知

MSR路由器与MP LNS设备使用国密算法互通建立IPSEC隧道案例

2天前发表

0关注
1收藏 91浏览

张刘勇

张刘勇四段

粉丝：0人关注：0人

组网及说明

组网图:

MSR36------------------MAIPU1800X

问题描述

组网需求:

按照反馈的迈普配置 (国密ike1.0), 使用单签名证书, MSR36和迈普互通ipsec.

Msr36需要配置导入peer证书, 并且在ike-profile中指定peer证书的sn序号.

Maipu侧作为发起方, 应该也需要导入peer证书, 指定peer证书set peer-id CN=xxx

过程分析

迈普配置:

interface loopback1

ip address 2.2.2.2 255.255.255.255

exit

interface vlan1000

ip address 55.17.15.243 255.255.0.0

crypto ca identity GDFH

ca type other

subject-name CN=r2

key-type sm2

exit

crypto sm2-encryption-encode old

crypto sm2-signature old

crypto sm2 hash-e

crypto cert-usage old

crypto ike proposal ikepro

encryption sm4

inte sm3

exit

crypto ipsec proposal ipsecpro

esp sm4-old sm3

exit

crypto tunnel tunnelsm

local interface vlan 1000

peer address 172.32.36.41

set authentication sm2-de-nc

set ike proposal ikepro

set ipsec proposal ipsecpro

set dpd on-demand 10 10 2

!!set idletime 30 outbound-only

!!set auto-up

exit

crypto policy local1

flow host 2.2.2.2 host 1.1.1.1 ip ipv4-tunnel tunnelsm

set reverse-route

exit

ip route 0.0.0.0 0.0.0.0 55.17.15.254

MSR36配置:

pki domain 1

public-key sm2 signature name 1

undo crl check enable

acl number 3001

rule 0 permit ip source 1.1.1.1 0 destination 2.2.2.2 0

ipsec transform-set 1

esp encryption-algorithm sm4-cbc

esp authentication-algorithm sm3

ipsec policy 1 10 isakmp

transform-set 1

security acl 3001

remote-address 55.17.15.243

ike-profile 1

ike profile 1

certificate domain 1

exchange-mode gm-main

local-identity dn

match remote identity address 0.0.0.0 0.0.0.0

proposal 1

ike gm-main ike-version 1.0

remote-certificate serial 71

ike proposal 1

authentication-method sm2-de

encryption-algorithm sm4-cbc

authentication-algorithm sm3

interface LoopBack0

ip address 1.1.1.1 255.255.255.255

interface GigabitEthernet0/0

port link-mode route

ip address 172.32.36.41 255.255.0.0

ipsec apply policy 1

ip route-static 2.2.2.2 32 172.32.254.254

ip route-static 55.17.0.0 16 172.32.254.254

准备证书文件:

按照前方反馈, 准备签名用途的单证书

D:\gmssl\test4\output>gmssl x509 -noout -text -in r1sig.crt

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 111 (0x6f)

Signature Algorithm: sm2sign-with-sm3

Issuer: CN = testca

Validity

Not Before: Jun 5 08:20:22 2025 GMT

Not After : Jun 3 08:20:22 2035 GMT

Subject: CN = r1

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (256 bit)

pub:

04:89:95:21:44:85:25:d1:45:77:00:ba:f7:2e:69:

5f:35:68:0b:37:89:61:9a:24:e1:77:85:04:62:8e:

6c:83:6f:7d:89:fa:4e:1c:89:dd:55:c8:ee:ae:b5:

4c:bf:4e:05:20:ee:5a:fb:50:e3:fd:b7:cc:9a:60:

48:13:34:4b:ad

ASN1 OID: sm2p256v1

NIST CURVE: SM2

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

X509v3 Key Usage:

Digital Signature, Non Repudiation

Signature Algorithm: sm2sign-with-sm3

30:44:02:20:59:13:9c:95:df:df:90:dc:36:14:b1:7d:1b:0f:

f7:de:4e:7e:05:5d:93:c3:8d:5a:ad:b0:fb:9e:cb:7d:82:41:

02:20:5b:1f:a0:87:f1:a6:96:07:9c:54:e0:77:6b:e6:b5:fc:

44:2c:53:14:7c:c6:ea:b0:80:97:02:29:b3:0a:99:c8

D:\gmssl\test4\output>gmssl x509 -noout -text -in r2sig.crt

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 113 (0x71)

Signature Algorithm: sm2sign-with-sm3

Issuer: CN = testca

Validity

Not Before: Jun 5 08:54:59 2025 GMT

Not After : Jun 3 08:54:59 2035 GMT

Subject: CN = r2

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (256 bit)

pub:

04:4f:70:bb:45:d0:68:97:4e:3e:0e:e0:e3:58:2f:

3e:c3:17:e1:90:2e:1f:65:94:07:e3:d8:f5:47:22:

03:d5:58:eb:52:23:9e:8c:74:b9:c7:9b:4a:73:18:

a9:d9:fe:63:e4:e3:5f:9d:48:a5:d8:5e:a2:eb:35:

16:13:13:0f:21

ASN1 OID: sm2p256v1

NIST CURVE: SM2

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

X509v3 Key Usage:

Digital Signature, Non Repudiation

Signature Algorithm: sm2sign-with-sm3

30:45:02:21:00:ef:53:fa:1b:74:87:e8:1a:ba:75:3f:e6:09:

9e:8d:9d:73:63:f1:a8:46:4e:26:65:b9:89:c8:dd:55:a1:34:

2e:02:20:04:64:d0:44:23:4c:ba:78:28:ca:58:f6:57:fb:06:

39:e7:6e:22:fd:70:a8:d2:31:aa:30:ba:6d:60:3e:39:1e

D:\gmssl\test4\output>

MSR36导入证书:

[3620x1]disp clock

09:29:07 bj Mon 06/09/2025

Time Zone : bj add 08:00:00

[3620x1]pki import domain 1 pem local

Enter PEM-formatted certificates.

End with a Ctrl+C on a line by itself.

r1sig.crt

-----BEGIN CERTIFICATE-----

MIIBJTCBzaADAgECAgFvMAoGCCqBHM9VAYN1MBExDzANBgNVBAMMBnRlc3RjYTAe

Fw0yNTA2MDUwODIwMjJaFw0zNTA2MDMwODIwMjJaMA0xCzAJBgNVBAMMAnIxMFkw

EwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEiZUhRIUl0UV3ALr3LmlfNWgLN4lhmiTh

d4UEYo5sg299ifpOHIndVcjurrVMv04FIO5a+1Dj/bfMmmBIEzRLraMaMBgwCQYD

VR0TBAIwADALBgNVHQ8EBAMCBsAwCgYIKoEcz1UBg3UDRwAwRAIgWROcld/fkNw2

FLF9Gw/33k5+BV2Tw41arbD7nst9gkECIFsfoIfxppYHnFTgd2vmtfxELFMUfMbq

sICXAimzCpnI

-----END CERTIFICATE-----

r1sig.key

ASN1 OID: sm2p256v1

NIST CURVE: SM2

-----BEGIN EC PARAMETERS-----

BggqgRzPVQGCLQ==

-----END EC PARAMETERS-----

-----BEGIN EC PRIVATE KEY-----

MHcCAQEEIDp6oY4SSZfP9ezcB8DiR34QPsaat4Q7DiYosBlwrpl7oAoGCCqBHM9V

AYItoUQDQgAEiZUhRIUl0UV3ALr3LmlfNWgLN4lhmiThd4UEYo5sg299ifpOHInd

VcjurrVMv04FIO5a+1Dj/bfMmmBIEzRLrQ==

-----END EC PRIVATE KEY-----

testca.crt

-----BEGIN CERTIFICATE-----

MIIBETCBuAIJAP81IXZFD76JMAoGCCqBHM9VAYN1MBExDzANBgNVBAMMBnRlc3Rj

YTAeFw0yNTA2MDQxMTIxMzdaFw0yNjA2MDQxMTIxMzdaMBExDzANBgNVBAMMBnRl

c3RjYTBZMBMGByqGSM49AgEGCCqBHM9VAYItA0IABFXG/PpNyw7T1K2v+edlYzwR

13hrToIw7+n260Lnwb5xofx6JOQGHv1sZ8EtbdT4SjLAe9stP+yi9ed1ufxOMmkw

CgYIKoEcz1UBg3UDSAAwRQIgOV4+tYcggLA7C/oLDZ7XVKykyEIlT6itcTmoKZgB

aCgCIQCUhKQ7IVGdmC4XkjA48M1da9bgEKfolW+8Mauix1N+9w==

-----END CERTIFICATE-----

The trusted CA's finger print is:

MD5 fingerprint:1E64 6F55 6967 BCE0 5D25 6B95 6332 42DA

SHA1 fingerprint:02BE 2FE0 EC15 F01D D234 4CF7 BB1C 0A29 4712 D824

Is the finger print correct?(Y/N):y

[3620x1]

[3620x1]pki import domain 1 pem peer

Enter PEM-formatted certificates.

End with a Ctrl+C on a line by itself.

-----BEGIN CERTIFICATE-----

MIIBJjCBzaADAgECAgFxMAoGCCqBHM9VAYN1MBExDzANBgNVBAMMBnRlc3RjYTAe

Fw0yNTA2MDUwODU0NTlaFw0zNTA2MDMwODU0NTlaMA0xCzAJBgNVBAMMAnIyMFkw

EwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAET3C7RdBol04+DuDjWC8+wxfhkC4fZZQH

49j1RyID1VjrUiOejHS5x5tKcxip2f5j5ONfnUil2F6i6zUWExMPIaMaMBgwCQYD

VR0TBAIwADALBgNVHQ8EBAMCBsAwCgYIKoEcz1UBg3UDSAAwRQIhAO9T+ht0h+ga

unU/5gmejZ1zY/GoRk4mZbmJyN1VoTQuAiAEZNBEI0y6eCjKWPZX+wY5524i/XCo

0jGqMLptYD45Hg==

-----END CERTIFICATE-----

[3620x1]

[3620x1]disp pki certificate domain 1 local

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 111 (0x6f)

Signature Algorithm: sm3WithSM2Sign

Issuer: CN=testca

Validity

Not Before: Jun 5 08:20:22 2025 GMT

Not After : Jun 3 08:20:22 2035 GMT

Subject: CN=r1

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (256 bit)

pub:

04:89:95:21:44:85:25:d1:45:77:00:ba:f7:2e:69:

5f:35:68:0b:37:89:61:9a:24:e1:77:85:04:62:8e:

6c:83:6f:7d:89:fa:4e:1c:89:dd:55:c8:ee:ae:b5:

4c:bf:4e:05:20:ee:5a:fb:50:e3:fd:b7:cc:9a:60:

48:13:34:4b:ad

ASN1 OID: SM2

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

X509v3 Key Usage:

Digital Signature, Non Repudiation

Signature Algorithm: sm3WithSM2Sign

30:44:02:20:59:13:9c:95:df:df:90:dc:36:14:b1:7d:1b:0f:

f7:de:4e:7e:05:5d:93:c3:8d:5a:ad:b0:fb:9e:cb:7d:82:41:

02:20:5b:1f:a0:87:f1:a6:96:07:9c:54:e0:77:6b:e6:b5:fc:

44:2c:53:14:7c:c6:ea:b0:80:97:02:29:b3:0a:99:c8

[3620x1]

[3620x1]disp pki certificate domain 1 peer

Total peer certificates: 1

Serial Number: 71

Subject Name: CN=r2

[3620x1]

MP1800X导入证书:

mp1800x55(config)#crypto ca import certificate to GDFH

% Input the certificate data, press <Enter> twice to finish:

-----BEGIN CERTIFICATE-----

MIIBETCBuAIJAP81IXZFD76JMAoGCCqBHM9VAYN1MBExDzANBgNVBAMMBnRlc3Rj

YTAeFw0yNTA2MDQxMTIxMzdaFw0yNjA2MDQxMTIxMzdaMBExDzANBgNVBAMMBnRl

c3RjYTBZMBMGByqGSM49AgEGCCqBHM9VAYItA0IABFXG/PpNyw7T1K2v+edlYzwR

13hrToIw7+n260Lnwb5xofx6JOQGHv1sZ8EtbdT4SjLAe9stP+yi9ed1ufxOMmkw

CgYIKoEcz1UBg3UDSAAwRQIgOV4+tYcggLA7C/oLDZ7XVKykyEIlT6itcTmoKZgB

aCgCIQCUhKQ7IVGdmC4XkjA48M1da9bgEKfolW+8Mauix1N+9w==

-----END CERTIFICATE-----

% Input the private key data, press <Enter> twice after data to finish or press <Enter> without data to ignore:

% The Root CA Certificate has the following attributes:

Serial Number: ff352176450fbe89

Subject: CN=testca

Issuer : CN=testca

Validity

Start date: 2025-06-04 11:21:37

End date: 2026-06-04 11:21:37

Usage: General

Fingerprint(sm3) :e88544b261ecfebfac63e87ea5228e1514699d53e90efabf3cd775da34d1c616

Fingerprint(sha1):02be2fe0ec15f01dd2344cf7bb1c0a294712d824

% Do you accept this root ca-certificate[yes]/[no]:yes

% PKI: Import Certificate success.

mp1800x55(config)#

mp1800x55(config)#crypto ca import certificate to GDFH

% Input the certificate data, press <Enter> twice to finish:

-----BEGIN CERTIFICATE-----

MIIBJjCBzaADAgECAgFxMAoGCCqBHM9VAYN1MBExDzANBgNVBAMMBnRlc3RjYTAe

Fw0yNTA2MDUwODU0NTlaFw0zNTA2MDMwODU0NTlaMA0xCzAJBgNVBAMMAnIyMFkw

EwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAET3C7RdBol04+DuDjWC8+wxfhkC4fZZQH

49j1RyID1VjrUiOejHS5x5tKcxip2f5j5ONfnUil2F6i6zUWExMPIaMaMBgwCQYD

VR0TBAIwADALBgNVHQ8EBAMCBsAwCgYIKoEcz1UBg3UDSAAwRQIhAO9T+ht0h+ga

unU/5gmejZ1zY/GoRk4mZbmJyN1VoTQuAiAEZNBEI0y6eCjKWPZX+wY5524i/XCo

0jGqMLptYD45Hg==

-----END CERTIFICATE-----

% Input the private key data, press <Enter> twice after data to finish or press <Enter> without data to ignore:

-----BEGIN EC PRIVATE KEY-----

MHcCAQEEIGzHdWWhv7mrRGwkGLXjBFqrteEYBmmXlWejLdeltJr8oAoGCCqBHM9V

AYItoUQDQgAET3C7RdBol04+DuDjWC8+wxfhkC4fZZQH49j1RyID1VjrUiOejHS5

x5tKcxip2f5j5ONfnUil2F6i6zUWExMPIQ==

-----END EC PRIVATE KEY-----

% PKI: Import Certificate success.

mp1800x55(config)#

MSR36发起协商建立成功:

<3620x1>debug

<3620x1>debugging ike al

<3620x1>debugging ike all

This command is CPU intensive and might affect ongoing services. Are you sure you want to continue? [Y/N]:y

<3620x1>t d

The current terminal is enabled to display debugging logs.

<3620x1>t m

The current terminal is enabled to display logs.

<3620x1>ping -c 1 -a 1.1.1.1 2.2.2.2 ?

<cr>

<3620x1>ping -c 1 -a 1.1.1.1 2.2.2.2

Ping 2.2.2.2 (2.2.2.2) from 1.1.1.1: 56 data bytes, press CTRL_C to break

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: Received message from ipsec, message type is 0.

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: Received SA acquire message from IPsec.

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: IKE thread 1099127030448 processes a job.

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: Received SA acquire message from IPsec.

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Set IPsec SA state to IKE_P2_STATE_INIT.

*Jun 9 09:35:32:965 2025 3620x1 IKE/7/EVENT: IKE SA not found. Initiate IKE SA negotiation.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Obtained profile 1.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Initiator created an SA for peer 55.17.15.243, local port 500, remote port 500.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Set IKE SA state to IKE_P1_STATE_INIT.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: IKE thread 1099127030448 processes a job.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Begin Main mode exchange.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Pre-shared key matching address 55.17.15.243 not found.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Encryption algorithm is SM4-CBC.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Hash algorithm is HMAC-SM3.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Authentication method is Digital envelope.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Asymmetric public key algorithm is sm2.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Lifetime type is in seconds.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Life duration is 86400.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Construct transform payload for transform 1.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Constructed SA payload.

*Jun 9 09:35:32:966 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Construct NAT-T rfc3947 vendor ID payload.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Construct NAT-T draft3 vendor ID payload.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Construct NAT-T draft2 vendor ID payload.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Construct NAT-T draft1 vendor ID payload.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

IKE SA state changed from IKE_P1_STATE_INIT to IKE_P1_STATE_SEND1.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Sending packet to 55.17.15.243 remote port 500, local port 500, out-interface 0.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

I-COOKIE: d452a4562a294fba

R-COOKIE: 0000000000000000

next payload: SA

version: ISAKMP Version 1.0

exchange mode: Main

flags:

message ID: 0

length: 164

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Sending an IPv4 packet.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Send udp packet by socket 46 SrcPort 500 ifIndex 0.

*Jun 9 09:35:32:967 2025 3620x1 IKE/7/EVENT: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Sent data to socket successfully.

*Jun 9 09:35:32:968 2025 3620x1 IKE/7/EVENT: Received packet successfully.

*Jun 9 09:35:32:968 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

Received packet from 55.17.15.243 source port 500 destination port 500.

*Jun 9 09:35:32:968 2025 3620x1 IKE/7/PACKET: vrf = 0, local = 172.32.36.41, remote = 55.17.15.243/500

I-COOKIE: d452a4562a294fba

R-COOKIE: f35e37a46244f13e

next payload: SA

version: ISAKMP Version 1.0

exchange mode: Main

flags:

message ID: 0

length: 124

*Jun 9 09:35:32:969 2025 3620x1 IKE/7/EVENT: IKE thread 1099127030448 processes a job.

*Jun 9 09:35:32:969 2025 3620x1 IKE/7/EVENT: Phase1 process started.