AR系列路由器IPSec Over GRE典型配置

AR系列路由器IPSec Over GRE典型配置

 

【需求】

分部1和分部2通过野蛮IPSec的方式连接到中心，采用IPSec -Over-GRE的方式，在tunnel上运行OSPF协议来实现总部和分部之间的互通。

【组网图】

 

 

【配置脚本】

中心配置脚本

# sysname Center # ike local-name center                 /中心ike的local-name为：center/ # router id 1.1.1.1 # radius scheme system # domain system # ike peer branch1                       /配置到分部1的ike peer/ exchange-mode aggressive              /设置IPSec为野蛮方式/ pre-shared-key abc                    /预共享密钥为abc/ id-type name                          /选择名字作为ike协商过程中使用的ID/ remote-name branch1                   /分部1的名字为branch1/ # ike peer branch2                       /配置到分部2的ike peer/ exchange-mode aggressive pre-shared-key abc id-type name remote-name branch2 # ipsec proposal 1                       /定义ipsec proposal/ # ipsec policy center 10 isakmp          /配置到分部1的ipsec policy/ security acl 3001                     /指定安全策略所引用的访问控制列表号/ ike-peer branch1                      /引用ike peer/ proposal 1                            /引用ipsec proposal/ # ipsec policy center 20 isakmp          /到分部2的配置和分部1的配置类似/ security acl 3002 ike-peer branch2 proposal 1 # acl number 3001                        /定义从中心到分部1的内网数据流/ rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 acl number 3002                        /定义从中心到分部2的内网数据流/ rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 # interface Serial2/0 link-protocol ppp ip address 202.101.1.2 255.255.255.252 # interface Tunnel0                      /配置中心和分部1之间的GRE tunnel/ ip address 10.0.0.1 255.255.255.252 source 202.101.1.2 destination 202.101.2.2 ipsec policy branch1                  /在tunnel 0上应用IPSec policy branch1/ # interface Tunnel1                      /配置中心和分部2之间的GRE tunnel/ ip address 10.0.0.5 255.255.255.252 source 202.101.1.2 destination 202.101.3.2 ipsec policy branch2                  /在tunnel 1上应用IPSec policy branch2/   # interface NULL0 # interface LoopBack0 ip address 1.1.1.1 255.255.255.255 # interface Ethernet0/0 ip address 192.168.1.1 255.255.255.0  /中心的内网地址/ # ospf 1 area 0.0.0.10                        /分部1属于area 10/ network 10.0.0.0 0.0.0.3 # area 0.0.0.20                        /分部2属于area 20/ network 10.0.0.4 0.0.0.3 # area 0.0.0.0                         /总部属于area 0/ network 1.1.1.1 0.0.0.0 network 192.168.1.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.1.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

分部1配置脚本

# sysname Branch1 # ike local-name branch1             /分部1的ike的local-name为：branch1/ # radius scheme system # domain system # ike peer center                     /配置到中心的ike peer/ exchange-mode aggressive           /设置IPSec为野蛮方式/ pre-shared-key abc                 /预共享密钥为abc/ id-type name                       /选择名字作为ike协商过程中使用的ID/ remote-name center                 /对端的名字为center/ remote-address 10.0.0.1            /对端的地址为10.0.0.1（中心的tunnel地址）/ # ipsec proposal 1                    /定义ipsec proposal/ # ipsec policy branch1 10 isakmp      /配置到中心的ipsec policy/ security acl 3001                  /指定安全策略所引用的访问控制列表号/ ike-peer center                    /引用ike peer/ proposal 1                         /引用ipsec proposal/ # acl number 3001                     /定义从分部1到中心的内网数据流/ rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 # interface Serial2/0 link-protocol ppp ip address 202.101.2.2 255.255.255.252 # interface Tunnel0                   /配置分部1和中心之间的GRE tunnel/ ip address 10.0.0.2 255.255.255.252 source 202.101.2.2 destination 202.101.1.2 ipsec policy branch1                  /在tunnel 0上应用IPSec policy branch1/ # interface NULL0 # interface LoopBack0 ip address 2.2.2.2 255.255.255.255 # interface Ethernet0/0               /配置分部1的内网地址/ ip address 192.168.2.1 255.255.255.0 # ospf 1 area 0.0.0.10                      /分部1属于area 10/ network 2.2.2.2 0.0.0.0 network 10.0.0.0 0.0.0.3 network 192.168.2.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.2.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

分部2配置脚本

# sysname Branch2 # ike local-name branch1             /分部2的ike的local-name为：branch2/ # radius scheme system # domain system # ike peer center                     /配置到中心的ike peer/ exchange-mode aggressive           /设置IPSec为野蛮方式/ pre-shared-key abc                 /预共享密钥为abc/ id-type name                       /选择名字作为ike协商过程中使用的ID/ remote-name center                 /对端的名字为center/ remote-address 10.0.0.5            /对端的地址为10.0.0.5（中心的tunnel地址）/ # ipsec proposal 1                    /定义ipsec proposal/ # ipsec policy branch1 10 isakmp      /配置到中心的ipsec policy/ security acl 3001                  /指定安全策略所引用的访问控制列表号/ ike-peer center                    /引用ike peer/ proposal 1                         /引用ipsec proposal/ # acl number 3001                     /定义从分部2到中心的GRE数据流/ rule 0 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 # interface Serial2/0 link-protocol ppp ip address 202.101.3.2 255.255.255.252 # interface Tunnel0                   /配置分部1和中心之间的GRE tunnel/ ip address 10.0.0.6 255.255.255.252 source 202.101.3.2 destination 202.101.1.2 ipsec policy branch2                  /在tunnel 0上应用IPSec policy branch2/ # interface NULL0 # interface LoopBack0 ip address 3.3.3.3 255.255.255.255 # interface Ethernet0/0               /配置分部1的内网地址/ ip address 192.168.3.1 255.255.255.0 # ospf 1 area 0.0.0.20                      /分部2属于area 20/ network 3.3.3.3 0.0.0.0 network 10.0.0.4 0.0.0.3 network 192.168.3.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.3.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

 

【验证】

1、中心上的ike sa 状态：

disp ike sa

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

       44          10.0.0.2        RD            1     IPSEC

       48          10.0.0.6        RD            2     IPSEC

       47          10.0.0.6        RD            1     IPSEC

       45          10.0.0.2        RD            2     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

2、中心上的IPSec sa状态：

disp ipsec sa

===============================

Interface: Tunnel0

    path MTU: 64000

===============================

 

  -----------------------------

  IPsec policy name: "branch1"

  sequence number: 10

  mode: isakmp

  -----------------------------

    connection id: 8

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 10.0.0.1

        remote address: 10.0.0.2

    flow:    (4 times matched)

        sour addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

        dest addr: 192.168.2.0/255.255.255.0  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 2701983530 (0xa10cff2a)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436664/2136

      max received sequence-number: 2    

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 2132567950 (0x7f1c678e)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436632/2136

      max sent sequence-number: 3

      udp encapsulation used for nat traversal: N

===============================

Interface: Tunnel1

    path MTU: 64000

===============================

 

  -----------------------------

  IPsec policy name: "branch2"

  sequence number: 10

  mode: isakmp

  -----------------------------

    connection id: 9

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 10.0.0.5

        remote address: 10.0.0.6

    flow:    (18 times matched)          

        sour addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

        dest addr: 192.168.3.0/255.255.255.0  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 1612204948 (0x60184b94)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436188/2886

      max received sequence-number: 9

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 3432409622 (0xcc966a16)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436044/2886

      max sent sequence-number: 10

      udp encapsulation used for nat traversal: N 

 

3、中心路由表

disp ip rout

 Routing Table: public net

Destination/Mask   Protocol Pre  Cost        Nexthop         Interface

0.0.0.0/0          STATIC   60   0           202.101.1.1     Serial2/0/0

1.1.1.1/32         DIRECT   0    0           127.0.0.1       InLoopBack0

2.2.2.2/32         OSPF     10   1563        10.0.0.2        Tunnel0

3.3.3.3/32         OSPF     10   1563        10.0.0.6        Tunnel1

10.0.0.0/30        DIRECT   0    0           10.0.0.1        Tunnel0

10.0.0.1/32        DIRECT   0    0           127.0.0.1       InLoopBack0

10.0.0.4/30        DIRECT   0    0           10.0.0.5        Tunnel1

10.0.0.5/32        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.0/8        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.1/32       DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.1.0/24     DIRECT   0    0           192.168.1.1     LoopBack10

192.168.1.1/32     DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.2.0/24     OSPF     10   1563        10.0.0.2        Tunnel0

192.168.3.0/24     OSPF     10   1563        10.0.0.6        Tunnel1

202.101.1.0/30     DIRECT   0    0           202.101.1.2     Serial2/0/0

202.101.1.1/32     DIRECT   0    0           202.101.1.1     Serial2/0/0

202.101.1.2/32     DIRECT   0    0           127.0.0.1       InLoopBack0

 

4、分部1的ike sa状态：

disp ike sa

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

       27          10.0.0.1        RD|ST         1     IPSEC

       28          10.0.0.1        RD|ST         2     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

5、分部1的ipsec sa状态：

disp ipsec sa

===============================

Interface: Tunnel0

    path MTU: 64000

===============================

 

  -----------------------------

  IPsec policy name: "branch1"

  sequence number: 10

  mode: isakmp

  -----------------------------

    connection id: 6

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 10.0.0.2

        remote address: 10.0.0.1

    flow:    (4 times matched)

        sour addr: 192.168.2.0/255.255.255.0  port: 0  protocol: IP

        dest addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 2132567950 (0x7f1c678e)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436664/2054

      max received sequence-number: 2    

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 2701983530 (0xa10cff2a)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887436632/2054

      max sent sequence-number: 3

      udp encapsulation used for nat traversal: N 

 

6、分部1的路由表：

disp ip rout

 Routing Table: public net

Destination/Mask   Protocol Pre  Cost        Nexthop         Interface

0.0.0.0/0          STATIC   60   0           202.101.2.1     Serial2/0/0

1.1.1.1/32         OSPF     10   1563        10.0.0.1        Tunnel0

2.2.2.2/32         DIRECT   0    0           127.0.0.1       InLoopBack0

3.3.3.3/32         OSPF     10   3125        10.0.0.1        Tunnel0

10.0.0.0/30        DIRECT   0    0           10.0.0.2        Tunnel0

10.0.0.2/32        DIRECT   0    0           127.0.0.1       InLoopBack0

10.0.0.4/30        OSPF     10   3124        10.0.0.1        Tunnel0

127.0.0.0/8        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.1/32       DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.1.0/24     OSPF     10   1563        10.0.0.1        Tunnel0

192.168.2.0/24     DIRECT   0    0           192.168.2.1     LoopBack10

192.168.2.1/32     DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.3.0/24     OSPF     10   3125        10.0.0.1        Tunnel0

202.101.2.0/30     DIRECT   0    0           202.101.2.2     Serial2/0/0

202.101.2.1/32     DIRECT   0    0           202.101.2.1     Serial2/0/0

202.101.2.2/32     DIRECT   0    0           127.0.0.1       InLoopBack0

 

【提示】

1、IPSec -Over-GRE和GRE-Over-IPSec方式配置上的区别为：

 

	GRE-Over-IPSec	IPSec-Over-GRE
ACL定义	GRE数据流	内网数据流
Ike peer中指定的remote-address	对方公网地址	对方GRE tunnel地址
应用端口	公网出口	GRE tunnel上

 

2、各个分部和总部之间通过OSPF路由来实现互访，如果没有运行OSPF则必需在分部和总部配置静态路由。

【Center配置】

ip route-static 192.168.2.0 255.255.255.0 Tunnel 0 preference 60   

 /访问分部1内网的数据从tunnel 0走/

 ip route-static 192.168.3.0 255.255.255.0 Tunnel 1 preference 60    

 /访问分部2内网的数据从tunnel 1走/

 

【分部1配置】

 ip route-static 192.168.1.0 255.255.255.0 Tunnel 0 preference 60     

 /访问中心内网的数据从tunnel 0走/

 

【分部2配置】

 ip route-static 192.168.1.0 255.255.255.0 Tunnel 0 preference 60     

 /访问中心内网的数据从tunnel 0走/

?