在華為設備上實戰站點到站點的虛擬私有網絡
掌握華為設備上IKE方案實施站點到站點的虛擬私有網絡
IPSec在IP層通過加密與數據來源認證等方式，來保證數據包在網絡上傳輸時的私有性、真實性、完整性和抗重放。
IPSec加密和驗證算法所使用的密鑰可以手工配置，也可以通過因特網密鑰交換IKE（Internet Key Exchange）協議動態協商。IKE協議建立在Internet安全聯盟和密鑰管理協議ISAKMP（Internet Security Association and Key Management Protocol）框架之上，采用DH（Diffie-Hellman）算法在不安全的網絡上安全地分發密鑰、驗證身份，以保證數據傳輸的安全性。IKE協議可提升密鑰的安全性，並降低IPSec管理復雜度。
目的
在Internet的傳輸中，絕大部分數據的內容都是明文傳輸的，這樣就會存在很多潛在的危險，比如：密碼、銀行帳戶的信息被竊取、篡改，用戶的身份被冒充，遭受網絡惡意×××等。網絡中部署IPSec後，可對傳輸的數據進行保護處理，降低信息泄漏的風險。
受益
IPSec通過加密與驗證等方式，從以下幾個方面保障了用戶業務數據在Internet中的安全傳輸：
數據來源驗證：接收方驗證發送方身份是否合法。
數據加密：發送方對數據進行加密，以密文的形式在Internet上傳送，接收方對接收的加密數據進行解密後處理或直接轉發。
數據完整性：接收方對接收的數據進行驗證，以判定報文是否被篡改。
抗重放：接收方拒絕舊的或重復的數據包，防止惡意用戶通過重復發送捕獲到的數據包所進行的×××。
2.實施拓撲圖
3.實驗步驟
3.1 路由問題
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2 //該路由可以解決到達對端通信點以及對端加解密點的通信問題
3.2 實施ACL匹配感興趣流
這些流量將被×××做安全處理
acl number 3000
rule 5 permit ip source 10.1.10.0 0.0.0.255 destination 10.1.20.0 0.0.0.255
3.3 配置IPSEC提案
ipsec proposal 10
esp authentication-algorithm sha2-384
esp encryption-algorithm aes-128
3.4 配置IKE提案
ike proposal 10
encryption-algorithm aes-cbc-128
dh group2
3.5配置IKE對等體組，協商對等體
ike peer R2 v1
pre-shared-key simple qytang
ike-proposal 10
remote-address 12.1.1.2
3.6配置策略匯總
ipsec policy P1 10 isakmp
security acl 3000
ike-peer R2
proposal 10
4.將策略調用在接口
interface GigabitEthernet0/0/0
ip address 12.1.1.1 255.255.255.0
ipsec policy P1
AR2的配置幾乎和AR1相同，大部分內容比如acl將流量的源目對調即可，請參考如下配置
acl number 3000
rule 5 permit ip source 10.1.20.0 0.0.0.255 destination 10.1.10.0 0.0.0.255
#
ipsec proposal 10
esp authentication-algorithm sha2-384
esp encryption-algorithm aes-128
#
ike proposal 10
encryption-algorithm aes-cbc-128
dh group2
#
ike peer R1 v1
pre-shared-key simple qytang
ike-proposal 10
remote-address 12.1.1.1
#
ipsec policy P1 10 isakmp
security acl 3000
ike-peer R1
proposal 10
#
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
ipsec policy P1
#
interface GigabitEthernet0/0/2
ip address 10.1.20.254 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.15.驗證IPSEC的各種狀態以便排錯
驗證：
[Gateway1]display ike sa
Conn-ID Peer ××× Flag(s) Phase
---------------------------------------------------------------
2 12.1.1.2 0 RD|ST 2
1 12.1.1.2 0 RD|ST 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
[Gateway1]dis ike peer
Number of IKE peers: 1
Peer name Exchange Remote NAT
mode name traversal
-------------------------------------------------------
R2 Main Disable
[Gateway1]dis ike statistics v1
----------------------------------------------------------
IKE V1 statistics information
Number of total peers : 18
Number of policy peers : 1
Number of profile peers : 17
Number of proposals : 2
Number of established V1 phase 1 SAs : 1
Number of established V1 phase 2 SAs : 1
Number of total V1 phase 1 SAs : 1
Number of total V1 phase 2 SAs : 1
Number of total SAs : 2
Keep alive time : 0
Keep alive interval : 0
keepalive spi list : Disable
----------------------------------------------------------
[Gateway1]dis ipsec sa // 查看IPSEC SA，它用於確定網絡的兩側，同時進行數據加解密
===============================
Interface: GigabitEthernet0/0/0
Path MTU: 1500
===============================
-----------------------------
IPSec policy name: "P1"
Sequence number : 10
Acl Group : 3000
Acl rule : 5
Mode : ISAKMP
-----------------------------
Connection ID : 2
Encapsulation mode: Tunnel
Tunnel local : 12.1.1.1
Tunnel remote : 12.1.1.2
Flow source : 10.1.10.0/255.255.255.0 0/0
Flow destination : 10.1.20.0/255.255.255.0 0/0
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 1214314935 (0x4860f9b7)
Proposal: ESP-ENCRYPT-AES-128 SHA2-384-192
SA remaining key duration (bytes/sec): 1887283200/3079
Max sent sequence-number: 10
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 2003986867 (0x777269b3)
Proposal: ESP-ENCRYPT-AES-128 SHA2-384-192
SA remaining key duration (bytes/sec): 1887436260/3079
Max received sequence-number: 9
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
[Gateway1]dis ipsec policy
===========================================
IPSec policy group: "P1"
Using interface: GigabitEthernet0/0/0
===========================================
Sequence number: 10
Security data flow: 3000
Peer name : R2
Perfect forward secrecy: None
Proposal name: 10
IPSec SA local duration(time based): 3600 seconds
IPSec SA local duration(traffic based): 1843200 kilobytes
Anti-replay window size: 32
SA trigger mode: Automatic
Route inject: None
Qos pre-classify: Disable
[Gateway1]dis ipsec statistics esp
Inpacket count : 9
Inpacket auth count : 0
Inpacket decap count : 0
Outpacket count : 10
Outpacket auth count : 0
Outpacket encap count : 0
Inpacket drop count : 0
Outpacket drop count : 0
BadAuthLen count : 0
AuthFail count : 0
InSAAclCheckFail count : 0
PktDuplicateDrop count : 0
PktSeqNoTooSmallDrop count: 0
PktInSAMissDrop count : 0需要註意的是ensp的acl並不一定匹配，如下所示
<Gateway1>dis acl all
Total quantity of nonempty ACL number is 1
Advanced ACL 3000, 1 rule
Acl‘s step is 5
rule 5 permit ip source 10.1.10.0 0.0.0.255 destination 10.1.20.0 0.0.0.255
6.查看安全處理的報文
下圖幫您認識ESP報文，您不能在看到icmp報文，因為數據被加密處理
在華為設備上實戰站點到站點的虛擬私有網絡