在兩個(gè)站點(diǎn)之間建立IPSec VPN
IPSec VPN的配置步驟：
1.按照拓?fù)鋱D配置各個(gè)路由器接口IP地址、PC基礎(chǔ)信息
按照拓?fù)鋱D自行完成，最后查看AR1垃喊、AR2吧恃、AR3的接口ip地址
[AR1]dis ip int brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 3
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 1
Interface IP Address/Mask Physical Protocol
GigabitEthernet0/0/0 202.108.10.1/30 up up
GigabitEthernet0/0/1 10.10.10.1/24 up up
GigabitEthernet0/0/2 unassigned down down
NULL0 unassigned up up(s)
[AR2]dis ip int brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 3
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 1
Interface IP Address/Mask Physical Protocol
GigabitEthernet0/0/0 202.108.20.1/30 up up
GigabitEthernet0/0/1 10.10.20.1/24 up up
GigabitEthernet0/0/2 unassigned down down
NULL0
[AR3]dis ip int brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 3
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 1
Interface IP Address/Mask Physical Protocol
GigabitEthernet0/0/0 202.108.10.2/30 up up
GigabitEthernet0/0/1 202.108.20.2/30 up up
GigabitEthernet0/0/2 unassigned down down
NULL0
2.在AR1和AR2上通過(guò)靜態(tài)默認(rèn)路由的方式又憨，指定去往對(duì)端的路由
[AR1]ip route-static 0.0.0.0 0 202.108.10.2
[AR2]ip route-static 0.0.0.0 0 202.108.20.2
測(cè)試站點(diǎn)1與站點(diǎn)2之間的連通性
[AR1]ping 202.108.20.1
PING 202.108.20.1: 56 data bytes, press CTRL_C to break
Request time out
Reply from 202.108.20.1: bytes=56 Sequence=2 ttl=254 time=40 ms
Reply from 202.108.20.1: bytes=56 Sequence=3 ttl=254 time=20 ms
Reply from 202.108.20.1: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 202.108.20.1: bytes=56 Sequence=5 ttl=254 time=30 ms
--- 202.108.20.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 20/30/40 ms
從測(cè)試結(jié)果得出AR1與AR2可以連通翠霍。
PC>ping 10.10.20.20
Ping 10.10.20.20: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!
--- 10.10.20.20 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
但是站點(diǎn)1的內(nèi)網(wǎng)主機(jī)PC1與站點(diǎn)2的內(nèi)網(wǎng)主機(jī)之間無(wú)法相互訪問(wèn)。
3.使用高級(jí)IP ACL指定需要通過(guò)IPSec隧道進(jìn)行保護(hù)的流量
[AR1]acl 3010
[AR1-acl-adv-3010]rule permit ip source 10.10.10.0 0.0.0.255 destination 10.10.20.0 0.0.0.255
[AR1-acl-adv-3010]rule deny ip
AR1上只放行源IP為10.10.10.0/24蠢莺，同時(shí)目的IP為10.10.20.0/24的流量
[AR2]acl 3020
[AR2-acl-adv-3020]rule permit ip source 10.10.20.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
[AR2-acl-adv-3020]rule deny ip
AR1上只放行源IP為10.10.20.0/24寒匙，同時(shí)目的IP為10.10.10.0/24的流量。
4.創(chuàng)建IPSec安全提議躏将，并指定IPSec使用的各項(xiàng)參數(shù)
[AR1]ipsec proposal prop10
[AR1-ipsec-proposal-prop10]encapsulation-mode tunnel
[AR1-ipsec-proposal-prop10]transform esp
[AR1-ipsec-proposal-prop10]esp authentication-algorithm sha2-256
[AR1-ipsec-proposal-prop10]esp encryption-algorithm aes-128
AR1創(chuàng)建名為prop10的IPSec安全協(xié)議锄弱，指定了用來(lái)建立連接的各種參數(shù)，包括數(shù)據(jù)封裝模式祸憋，安全協(xié)議会宪、認(rèn)證和加密算法。
[AR2]ipsec proposal prop20
[AR2-ipsec-proposal-prop20]esp authentication-algorithm sha2-256
[AR2-ipsec-proposal-prop20]esp encryption-algorithm aes-128
AR2創(chuàng)建名為prop20的IPSec安全協(xié)議蚯窥，AR1與AR2通過(guò)對(duì)比雙方支持的IPSec安全提議掸鹅，并對(duì)IPSec所需要使用的認(rèn)證和加密算法進(jìn)行協(xié)商。
查看AR1上的IPSec安全協(xié)議
[AR1]dis ipsec proposal
Number of proposals: 1
IPSec proposal name: prop10
Encapsulation mode: Tunnel
Transform : esp-new
ESP protocol : Authentication SHA2-HMAC-256
Encryption AES-128
5.創(chuàng)建IKE安全提議拦赠，并指定IKE使用的各項(xiàng)參數(shù)
[AR1]ike proposal 10
[AR1-ike-proposal-10]authentication-method pre-share
[AR1-ike-proposal-10]authentication-algorithm sha1
[AR1-ike-proposal-10]encryption-algorithm aes-cbc-128
[AR2]ike proposal 20
[AR2-ike-proposal-20]authentication-algorithm sha1
[AR2-ike-proposal-20]encryption-algorithm aes-cbc-128
IKE安全提議的編號(hào)取值范圍是1~99巍沙，在IKE安全提議中，指定IKE尾交換和保護(hù)密鑰所使用的認(rèn)證方式荷鼠，認(rèn)證和加密算法句携。
6.創(chuàng)建IKE對(duì)等體，并在其中引用配置的IKE安全提議
[AR1]ike peer ike10 v1
[AR1-ike-peer-ike10]ike-proposal 10
[AR1-ike-peer-ike10]pre-shared-key cipher huawei123
[AR1-ike-peer-ike10]remote-address 202.108.20.1
[AR2]ike peer ike20 v1
[AR2-ike-peer-ike20]ike-proposal 20
[AR2-ike-peer-ike20]pre-shared-key cipher huawei123
[AR2-ike-peer-ike20]remote-address 202.108.10.1
使用系統(tǒng)視圖命令ike peer ike20 v1創(chuàng)建了一個(gè)對(duì)等體允乐，在IKE視圖中矮嫉，制定了對(duì)端IP地址、應(yīng)用了之前建立的IKE安全提議喳篇，并定義了預(yù)共享密鑰敞临。
在AR1上查看IKE對(duì)等體
[AR1]dis ike peer verbose
Number of IKE peers: 1
------------------------------------------
Peer name : ike10
Exchange mode : main on phase 1
Pre-shared-key cipher : "@J*U2S*(7F,YWX*NZ55OA!!
Proposal : 10
Local ID type : IP
DPD : Disable
DPD mode : Periodic
DPD idle time : 30
DPD retransmit interval: 15
DPD retry limit : 3
Host name :
Peer IP address : 202.108.20.1
VPN name :
Local IP address :
Local name :
Remote name :
NAT-traversal : Disable
Configured IKE version : Version one
PKI realm : NULL
Inband OCSP : Disable
---- More ----
從輸出命令可以看到，目前為止所配置的與IKE相關(guān)的所有參數(shù)麸澜，對(duì)等體名稱（ike10），IKE安全提議號(hào)（10）奏黑，IKE對(duì)等體IP地址（202.108.20.1）和IKE版本（Version one）炊邦。
7.創(chuàng)建IPSec安全策略，并在其中應(yīng)用ACL熟史、IPSec安全提議和IKE對(duì)等體
配置安全策略
[AR1]ipsec policy po10 10 isakmp
[AR1-ipsec-policy-isakmp-po10-10]ike-peer ike10
[AR1-ipsec-policy-isakmp-po10-10]proposal prop10
[AR1-ipsec-policy-isakmp-po10-10]security acl 3010
[AR2]ipsec policy po20 20 isakmp
[AR2-ipsec-policy-isakmp-po20-20]ike-peer ike20
[AR2-ipsec-policy-isakmp-po20-20]proposal prop20
[AR2-ipsec-policy-isakmp-po20-20]security acl 3020
將步驟2-5中創(chuàng)建的參數(shù)全部應(yīng)用到了IPSec安全策略中馁害。
在AR1中查看IPSec安全策略
[AR1]dis ipsec policy
===========================================
IPSec policy group: "po10"
Using interface:
===========================================
Sequence number: 10
Security data flow: 3010
Peer name : ike10
Perfect forward secrecy: None
Proposal name: prop10
IPSec SA local duration(time based): 3600 seconds
IPSec SA local duration(traffic based): 1843200 kilobytes
Anti-replay window size: 32
SA trigger mode: Automatic
Route inject: None
Qos pre-classify: Disable
從輸出中可以找到剛才應(yīng)用的IKE對(duì)等體名稱（ike10），IPSec安全提議（prop10）蹂匹，以及指定了搜保護(hù)流量的ACL（3010）碘菜。
8.建立連接的兩端，在面向Internet的接口上應(yīng)用安全策略。
[AR1]interface g0/0/0
[AR1-GigabitEthernet0/0/0]ipsec policy po10
[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]ipsec policy po20
在AR1和AR2上查看已建立的IKE SA
[AR1]DIS IKE SA
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
3 202.108.20.1 0 RD|ST 2
2 202.108.20.1 0 RD|ST 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
[AR2]dis ike sa
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
3 202.108.10.1 0 RD 2
2 202.108.10.1 0 RD 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
AR1上面多了一個(gè)ST標(biāo)記忍啸，表示AR1是IKE SA協(xié)商過(guò)程的發(fā)起方仰坦。AR1和AR2都有的標(biāo)記RD表示IKE SA已經(jīng)成功建立。
在AR1和AR2上查看已經(jīng)建立的IPSec SA
[AR1]dis ipsec sa br
Number of SAs:2
Src address Dst address SPI VPN Protocol Algorithm
-------------------------------------------------------------------------------
202.108.10.1 202.108.20.1 1024164772 0 ESP E:AES-128 A:SHA2_256_
128
202.108.20.1 202.108.10.1 168286895 0 ESP E:AES-128 A:SHA2_256_
128
<AR2>dis ipsec sa brief
Number of SAs:2
Src address Dst address SPI VPN Protocol Algorithm
-------------------------------------------------------------------------------
202.108.10.1 202.108.20.1 1024164772 0 ESP E:AES-128 A:SHA2_256_
128
202.108.20.1 202.108.10.1 168286895 0 ESP E:AES-128 A:SHA2_256_
128
SPI的作用是唯一標(biāo)識(shí)一個(gè)IPSec SA计雌。在IPSec流量封裝過(guò)程中悄晃，路由器從SADB中查找相應(yīng)的SA的SPI值并添加ESP頭部。
PC1向PC2發(fā)起ping測(cè)試
PC>ping 10.10.20.20
Ping 10.10.20.20: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 10.10.20.20: bytes=32 seq=2 ttl=127 time=31 ms
From 10.10.20.20: bytes=32 seq=3 ttl=127 time=31 ms
From 10.10.20.20: bytes=32 seq=4 ttl=127 time=16 ms
From 10.10.20.20: bytes=32 seq=5 ttl=127 time=15 ms
--- 10.10.20.20 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/23/31 ms
