AR28/AR46系列路由器和CISCO设备IPsec互通的典型配置

AR28/AR46系列路由器和CISCO设备

IPSec互通的典型配置

【需求】

AR28-11和cisco2800通过以太网背靠背连接，要求实现相互之间的IPSec功能的互通。

【组网图】

【配置脚本】

AR28-11配置脚本

#                                                                                sysname Quidway                                                                 #                                                                               radius scheme system                                                            #                                                                                domain system                                                                   #                                                                               local-user admin                                                                 password cipher .]@USE=B,53Q=^Q`MAF4<1!!                        service-type telnet terminal                                            level 3                                                                         service-type ftp                                                          #                                                                               ike peer peer                     //ike的配置                          pre-shared-key vpn                                                              remote-address 10.1.1.2                                                         local-address 3.3.3.3                                                           #                                                                             ipsec proposal vpn                //使用IPsec proposal的默认配置          #                                                                               ipsec policy vpnmap 10 isakmp     //IPsec policy的配置                    security acl 3001                                                               ike-peer peer                                                                   proposal vpn                                                                   #                                                                               acl number 3001                                                                  rule 0 permit ip                                                                #                                                                               interface Aux0                                                                   async mode flow                                                                 #                                                                                 interface Ethernet0/0                                                            ip address 10.1.1.1 255.255.255.0                                                ipsec policy vpnmap              //在端口上应用安全策略                  #                                                                               interface Ethernet0/1                                                             ip address dhcp-alloc                                                          #                                                                               interface Serial0/0                                                               clock DTECLK1                                                                   link-protocol ppp                                                               ip address 1.1.1.2 255.255.255.0                                                #                                                                               interface NULL0                                                                 #                                                                               interface LoopBack1                                                              ip address 3.3.3.3 255.255.255.255                                             #                                                                                FTP server enable                                                              #                                                                                ip route-static 0.0.0.0 0.0.0.0 10.1.1.2 preference 60                         #                                                                                user-interface con 0                                                            user-interface aux 0                                                            user-interface vty 0 4                                                            authentication-mode scheme                                                     #                                                                               return

Cisco2800配置脚本

Router(config)#do show run                                                       Building configuration...                                                       Current configuration : 1472 bytes                                              !                                                                                version 12.4                                                                    service timestamps debug datetime msec                                          service timestamps log datetime msec                                             no service password-encryption                                                  !                                                                               hostname Router                                                                  !                                                                               boot-start-marker                                                               boot-end-marker                                                                 !                                                                                ! card type command needed for slot 1                                           !                                                                               no aaa new-model                                                                 !                                                                               resource policy                                                                 !                                                                                ip subnet-zero                                                                  !                                                                               !                                                                                ip cef                                                                          !                                                                               !                                                                                !                                                                               !                                                                               voice-card 0                                                                      no dspfarm                                                                     !                                                                               !                                                                               !                                                                               !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                crypto isakmp policy 1                      // ike的配置                  authentication pre-share                                                       crypto isakmp key vpn address 10.1.1.1                                          !                                                                                !                                                                               crypto ipsec transform-set vpn esp-des esp-md5-hmac                             !                                           //IPsec proposal的配置          crypto map vpnmap 10 ipsec-isakmp           //IPsec policy的配置           set peer 10.1.1.1                                                               set transform-set vpn                                                            match address 101                                                              !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                interface Loopback1                                                              ip address 2.2.2.2 255.255.255.255                                             !                                                                               interface FastEthernet0/0                                                        no ip address                                                                   shutdown                                                                        duplex auto                                                                      speed auto                                                                     !                                                                               interface FastEthernet0/1                                                         ip address 10.1.1.2 255.255.255.0                                               duplex auto                                                                     speed auto                                                                       crypto map vpnmap                         //在端口上应用          !                                                                               interface FastEthernet0/0/0                                                      !                                                                               interface FastEthernet0/0/1                                                     !                                                                                interface FastEthernet0/0/2                                                     !                                                                               interface FastEthernet0/0/3                                                      !                                                                               interface Serial0/1/0                                                            ip address 1.1.1.2 255.255.255.0                                                encapsulation ppp                                                               no fair-queue                                                                   clock rate 2000000                                                             !                                                                                interface Serial0/1/1                                                            no ip address                                                                   shutdown                                                                         clock rate 2000000                                                             !                                                                               interface Vlan1                                                                   no ip address                                                                  !                                                                               !                                                                                ip classless                                                                    ip route 0.0.0.0 0.0.0.0 10.1.1.1                                               !                                                                                !                                                                               ip http server                                                                  no ip http secure-server                                                        !                                                                               access-list 101 permit ip any any                                               !                                                                               !                                                                                !                                                                               !                                                                               control-plane                                                                    !                                                                               !                                                                               !                                                                                voice-port 0/3/0                                                                !                                                                               voice-port 0/3/1                                                                 !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               !                                                                                !                                                                               !                                                                               line con 0                                                                      line aux 0                                                                      line vty 0 4                                                                     login                                                                          !                                                                                scheduler allocate 20000 1000                                                   !                                                                               end

在AR28-11上查看测试结果

[Quidway]ping 10.1.1.2                                                            PING 10.1.1.2: 56  data bytes, press CTRL_C to break                              Reply from 10.1.1.2: bytes=56 Sequence=1 ttl=255 time=4 ms                       Reply from 10.1.1.2: bytes=56 Sequence=2 ttl=255 time=4 ms                      Reply from 10.1.1.2: bytes=56 Sequence=3 ttl=255 time=4 ms                      Reply from 10.1.1.2: bytes=56 Sequence=4 ttl=255 time=4 ms                      Reply from 10.1.1.2: bytes=56 Sequence=5 ttl=255 time=4 ms                    --- 10.1.1.2 ping statistics ---                                                  5 packet(s) transmitted                                                         5 packet(s) received                                                            0.00% packet loss                                                           round-trip min/avg/max = 4/4/4 ms   [Quidway]dis ipsec policy                                                       ===========================================                                     IPsec Policy Group: "1"                                                         Using interface: {}                                                             ===========================================                                       -----------------------------                                                   IPsec policy name: "1"                                                          sequence number: 1                                                               mode: isakmp                                                                    -----------------------------                                                     security data flow : 0                                                           selector mode: standard                                                         tunnel remote address: 0.0.0.0                                                  perfect forward secrecy: None                                                    proposal name:                                                                  IPsec sa local duration(time based): 3600 seconds                               IPsec sa local duration(traffic based): 1843200 kilobytes                    ===========================================                                     IPsec Policy Group: "12"                                                        Using interface: {}                                                              ===========================================                                       -----------------------------                                                   IPsec policy name: "12"                                                         sequence number: 12                                                             mode: manual                                                                    -----------------------------                                                     security data flow : 0                                                          selector mode: standard                                                         tunnel local  address: 0.0.0.0                                                  tunnel remote address: 0.0.0.0                                                   proposal name:                                                                  inbound AH setting:                                                               AH spi:                                                                          AH string-key:                                                                  AH authentication hex key:                                                    inbound ESP setting:                                                               ESP spi:                                                                        ESP string-key:                                                                 ESP encryption hex key:                                                          ESP authentication hex key:                                                   outbound AH setting:                                                              AH spi:                                                                         AH string-key:                                                                  AH authentication hex key:                                                    outbound ESP setting:                                                             ESP spi:                                                                         ESP string-key:                                                                 ESP encryption hex key:                                                         ESP authentication hex key:                                               ===========================================                                     IPsec Policy Group: "vpnmap"                                                    Using interface: {Ethernet0/0}                                                   ===========================================                                       -----------------------------                                                   IPsec policy name: "vpnmap"                                                      sequence number: 10                                                             mode: isakmp                                                                    -----------------------------                                                      security data flow : 3001                                                       selector mode: standard                                                         ike-peer name:  peer                                                            perfect forward secrecy: None                                                   proposal name:  vpn                                                             IPsec sa local duration(time based): 3600 seconds                               IPsec sa local duration(traffic based): 1843200 kilobytes                                                                             [Quidway]dis ipsec tunnel                                                           ------------------------------------------------                                Connection ID : 9                                                               Perfect forward secrecy: None                                                   SA's SPI :                                                                          Inbound :  1663789321 (0x632b6909) [ESP]                                        Outbound : 1284132306 (0x4c8a4dd2) [ESP]                                    Tunnel :                                                                             Local Address:  10.1.1.1  Remote Address : 10.1.1.2                         Flow :     (68 times matched)                                                       Sour Addr : 0.0.0.0/0.0.0.0  Port: 0  Protocol : IP                             Dest Addr : 0.0.0.0/0.0.0.0  Port: 0  Protocol : IP                                                                                      [Quidway]dis ipsec ?                                                               policy           Display IPSec security policy information                      policy-template  Display IPSec security policy template information             proposal         Display configured IPSec proposal                              sa               Display IPSec security association information                 statistics       Display statistics information of security packets             tunnel           Display IPSec tunnel information                                                                                                                [Quidway]dis ipsec statistics all                                                 the security packet statistics:                                                    input/output security packets: 227/266                                          input/output security bytes: 18842/22424                                        input/output dropped security packets: 0/116                                     dropped security packet detail:                                                   no enough memory: 0                                                             can't find SA: 116                                                               queue is full: 0                                                                authentication is failed: 0                                                     wrong length: 0                                                                 replay packet: 0                                                                too long packet: 0                                                              wrong SA: 0

【提示】

1、在ike视图下配置原地址时，一定要保证原地址的路由可达。如在本例中原地址配置的是loopback 1，所以需配置一条静态路由，下一跳指向对端端口。