Ipsec用于在數(shù)據(jù)傳輸過程中的加密協(xié)議
1. 搭建環(huán)境拓撲
拓撲
2. 配置第一階段：isakmp協(xié)商
需要配置的有isakmp協(xié)商的加密算法鞠呈、驗證算法、驗證方式和共享密鑰及可選的group值和生存時間Lifetime
R1配置：
R1(config)#crypto isakmp policy 1 定義策略
R1(config-isakmp)#encryption 3des 加密算法為3des
R1(config-isakmp)#hash md5 驗證算法為md5
R1(config-isakmp)#authentication pre-share 驗證方式為預共享密鑰
R1(config-isakmp)#group 5 組值
R1(config-isakmp)#lifetime 120 生存時間
R1(config)#crypto isakmp key 0 ruijie address 172.16.50.2 配置共享密鑰ruijie
R2配置：
R2的isakmp配置與R1完全一致右钾。
R2(config)#crypto isakmp key 0 ruijie address 172.16.50.1 配置共享密鑰ruijie
3. 第二階段：ipsec配置
R1配置：
定義IP數(shù)據(jù)的保護策略蚁吝，主要是ESP還是AH、加密算法舀射、驗證算法窘茁、傳輸模式還是隧道模式，定義需要被Ipsec保護的數(shù)據(jù)脆烟，即感興趣流
R1(config)#crypto ipsec transform-set IPSEC esp-3des esp-sha-hmac 定義策略的名稱為IPSEC山林，加密算法為esp-3des，驗證算法為esp-sha-hmac
R1(cfg-crypto-trans)#mode tunnel 隧道模式
R1(config)#access-list 100 permit ip host 1.1.1.1 host 2.2.2.2 需要被保護的數(shù)據(jù)邢羔，即感興趣流
R2配置：
此處配置與R1完全一致
R2(config)#access-list 100 permit ip host 2.2.2.2 host 1.1.1.1 需要被保護的數(shù)據(jù)驼抹，即感興趣流
4. 定義crypto map
定義IPsec SA對段通信實體，調(diào)用配置的第二階段IPsec SA策略拜鹤、感興趣流
R1配置：
R1(config)#crypto map MAP 1 ipsec-isakmp 定義map
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R1(config-crypto-map)#set peer 172.16.50.2 對端體ip
R1(config-crypto-map)#set transform-set IPSEC 調(diào)用第二階段的ipsec策略
R1(config-crypto-map)#match address 100 匹配感興趣流
R2配置：
與R1配置完全一致
R2(config-crypto-map)#set peer 172.16.50.1 對端體ip
5. 將map應(yīng)用在接口上
使需要被保護的數(shù)據(jù)流通過出口接口出去框冀，則需要配置路由
R1配置：
R1(config)#ip route 2.2.2.2 255.255.255.255 172.16.50.2
R1(config)#int f0/0
R1(config-if)#crypto map MAP
R2配置：
R2(config)#ip route 1.1.1.1 255.255.255.255 172.16.50.1
R2(config)#int f0/0
R2(config-if)#crypto map MAP
6. 驗證
使用擴展ping，分別查看isakmp sa和ipsec sa是否正常
show crypto isakmp sa
show crypto ipsec sa
R1#ping 2.2.2.2 source 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/22/32 m
R1#show crypto isakmp sa 協(xié)商正常
dst src state conn-id slot status
172.16.50.2 172.16.50.1 QM_IDLE 1 0 ACTIVE
R1#show crypto ipsec sa
interface: FastEthernet0/0
Crypto map tag: MAP, local addr 172.16.50.1
protected vrf: (none)
local ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/0/0)
current_peer 172.16.50.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 6, #pkts encrypt: 6, #pkts digest: 6
#pkts decaps: 6, #pkts decrypt: 6, #pkts verify: 6
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 4, #recv errors 0
local crypto endpt.: 172.16.50.1, remote crypto endpt.: 172.16.50.2
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0xEB9A4D72(3952758130)
inbound esp sas:
spi: 0xEE99A619(4003046937)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: MAP
sa timing: remaining key lifetime (k/sec): (4467890/3527)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xEB9A4D72(3952758130)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: MAP
sa timing: remaining key lifetime (k/sec): (4467890/3526)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
