HCNA_IPSEC原理及配置
阿新 • • 發佈：2019-01-06
手工方式
第1步 配置網路可達
Site1 ping 202.100.1.1能ping通
<Site1>ping 202.100.1.1 PING 202.100.1.1: 56 data bytes, press CTRL_C to break Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=30 ms Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=10 ms Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=20 ms Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms --- 202.100.1.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 10/28/50 ms
第2步 配置 ACL識別興趣流
Site1上配置
acl number 3000
rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 Site2上配置
acl number 3000
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255 第3步配置安全提議
Site1上配置
ipsec proposal proposal1
esp encryption-algorithm 3des
<Site1>display ipsec proposal Number of proposals: 1 IPSec proposal name: proposal1 Encapsulation mode: Tunnel Transform : esp-new ESP protocol : Authentication MD5-HMAC-96 Encryption 3DES
Site2上配置
ipsec proposal proposal1
esp encryption-algorithm 3des<Site2>display ipsec proposal Number of proposals: 1 IPSec proposal name: proposal1 Encapsulation mode: Tunnel Transform : esp-new ESP protocol : Authentication MD5-HMAC-96 Encryption 3DES
第4步，建立安全策略
Site1上配置
ipsec policy policy1 1 manual
security acl 3000
proposal proposal1
tunnel local 61.120.1.1
tunnel remote 202.100.1.1
sa spi inbound esp 654321
sa string-key inbound esp simple [email protected]
sa spi outbound esp 123456
sa string-key outbound esp simple [email protected]
#Site1上配置
ipsec policy policy1 1 manual
security acl 3000
proposal proposal1
tunnel local 202.100.1.1
tunnel remote 61.120.1.1
sa spi inbound esp 123456
sa string-key inbound esp simple [email protected]
sa spi outbound esp 654321
sa string-key outbound esp simple [email protected]第5步，應用安全策略
Site2上配置
interface GigabitEthernet0/0/2
ip address 61.120.1.1 255.255.255.0
ipsec policy policy1Site2上配置
interface GigabitEthernet0/0/1
ip address 202.100.1.1 255.255.255.0
ipsec policy policy1測試
Insite ping 10.1.1.1能ping通。
<Inside>
<Inside>ping 10.1.1.1
PING 10.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=60 ms
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=40 ms
Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=50 ms
Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=254 time=40 ms
Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=254 time=40 ms
--- 10.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/46/60 ms
IKE方式
前兩步相同
第3步，配置ike proposal(可以不配有預設值)
Site1配置
ike proposal 10
encryption-algorithm aes-cbc-256
dh group14
authentication-algorithm aes-xcbc-mac-96
prf aes-xcbc-128Sete2配置
ike proposal 10
encryption-algorithm aes-cbc-256
dh group14
authentication-algorithm aes-xcbc-mac-96
prf aes-xcbc-128第4步，配置ike peer
Site1配置
ike peer Site2 v2
pre-shared-key simple 123456
ike-proposal 10
remote-address 202.100.1.1Site2配置
ike peer Site1 v2
pre-shared-key simple 123456
ike-proposal 10
remote-address 61.120.1.1第5步,配置ipsec policy
Site1配置
ipsec policy policy1 1 isakmp
security acl 3000
ike-peer Site2
proposal proposal1Site2配置
ipsec policy policy1 1 isakmp
security acl 3000
ike-peer Site1
proposal proposal1第6步，應用ipsec policy
Site1配置
interface GigabitEthernet0/0/2
ip address 61.120.1.1 255.255.255.0
ipsec policy policy1Site2配置
interface GigabitEthernet0/0/1
ip address 202.100.1.1 255.255.255.0
ipsec policy policy1Insite ping 10.1.1.1能ping通。
<Inside>ping 10.1.1.1
PING 10.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=40 ms
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms
Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=50 ms
Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=254 time=50 ms
Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms
--- 10.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/44/50 msSite1檢視ike sa
<Site1>display ike sa v2
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
3 202.100.1.1 0 RD 2
1 202.100.1.1 0 RD|ST 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UPSite2檢視ike sa
<Site2>display ike sa v2
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
16 61.120.1.1 0 RD|ST 2
14 61.120.1.1 0 RD 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UPSite1檢視ipsec sa
<Site1>display ipsec sa
===============================
Interface: GigabitEthernet0/0/2
Path MTU: 1500
===============================
-----------------------------
IPSec policy name: "policy1"
Sequence number : 1
Acl Group : 3000
Acl rule : 5
Mode : ISAKMP
-----------------------------
Connection ID : 3
Encapsulation mode: Tunnel
Tunnel local : 61.120.1.1
Tunnel remote : 202.100.1.1
Flow source : 172.16.1.0/255.255.255.0 0/0
Flow destination : 10.1.1.0/255.255.255.0 0/0
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 4252858551 (0xfd7d78b7)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887114240/2220
Max sent sequence-number: 15
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 2989933471 (0xb236c39f)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887435540/2220
Max received sequence-number: 15
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: NSite2檢視ipsec sa
<Site2>display ipsec sa
===============================
Interface: GigabitEthernet0/0/1
Path MTU: 1500
===============================
-----------------------------
IPSec policy name: "policy1"
Sequence number : 1
Acl Group : 3000
Acl rule : 5
Mode : ISAKMP
-----------------------------
Connection ID : 16
Encapsulation mode: Tunnel
Tunnel local : 202.100.1.1
Tunnel remote : 61.120.1.1
Flow source : 10.1.1.0/255.255.255.0 0/0
Flow destination : 172.16.1.0/255.255.255.0 0/0
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 2989933471 (0xb236c39f)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887114240/2137
Max sent sequence-number: 15
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 4252858551 (0xfd7d78b7)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887435540/2137
Max received sequence-number: 15
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N