HCNA_IPSEC原理及配置

手工方式

第1步配置网络可达

Site1 ping 202.100.1.1能ping通


<Site1>ping 202.100.1.1
  PING 202.100.1.1: 56  data bytes, press CTRL_C to break
    Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms
    Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=30 ms
    Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=10 ms
    Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=20 ms
    Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms

  --- 202.100.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/28/50 ms

第2步配置 ACL识别兴趣流

Site1上配置

acl number 3000
 rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

Site2上配置

acl number 3000
 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

第3步配置安全提议

Site1上配置

扫描二维码关注公众号，回复： 4805128 查看本文章

ipsec proposal proposal1
 esp encryption-algorithm 3des

<Site1>display ipsec proposal 

Number of proposals: 1

IPSec proposal name: proposal1                            
 Encapsulation mode: Tunnel                            
 Transform         : esp-new
 ESP protocol      : Authentication MD5-HMAC-96                             
                     Encryption     3DES

Site2上配置

ipsec proposal proposal1
 esp encryption-algorithm 3des

<Site2>display ipsec proposal

Number of proposals: 1

IPSec proposal name: proposal1                            
 Encapsulation mode: Tunnel                            
 Transform         : esp-new
 ESP protocol      : Authentication MD5-HMAC-96                             
                     Encryption     3DES

第4步，创建安全策略

Site1上配置

ipsec policy policy1 1 manual
 security acl 3000
 proposal proposal1
 tunnel local 61.120.1.1
 tunnel remote 202.100.1.1
 sa spi inbound esp 654321
 sa string-key inbound esp simple huawei@321
 sa spi outbound esp 123456
 sa string-key outbound esp simple huawei@123
#

Site1上配置

ipsec policy policy1 1 manual
 security acl 3000
 proposal proposal1
 tunnel local 202.100.1.1
 tunnel remote 61.120.1.1
 sa spi inbound esp 123456
 sa string-key inbound esp simple huawei@123
 sa spi outbound esp 654321
 sa string-key outbound esp simple huawei@321

第5步，应用安全策略

Site2上配置

interface GigabitEthernet0/0/2
 ip address 61.120.1.1 255.255.255.0 
 ipsec policy policy1

Site2上配置

interface GigabitEthernet0/0/1
 ip address 202.100.1.1 255.255.255.0     
 ipsec policy policy1

测试

Insite ping 10.1.1.1能ping通。

<Inside>
<Inside>ping 10.1.1.1
  PING 10.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=60 ms
    Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=40 ms
    Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=50 ms
    Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=254 time=40 ms
    Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=254 time=40 ms

  --- 10.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/46/60 ms

IKE方式

前两步相同

第3步，配置ike proposal(可以不配有默认值)

Site1配置

ike proposal 10
 encryption-algorithm aes-cbc-256
 dh group14
 authentication-algorithm aes-xcbc-mac-96
 prf aes-xcbc-128

Sete2配置

ike proposal 10
 encryption-algorithm aes-cbc-256
 dh group14
 authentication-algorithm aes-xcbc-mac-96
 prf aes-xcbc-128

第4步，配置ike peer

Site1配置

ike peer Site2 v2
 pre-shared-key simple 123456
 ike-proposal 10
 remote-address 202.100.1.1

Site2配置

ike peer Site1 v2
 pre-shared-key simple 123456
 ike-proposal 10
 remote-address 61.120.1.1

第5步,配置ipsec policy

Site1配置

ipsec policy policy1 1 isakmp
 security acl 3000
 ike-peer Site2
 proposal proposal1

Site2配置

ipsec policy policy1 1 isakmp
 security acl 3000
 ike-peer Site1
 proposal proposal1

第6步，应用ipsec policy

Site1配置

interface GigabitEthernet0/0/2
 ip address 61.120.1.1 255.255.255.0 
 ipsec policy policy1

Site2配置

interface GigabitEthernet0/0/1
 ip address 202.100.1.1 255.255.255.0 
 ipsec policy policy1

Insite ping 10.1.1.1能ping通。

<Inside>ping 10.1.1.1
  PING 10.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=40 ms
    Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms
    Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=50 ms
    Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=254 time=50 ms
    Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms

  --- 10.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 30/44/50 ms

Site1查看ike sa

<Site1>display ike sa v2
    Conn-ID  Peer            VPN   Flag(s)                Phase  
  ---------------------------------------------------------------
        3    202.100.1.1     0     RD                     2     
        1    202.100.1.1     0     RD|ST                  1     

  Flag Description:
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP

Site2查看ike sa

<Site2>display ike sa v2
    Conn-ID  Peer            VPN   Flag(s)                Phase  
  ---------------------------------------------------------------
       16    61.120.1.1      0     RD|ST                  2     
       14    61.120.1.1      0     RD                     1     

  Flag Description:
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP

Site1查看ipsec sa

<Site1>display ipsec sa

===============================
Interface: GigabitEthernet0/0/2
 Path MTU: 1500
===============================

  -----------------------------
  IPSec policy name: "policy1"
  Sequence number  : 1
  Acl Group        : 3000
  Acl rule         : 5
  Mode             : ISAKMP
  -----------------------------
    Connection ID     : 3
    Encapsulation mode: Tunnel
    Tunnel local      : 61.120.1.1
    Tunnel remote     : 202.100.1.1
    Flow source       : 172.16.1.0/255.255.255.0 0/0
    Flow destination  : 10.1.1.0/255.255.255.0 0/0
    Qos pre-classify  : Disable

    [Outbound ESP SAs] 
      SPI: 4252858551 (0xfd7d78b7)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887114240/2220
      Max sent sequence-number: 15
      UDP encapsulation used for NAT traversal: N

    [Inbound ESP SAs] 
      SPI: 2989933471 (0xb236c39f)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887435540/2220
      Max received sequence-number: 15
      Anti-replay window size: 32
      UDP encapsulation used for NAT traversal: N

Site2查看ipsec sa

<Site2>display ipsec sa

===============================
Interface: GigabitEthernet0/0/1
 Path MTU: 1500
===============================

  -----------------------------
  IPSec policy name: "policy1"
  Sequence number  : 1
  Acl Group        : 3000
  Acl rule         : 5
  Mode             : ISAKMP
  -----------------------------
    Connection ID     : 16
    Encapsulation mode: Tunnel
    Tunnel local      : 202.100.1.1
    Tunnel remote     : 61.120.1.1
    Flow source       : 10.1.1.0/255.255.255.0 0/0
    Flow destination  : 172.16.1.0/255.255.255.0 0/0
    Qos pre-classify  : Disable

    [Outbound ESP SAs] 
      SPI: 2989933471 (0xb236c39f)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887114240/2137
      Max sent sequence-number: 15
      UDP encapsulation used for NAT traversal: N

    [Inbound ESP SAs] 
      SPI: 4252858551 (0xfd7d78b7)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887435540/2137
      Max received sequence-number: 15
      Anti-replay window size: 32
      UDP encapsulation used for NAT traversal: N

HCNA_IPSEC原理及配置

猜你喜欢