1
[Device-ike-profile-profile1] local-identity dn
[Device-ike-profile-profile1] certificate domain headgate
[Device-ike-profile-profile1] proposal 1
[Device-ike-profile-profile1] match remote certificate device
[Device-ike-profile-profile1] quit
# 在采用数字签名认证时，指定总从本端证书中的主题字段取得本端身份。
[Device]ike signature-identity from-certificate
# 创建一条IPsec安全策略模板，名称为template1，序列号为1。
[Device]
ipsec policy-template template1 1
[Device-ipsec-policy-template-template1-1] transform-set tran1
[Device-ipsec-policy-template-template1-1] ike-profile profile1
[Device-ipsec-policy-template-template1-1] quit
# 引用IPsec安全策略模板创建一条IPsec安全策略，名称为policy1，顺序号为1。
[Device] ipsec policy policy1 1 isakmp template template1
# 在接口上应用IPsec安全策略。
[Device] interface gigabitethernet 2/0/2
[Device-GigabitEthernet2/0/2] ipsec apply policy policy1
[Device-GigabitEthernet2/0/2] quit
3.4.2 Host的配置
(1) 从证书服务器上申请客户端证书
# 登录到证书服务器：192.168.1.51/certsrv ，点击“申请一个证书”。
图1 进入申请证书页面
# 点击“高级证书申请”。
图2 高级证书申请
# 选择第一项：创建并向此CA提交一个申请。
图3 创建并向CA提交一个申请
# 填写相关信息。
• 需要的证书类型，选择“客户端身份验证证书”；
• 密钥选项的配置，勾选“标记密钥为可导出”前的复选框。
# 点击<提交>，弹出一提示框
：在对话框中选择“是”。
# 点击安装此证书。
图4 安装证书
(2) iNode客户端的配置（使用iNode版本为：iNode PC 5.2(E0409)）
# 打开L2TP VPN连接，并单击“属性…(Y)”。
图5 打开L2TP连接
# 输入LNS服务器的地址，并启用IPsec安全协议，验证证方法选择证书认证。 图6 基本配置
# 单击<高级(C)>按钮，进入“L2TP设置”页签，设置L2TP参数如下图所示。
图7 L2TP设置
# 单击“IPsec设置”页签，配置IPsec参数。
图8 IPsec参数设置
# 单击“IKE设置”页签，配置IKE参数。
图9 IKE参数设置
# 单击“路由设置”页签，添加访问Corporate network的路由。
图10 路由设置
# 完成上述配置后，单击<确定>按钮，回到L2TP连接页面。
3.5 验证配置
# 在L2TP连接对话框中，输入用户名“l2tpuser”和密码“hello”，单击<连接>按钮。
图11 连接L2TP
# 在弹出的对话框中选择申请好的证书，单击<确定>按钮。
图12 证书选择
# 通过下图可以看到L2TP连接成功。
图13 连接成功
图14 连接成功
# 在Device上使用display ike sa命令，可以看到IPsec隧道第一阶段的SA正常建立。
Connection-ID Remote Flag DOI
------------------------------------------------------------------
10 102.168.1.1 RD IPSEC
Flags:
RD--READY RL--REPLACED FD-FADING
# 在Device上使用display ipsec sa命令可以看到IPsec SA的建立情况。
-------------------------------
Interface: GigabitEthernet2/0/2
-------------------------------
-----------------------------
IPsec policy: policy1
Sequence number: 1
Mode: template
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect forward secrecy:
Path MTU: 1443
Tunnel:
local address: 102.168.1.11
remote address: 102.168.1.1
Flow:
sour addr: 102.168.1.11/255.255.255.255 port: 1701 protocol: udp
dest addr: 102.168.1.1/255.255.255.255 port: 0 protocol: udp
[Inbound ESP SAs]
SPI: 2187699078 (0x8265a386)
Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843197/3294
Max received sequence-number: 51
Anti-replay check enable: Y
Anti-replay window size: 64
UDP encapsulation used for NAT traversal: N
Status: Active
[Outbound ESP SAs]
SPI: 3433374591 (0xcca5237f)
Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-SHA1 SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843197/3294
Max sent sequence-number: 52
UDP encapsulation used for NAT traversal: N
Status: Active
3.6 配置文件
#
interface Virtual-Template0
ppp authentication-mode pap
remote address 172.16.0.2
ip address 172.16.0.1 255.255.255.0
#
interface GigabitEthernet2/0/1
ip address 192.168.100.50 255.255.255.0
#
interface GigabitEthernet2/0/2
ip address 102.168.1.11 255.255.255.0
ipsec apply policy policy1
#
interface GigabitEthernet2/0/3
ip address 192.168.1.1 255.255.255.0
#
domain system
authentication ppp local
#
local-user l2tpuser class network
password cipher $c$3$nl46fURLtkCkcbdnB6irTXma+E6u0c+h
service-type ppp
authorization-attribute user-role network-operator
#
pki domain headgate
ca identifier LYQ
certificate request url 192.168.1.51/certsrv/mscep/
certificate request from ra
certificate request entity security
public-key rsa general name abc
undo crl check enable
#
pki entity security
common-name host
#
ipsec transform-set tran1
esp encryption-algorithm 3des-cbc esp authentication-algorithm sha1
#
ipsec policy-template template1 1
transform-set tran1
ike-profile profile1
#
ipsec policy policy1 1 isakmp template template1
#
l2tp-group 1 mode lns
allow l2tp virtual-template 0
undo tunnel authentication
tunnel name lns
#
l2tp enable
#
ike signature-identity from-certificate
#
ike profile profile1
certificate domain headgate
local-identity dn
match remote certificate device
proposal 1
#
ike proposal 1
authentication-method rsa-signature
encryption-algorithm 3des-cbc
dh group2
#
4 IPsec over GRE的典型配置举例
4.1 组网需求
如图15所示，企业远程办公网络通过IPsec VPN接入企业总部，要求：通过GRE隧道传输两网络之间的IPsec加密数据。
图15 IPsec over GRE组网图
4.2 配置思路
• 为了对数据先进行IPsec处理，再进行GRE封装，访问控制列表需匹配数据的原始范围，并且要将IPsec应用到GRE隧道接口上。
• 为了对网络间传输的数据先进行IPsec封装，再进行GRE封装，需要配置IPsec隧道的对端IP地址为GRE隧道的接口地址。
4.3 使用版本
本举例是在R0106版本上进行配置和验证的。
4.4 配置步骤
4.4.1 Device A的配置
(1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceA] interface gigabitethernet 2/0/1
[DeviceA-GigabitEthernet2/0/1] ip address 192.168.1.1 255.255.255.0
[DeviceA-GigabitEthernet2/0/1] tcp mss 1350
[DeviceA-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[DeviceA] interface gigabitethernet 2/0/2
[DeviceA-GigabitEthernet2/0/2] ip address 202.115.22.48 255.255.255.0
[DeviceA-GigabitEthernet2/0/2] quit
(2) 配置GRE隧道
# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。
[DeviceA] interface tunnel 0 mode gre
# 配置Tunnel0接口的IP地址为10.1.1.1/24。
[DeviceA-Tunnel0] ip address 10.1.1.1 255.255.255.0
# 配置Tunnel0接口的源端地址为202.115.22.48/24（Device A的GigabitEthernet2/0/2的IP地址）。
[DeviceA-Tunnel0] source 202.115.22.48
# 配置Tunnel0接口的目的端地址为202.115.24.50/24（Device B的GigabitEthernet2/0/2的IP地址）。
[DeviceA-Tunnel0] destination 202.115.24.50
[DeviceA-Tunnel0] quit
# 配置从Device A经过Tunnel0接口到Remote office network的静态路由。
[DeviceA] ip route-static 192.168.2.1 255.255.255.0 tunnel 0
(3) 配置IPsec VPN
# 配置IKE keychain。
[DeviceA] ike keychain keychain1
[DeviceA-ike-keychain-keychain1] pre-shared-key address 10.1.1.2 255.255.255.0 key simple 123
[DeviceA-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。 [DeviceA] acl number 3000
[DeviceA-acl-adv-3000] rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0
0.0.0.255
[DeviceA-acl-adv-3000] quit
# 配置IPsec安全提议。
[DeviceA] ipsec transform-set tran1
[DeviceA-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceA-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceA] ipsec policy policy1 1 isakmp
[DeviceA-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceA-ipsec-policy-isakmp-policy1-1] remote-address 10.1.1.2
[DeviceA-ipsec-policy-isakmp-policy1-1] transform-set tran1
[DeviceA-ipsec-policy-isakmp-policy1-1] quit
# 在GRE隧道接口上应用安全策略。
[DeviceA] interface tunnel 0
[DeviceA-Tunnel0] ipsec apply policy policy1
[DeviceA-Tunnel0] quit
4.4.2 Device B的配置
(1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceB] interface gigabitethernet 2/0/1
[DeviceB-GigabitEthernet2/0/1] ip address 192.168.2.1 255.255.255.0
[DeviceB-GigabitEthernet2/0/1] tcp mss 1350
[DeviceB-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[DeviceB] interface gigabitethernet 2/0/2
[DeviceB-GigabitEthernet2/0/2] ip address 202.115.24.50 255.255.255.0
[DeviceB-GigabitEthernet2/0/2] quit
(2) 配置GRE隧道
# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。
[DeviceB] interface tunnel 0 mode gre
# 配置Tunnel0接口的IP地址为10.1.1.2/24。
[DeviceB-Tunnel0] ip address 10.1.1.2 255.255.255.0
# 配置Tunnel0接口的源端地址为202.115.24.50/24（Device B的GigabitEthernet2/0/2的IP地址）。
[DeviceB-Tunnel0] source 202.115.24.50
# 配置Tunnel0接口的目的端地址为202.115.22.48/24（Device A的GigabitEthernet2/0/2的IP地址）。
[DeviceB-Tunnel0] destination 202.115.22.48
[DeviceB-Tunnel0] quit # 配置从DeviceB经过Tunnel0接口到Corporate network的静态路由。
[DeviceB] ip route-static 192.168.1.1 255.255.255.0 tunnel 0
(3) 配置IPsec VPN
# 配置IKE keychain。
[DeviceB] ike keychain keychain1
[DeviceB-ike-keychain-keychain1] pre-shared-key address 10.1.1.1 255.255.255.0 key simple 123
[DeviceB-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。
[DeviceB] acl number 3000
[DeviceB-acl-adv-3000] rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0
0.0.0.255
[DeviceB-acl-adv-3000] quit
# 配置IPsec安全提议。
[DeviceB] ipsec transform-set tran1
[DeviceB-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceB-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceB-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceB] ipsec policy policy1 1 isakmp
[DeviceB-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceB-ipsec-policy-isakmp-policy1-1] remote-address 10.1.1.1
[DeviceB-ipsec-policy-isakmp-policy1-1] transform-set tran1
[DeviceB-ipsec-policy-isakmp-policy1-1] quit
# 在GRE隧道接口上应用安全策略。
[DeviceB] interface tunnel 0
[DeviceB-Tunnel0] ipsec apply policy policy1
[DeviceB-Tunnel0] quit
4.5 验证配置
# 以Corporate network的主机192.168.1.2向Remote office network的主机192.168.2.2发起通信为例，从192.168.1.2 ping 192.168.2.2，会触发IPsec协商，建立IPsec隧道，在成功建立IPsec隧道后，可以ping通。
C:Userscorporatenetwork> ping 192.168.2.2
Pinging 192.168.2.2 with 32 bytes of data:
Request timed out.
Reply from 192.168.2.2: bytes=32 time=2ms TTL=254
Reply from 192.168.2.2: bytes=32 time=2ms TTL=254
Reply from 192.168.2.2: bytes=32 time=1ms TTL=254
Ping statistics for 192.168.2.2:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms # 在Device A上使用display ike sa命令，可以看到第一阶段的SA正常建立。
Connection-ID Remote Flag DOI
------------------------------------------------------------------
1 10.1.1.2 RD IPSEC
Flags:
RD--READY RL--REPLACED FD-FADING
# 在Device A上使用display ipsec sa命令可以看到IPsec SA的建立情况。
-------------------------------
Interface: Tunnel0
-------------------------------
-----------------------------
IPsec policy: policy1
Sequence number: 1
Mode: isakmp
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect forward secrecy:
Path MTU: 1419
Tunnel:
local address: 10.1.1.1
remote address: 10.1.1.2
Flow:
sour addr: 192.168.1.1/255.255.255.255 port: 0 protocol: ip
dest addr: 192.168.2.1/255.255.255.255 port: 0 protocol: ip
[Inbound ESP SAs]
SPI: 3128557135 (0xba79fe4f)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843199/3550
Max received sequence-number: 3
Anti-replay check enable: Y
Anti-replay window size: 64
UDP encapsulation used for NAT traversal: N
Status: Active
[Outbound ESP SAs]
SPI: 2643166978 (0x9d8b8702)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843199/3550
Max sent sequence-number: 3
UDP encapsulation used for NAT traversal: N
Status: Active
# 在Device A上通过命令display interface tunnel 0可以查看经过GRE隧道传输的流量情况。
Tunnel0
Current state: UP
Line protocol state: UP
Description: Tunnel0 Interface
Bandwidth: 64kbps
Maximum Transmit Unit: 1476
Internet Address is 10.1.1.1/24 Primary
Tunnel source 202.115.22.48, destination 202.115.24.50
Tunnel keepalive disabled
Tunnel TTL 255
Tunnel protocol/transport GRE/IP
GRE key disabled
Checksumming of GRE packets disabled
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0
Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last clearing of counters: Never
Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Input: 40 packets, 3300 bytes, 0 drops
Output: 41 packets, 3464 bytes, 0 drops
# 从Remote office network的主机向Corporate network的主机发起通信验证方法相同，此不赘述。
4.6 配置文件
• Device A：
#
interface GigabitEthernet2/0/1
ip address 192.168.1.1 255.255.255.0
tcp mss 1350
#
interface GigabitEthernet2/0/2
ip address 202.115.22.48 255.255.255.0
#
interface Tunnel0 mode gre
ip address 10.1.1.1 255.255.255.0
source 202.115.22.48 destination 202.115.24.50
ipsec apply policy policy1
#
ip route-static 192.168.2.0 24 Tunnel0
#
acl number 3000
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 10.1.1.2
#
ike keychain keychain1
pre-shared-key address 10.1.1.2 255.255.255.0 key cipher
$c$3$n6jdlYtuR+K6mijQ8qp4hMMjV/iteA==
#
• Devoce B
#
interface GigabitEthernet2/0/1
ip address 192.168.2.1 255.255.255.0
tcp mss 1350
#
interface GigabitEthernet2/0/2
ip address 202.115.22.50 255.255.255.0
#
interface Tunnel0 mode gre
ip address 10.1.1.2 255.255.255.0
source 202.115.24.50
destination 202.115.22.48
ipsec apply policy policy1
#
ip route-static 192.168.1.1 24 Tunnel0
#
acl number 3000
rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1 #
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 10.1.1.1
#
ike keychain keychain1
pre-shared-key address 10.1.1.1 255.255.255.0 key cipher
$c$3$n6jdlYtuR+K6mijQ8qp4hMMjV/iteA==
#
5 GRE over IPsec的典型配置举例
5.1 组网需求
如图16所示，企业远程办公网络通过GRE隧道与企业总部传输数据，要求：对通过GRE隧道的数据进行IPsec加密处理。
图16 GRE over IPsec组网图
5.2 配置思路
• 为了对经GRE封装的数据进行IPsec加密，将IPsec策略应用在物理接口上，访问控制列表源和目的地址为物理接口地址。
• 为了使IPsec保护整个GRE隧道，应用IPsec策略的接口和GRE隧道源、目的接口必须是同一接口。
5.3 使用版本
本举例是在R0106版本上进行配置和验证的。
5.4 配置步骤
5.4.1 Device A的配置
(1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceA] interface gigabitethernet 2/0/1
[DeviceA-GigabitEthernet2/0/1] ip address 192.168.1.1 255.255.255.0
[DeviceA-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。 [DeviceA] interface gigabitethernet 2/0/2
[DeviceA-GigabitEthernet2/0/2] ip address 202.115.22.48 255.255.255.0
[DeviceA-GigabitEthernet2/0/2] quit
(2) 配置GRE隧道
# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。
[DeviceA] interface tunnel 0 mode gre
# 配置Tunnel0接口的IP地址为10.1.1.1/24。
[DeviceA-Tunnel0] ip address 10.1.1.1 255.255.255.0
# 配置Tunnel0接口的源端地址为202.115.22.48/24（Device A的GigabitEthernet2/0/2的IP地址）。
[DeviceA-Tunnel0] source 202.115.22.48
# 配置Tunnel0接口的目的端地址为202.115.24.50/24（Device B的GigabitEthernet2/0/2的IP地址）。
[DeviceA-Tunnel0] destination 202.115.24.50
[DeviceA-Tunnel0] quit
# 配置从Device A经过Tunnel0接口到Remote office network的静态路由。
[DeviceA] ip route-static 192.168.2.1 255.255.255.0 tunnel 0
(3) 配置IPsec VPN
# 配置IKE keychain。
[DeviceA] ike keychain keychain1
[DeviceA-ike-keychain-keychain1] pre-shared-key address 202.115.24.50 255.255.255.0 key simple
123
[DeviceA-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。
[DeviceA] acl number 3000
[DeviceA-acl-adv-3000] rule 0 permit gre source 202.115.22.48 0 destination 202.115.24.50 0
[DeviceA-acl-adv-3000] quit
# 配置IPsec安全提议。
[DeviceA] ipsec transform-set tran1
[DeviceA-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceA-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceA] ipsec policy policy1 1 isakmp
[DeviceA-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceA-ipsec-policy-isakmp-policy1-1] remote-address 202.115.24.50
[DeviceA-ipsec-policy-isakmp-policy1-1] transform-set tran1
[DeviceA-ipsec-policy-isakmp-policy1-1] quit
# 在接口GigabitEthernet2/0/2上应用安全策略。
[DeviceA] interface gigabitethernet 2/0/2
[DeviceA-GigabitEthernet2/0/2] ipsec apply policy policy1
[DeviceA-GigabitEthernet2/0/2] quit
5.4.2 Device B的配置 (1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceB] interface gigabitethernet 2/0/1
[DeviceB-GigabitEthernet2/0/1] ip address 192.168.2.1 255.255.255.0
[DeviceB-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[DeviceB] interface gigabitethernet 2/0/2
[DeviceB-GigabitEthernet2/0/2] ip address 202.115.24.50 255.255.255.0
[DeviceB-GigabitEthernet2/0/2] quit
(2) 配置GRE隧道
# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。
[DeviceB] interface tunnel 0 mode gre
# 配置Tunnel0接口的IP地址为10.1.1.2/24。
[DeviceB-Tunnel0] ip address 10.1.1.2 255.255.255.0
# 配置Tunnel0接口的源端地址为202.115.24.50/24（Device B的GigabitEthernet2/0/2的IP地址）。
[DeviceB-Tunnel0] source 202.115.24.50
# 配置Tunnel0接口的目的端地址为202.115.22.48/24（Device A的GigabitEthernet2/0/2的IP地址）。
[DeviceB-Tunnel0] destination 202.115.22.48
[DeviceB-Tunnel0] quit
# 配置从DeviceB经过Tunnel0接口到Corporate network的静态路由。
[DeviceB] ip route-static 192.168.1.1 255.255.255.0 tunnel 0
(3) 配置IPsec VPN
# 配置IKE keychain。
[DeviceB] ike keychain keychain1
[DeviceB-ike-keychain-keychain1] pre-shared-key address 202.115.22.48 255.255.255.0 key simple
123
[DeviceB-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。
[DeviceB] acl number 3000
[DeviceB-acl-adv-3000] rule 0 permit gre source 202.115.24.50 0 destination 202.115.22.48 0
[DeviceB-acl-adv-3000] quit
# 配置IPsec安全提议。
[DeviceB] ipsec transform-set tran1
[DeviceB-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceB-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceB-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceB] ipsec policy policy1 1 isakmp
[DeviceB-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceB-ipsec-policy-isakmp-policy1-1] remote-address 202.115.22.48
[DeviceB-ipsec-policy-isakmp-policy1-1] transform-set tran1 [DeviceB-ipsec-policy-isakmp-policy1-1] quit
# 在接口GigabitEthernet2/0/2上应用安全策略。
[DeviceB] interface gigabitethernet 2/0/2
[DeviceB-GigabitEthernet2/0/2] ipsec apply policy policy1
[DeviceB-GigabitEthernet2/0/2] quit
5.5 验证配置
# 以Corporate network的主机192.168.1.2向Remote office network的主机192.168.2.2发起通信为例，从192.168.1.2 ping 192.168.2.2，会触发IPsec协商，建立IPsec隧道，在成功建立IPsec隧道后，可以ping通。
C:Userscorporatenetwork> ping 192.168.2.2
Pinging 192.168.2.2 with 32 bytes of data:
Request timed out.
Reply from 192.168.2.2: bytes=32 time=2ms TTL=254
Reply from 192.168.2.2: bytes=32 time=2ms TTL=254
Reply from 192.168.2.2: bytes=32 time=1ms TTL=254
Ping statistics for 192.168.2.2:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
# 在Device A上使用display ike sa命令，可以看到第一阶段的SA正常建立。
Connection-ID Remote Flag DOI
------------------------------------------------------------------
2 202.115.22.49 RD IPSEC
Flags:
RD--READY RL--REPLACED FD-FADING
# 在Device A上使用display ipsec sa命令可以看到IPsec SA的建立情况。
-------------------------------
Interface: GigabitEthernet2/0/2
-------------------------------
-----------------------------
IPsec policy: policy1
Sequence number: 1
Mode: isakmp
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect forward secrecy:
Path MTU: 1443 Tunnel:
local address: 202.115.22.48
remote address: 202.115.24.50
Flow:
sour addr: 202.115.22.48/255.255.255.255 port: 0 protocol: gre
dest addr: 202.115.24.50/255.255.255.255 port: 0 protocol: gre
[Inbound ESP SAs]
SPI: 2130348402 (0x7efa8972)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843199/3573
Max received sequence-number: 3
Anti-replay check enable: Y
Anti-replay window size: 64
UDP encapsulation used for NAT traversal: N
Status: Active
[Outbound ESP SAs]
SPI: 2811839266 (0xa7994322)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843199/3573
Max sent sequence-number: 3
UDP encapsulation used for NAT traversal: N
Status: Active
# 在Device A上通过命令display interface tunnel 0可以查看经过GRE隧道传输的流量情况。
Tunnel0
Current state: UP
Line protocol state: UP
Description: Tunnel0 Interface
Bandwidth: 64kbps
Maximum Transmit Unit: 1476
Internet Address is 10.1.1.1/24 Primary
Tunnel source 202.115.22.48, destination 202.115.24.50
Tunnel keepalive disabled
Tunnel TTL 255
Tunnel protocol/transport GRE/IP
GRE key disabled
Checksumming of GRE packets disabled
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0 Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last clearing of counters: Never
Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Input: 43 packets, 3480 bytes, 0 drops
Output: 45 packets, 3740 bytes, 2 drops
# 从Remote office network的主机向Corporate network的主机发起通信验证方法相同，此不赘述。
5.6 配置文件
• Device A：
#
interface GigabitEthernet2/0/1
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet2/0/2
ip address 202.115.22.48 255.255.255.0
ipsec apply policy policy1
#
interface Tunnel0 mode gre
ip address 10.1.1.1 255.255.255.0
source 202.115.22.48
destination 202.115.24.50
#
ip route-static 192.168.2.0 24 Tunnel0
#
acl number 3000
rule 0 permit gre source 202.115.22.48 0 destination 202.115.24.50 0
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 202.115.24.50
#
ike keychain keychain1
pre-shared-key address 202.115.24.50 255.255.255.0 key cipher $c$3$n6jdlYtuR+K6mijQ8
qp4hMMjV/iteA==
#
• Devoce B：
# interface GigabitEthernet2/0/1
ip address 192.168.2.1 255.255.255.0
#
interface GigabitEthernet2/0/2
ip address 202.115.24.50 255.255.255.0
ipsec apply policy policy1
#
interface Tunnel0 mode gre
ip address 10.1.1.2 255.255.255.0
source 202.115.24.50
destination 202.115.22.48
#
ip route-static 192.168.1.1 24 Tunnel0
#
acl number 3000
rule 0 permit ip source 202.115.24.50 0 destination 202.115.22.48 0
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 202.115.22.48
#
ike keychain keychain1
pre-shared-key address 202.115.22.48 255.255.255.0 key cipher $c$3$n6jdlYtuR+K6mijQ8
qp4hMMjV/iteA==
#
6 IPsec同流双隧道的典型配置举例
6.1 组网需求
如图17所示组网，要求：
• 在Device A和Device B之间建立IPsec隧道，对Host A所在的子网（10.1.1.0/24）与Host B所在的子网（10.1.2.0/24）之间的数据流进行安全保护。
• Device B上通过两条链路接入互联网，在这两条链路上配置相同的IPsec隧道形成备份。
• 使用IKE自动协商方式建立SA，安全协议采用ESP协议，加密算法采用DES，认证算法采用SHA1-HMAC-96。
• 在Device B上配置共享源接口安全策略，实现数据流量在不同接口间平滑切换。
图17 IPsec同流双隧道组网图
6.2 使用版本
本举例是在R0106版本上进行配置和验证的。
6.3 配置步骤
6.3.1 Device A的配置
(1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceA] interface gigabitethernet 2/0/1
[DeviceA-GigabitEthernet2/0/1] ip address 2.2.1.2 255.255.255.0
[DeviceA-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[DeviceA] interface gigabitethernet 2/0/2
[DeviceA-GigabitEthernet2/0/2] ip address 10.1.1.1 255.255.255.0
[DeviceA-GigabitEthernet2/0/2] quit
# 配置访问10.1.2.0网段的静态路由。
[DeviceA] ip route-static 10.1.2.0 255.255.255.0 2.2.2.3
[DeviceA] ip route-static 10.1.2.0 255.255.255.0 4.4.4.5
# 配置到Device B上Loopback0接口的静态路由。
[DeviceA] ip route-static 3.3.3.3 255.255.255.255 2.2.2.3
[DeviceA] ip route-static 3.3.3.3 255.255.255.255 4.4.4.5
(2) 配置IPsec VPN
# 配置IKE keychain。
[DeviceA] ike keychain keychain1
[DeviceA-ike-keychain-keychain1] pre-shared-key address 3.3.3.3 255.255.255.255 key simple 123
[DeviceA-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。
[DeviceA] acl number 3000
[DeviceA-acl-adv-3000] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[DeviceA-acl-adv-3000] quit # 配置IPsec安全提议。
[DeviceA] ipsec transform-set tran1
[DeviceA-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceA-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceA] ipsec policy policy1 1 isakmp
[DeviceA-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceA-ipsec-policy-isakmp-policy1-1] remote-address 3.3.3.3
[DeviceA-ipsec-policy-isakmp-policy1-1] transform-set tran1
[DeviceA-ipsec-policy-isakmp-policy1-1] quit
# 在接口GigabitEthernet2/0/1上应用安全策略。
[DeviceA] interface gigabitethernet 2/0/1
[DeviceA-GigabitEthernet2/0/1] ipsec apply policy policy1
[DeviceA-GigabitEthernet2/0/1] quit
6.3.2 Device B的配置
(1) 配置各接口IP地址
# 配置接口GigabitEthernet2/0/1的IP地址。
[DeviceB] interface gigabitethernet 2/0/1
[DeviceB-GigabitEthernet2/0/1] ip address 2.2.2.3 255.255.255.0
[DeviceB-GigabitEthernet2/0/1] quit
# 配置接口GigabitEthernet2/0/2的IP地址。
[DeviceB] interface gigabitethernet 2/0/2
[DeviceB-GigabitEthernet2/0/2] ip address 4.4.4.5 255.255.255.0
[DeviceB-GigabitEthernet2/0/2] quit
# 配置接口GigabitEthernet2/0/3的IP地址。
[DeviceB] interface gigabitethernet 2/0/3
[DeviceB-GigabitEthernet2/0/3] ip address 10.1.2.1 255.255.255.0
[DeviceB-GigabitEthernet2/0/3] quit
# 配置接口Loopback 0的IP地址。
[DeviceB] interface loopback 0
[DeviceB-LoopBack0] ip address 3.3.3.3 255.255.255.0
[DeviceB-LoopBack0] quit
# 配置访问10.1.1.0网段的静态路由。
[DeviceA] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet 2/0/1 2.2.1.2
[DeviceA] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet 2/0/2 2.2.1.2
(2) 配置IPsec VPN
# 配置IKE keychain。
[DeviceB] ike keychain keychain1
[DeviceB-ike-keychain-keychain1] pre-shared-key address 2.2.1.2 255.255.255.0 key simple 123
[DeviceB-ike-keychain-keychain1] quit
# 创建ACL3000，定义需要IPsec保护的数据流。 [DeviceB] acl number 3000
[DeviceB-acl-adv-3000] rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
[DeviceB-acl-adv-3000] quit
# 配置IPsec安全提议。
[DeviceB] ipsec transform-set tran1
[DeviceB-ipsec-transform-set-tran1] esp encryption-algorithm des
[DeviceB-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[DeviceB-ipsec-transform-set-tran1] quit
# 创建一条IKE协商方式的IPsec安全策略，名称为policy1，序列号为1。
[DeviceB] ipsec policy policy1 1 isakmp
[DeviceB-ipsec-policy-isakmp-policy1-1] security acl 3000
[DeviceB-ipsec-policy-isakmp-policy1-1] remote-address 2.2.1.2
[DeviceB-ipsec-policy-isakmp-policy1-1] transform-set tran1
[Device-ipsec-policy-isakmp-policy1-1] quit
# 在接口GigabitEthernet2/0/1上应用安全策略。
[DeviceB] interface gigabitethernet 2/0/1
[DeviceB-GigabitEthernet2/0/1] ipsec apply policy policy1
[DeviceB-GigabitEthernet2/0/1] quit
# 在接口GigabitEthernet2/0/2上应用安全策略。
[DeviceB] interface gigabitethernet 2/0/2
[DeviceB-GigabitEthernet2/0/2] ipsec apply policy policy1
[DeviceB-GigabitEthernet2/0/2] quit
# 配置IPsec安全策略policy1为共享源接口安全策略，共享源接口为Loopback0。
[DeviceB] ipsec policy policy1 local-address loopback 0
6.4 验证配置
# 从Host A ping Host B，会触发IPsec协商，建立IPsec隧道，在成功建立IPsec隧道后，可以ping通。
C:Usershosta> ping 10.1.2.2
Pinging 10.1.2.2 with 32 bytes of data:
Request timed out.
Reply from 10.1.2.2: bytes=32 time=3ms TTL=126
Reply from 10.1.2.2: bytes=32 time=1ms TTL=126
Reply from 10.1.2.2: bytes=32 time=5ms TTL=126
Ping statistics for 10.1.2.2:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 5ms, Average = 3ms
# 在Device A上使用display ike sa命令，可以看到第一阶段的SA正常建立。
[DeviceA] display ike sa
Connection-ID Remote Flag DOI
------------------------------------------------------------------ 9 3.3.3.3 RD IPSEC
Flags:
RD--READY RL--REPLACED FD-FADING
# 在Device A上使用display ipsec sa命令可以看到IPsec SA的建立情况。
[DeviceA] display ipsec sa
-------------------------------
Interface: GigabitEthernet2/0/1
-------------------------------
-----------------------------
IPsec policy: policy1
Sequence number: 1
Mode: isakmp
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect forward secrecy:
Path MTU: 1443
Tunnel:
local address: 2.2.1.2
remote address: 3.3.3.3
Flow:
sour addr: 10.1.1.0/255.255.255.0 port: 0 protocol: ip
dest addr: 10.1.2.0/255.255.255.0 port: 0 protocol: ip
[Inbound ESP SAs]
SPI: 1851852454 (0x6e6106a6)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843199/3035
Max received sequence-number: 3
Anti-replay check enable: Y
Anti-replay window size: 64
UDP encapsulation used for NAT traversal: N
Status: Active
[Outbound ESP SAs]
SPI: 718692851 (0x2ad661f3)
Transform set: ESP-ENCRYPT-DES-CBC ESP-AUTH-SHA1
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843199/3035
Max sent sequence-number: 3
UDP encapsulation used for NAT traversal: N
Status: Active # 从Host B向Host A发起通信验证方法相同，此不赘述。
6.5 配置文件
• Device A：
#
interface GigabitEthernet2/0/1
ip address 2.2.1.2 255.255.255.0
ipsec apply policy policy1
#
interface GigabitEthernet2/0/2
ip address 10.1.1.1 255.255.255.0
#
ip route-static 3.3.3.3 32 2.2.2.3
ip route-static 3.3.3.3 32 4.4.4.5
ip route-static 10.1.2.0 24 2.2.2.3
ip route-static 10.1.2.0 24 4.4.4.5
#
acl number 3000
rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 3.3.3.3
#
ike keychain keychain1
pre-shared-key address 3.3.3.3 255.255.255.255 key cipher
$c$3$n6jdlYtuR+K6mijQ8qp4hMMjV/iteA==
#
• Device B：
#
interface LoopBack0
ip address 3.3.3.3 255.255.255.0
#
interface GigabitEthernet2/0/1
ip address 2.2.2.3 255.255.255.0
ipsec apply policy policy1
#
interface GigabitEthernet2/0/2
ip address 4.4.4.5 255.255.255.0 ipsec apply policy policy1
#
interface GigabitEthernet2/0/3
ip address 10.1.2.1 255.255.255.0
#
ip route-static 10.1.1.0 24 GigabitEthernet2/0/1 2.2.1.2
ip route-static 10.1.1.0 24 GigabitEthernet2/0/2 2.2.1.2
#
acl number 3000
rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec policy policy1 1 isakmp
transform-set tran1
security acl 3000
remote-address 2.2.1.2
#
ipsec policy policy1 local-address LoopBack0
#
ike keychain keychain1
pre-shared-key address 2.2.1.2 255.255.255.0 key cipher $c$3$n6jdlYtuR+K6mijQ8
qp4hMMjV/iteA==
#
发布者：admin，转转请注明出处：http://www.yc00.com/news/1688940044a185955.html
评论列表（0条）