MSR3620做ipsec两边终端局域网地址重叠访问的处理经验

江苏某公司两个局域网站点出口用MSR3620做ipsec VPN，两端地址重叠,导致ipsec建立成功后,两端不能互访,实验室组网拓扑简图如图一所示:

图一 组网拓扑

两端局域网出口设备建立ipsec之后,由PC1侧发起ping操作到PC2侧时,ping报文可以到达PC2,但当PC2回应报文时,由于在MSR3620-2侧直接查找本地路由到了PC3,无法到达设备出接口封装ipsec报文头,导致两端局域网终端无法互访。

在连接PC2的接口上配nat outbound和PBR，PC1发出的报文在该接口上先

匹配nat outbound，替换为该接口ip地址到达pc2，pc2回应的时候匹配PBR，下一跳为MSR3620-2的出接口ip地址，将该报文送到MSR3620-2的ipsec接口上，使PC1访问PC2的报文得到回应。

关键配置如下：

MSR3620-1：

#

interface GigabitEthernet0/0 

 port link-mode route

 combo enable copper

 ip address 2.2.2.1 255.255.255.0

 ipsec apply policy map1

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 10.1.1.1 255.255.255.0

#

 ip route-static 10.1.2.0 24 GigabitEthernet0/0 2.2.2.2

#

acl advanced 3101

 rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255

#

ipsec transform-set tran1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1

#

ipsec policy map1 10 isakmp

 transform-set tran1

 security acl 3101

 local-address 2.2.2.1

 remote-address 2.2.2.2

 ike-profile profile1

#

ike profile profile1

 keychain keychain1

 match remote identity address 2.2.2.2 255.255.255.0

#

ike keychain keychain1

 pre-shared-key address 2.2.2.2 255.255.255.0 key cipher $c$3$0hpFFye6lOO9kcA9W2ZftyUCBV6c6A==

#

MSR3620-2：

policy-based-route aaa permit node 5

 if-match acl 3000

 apply next-hop 2.2.2.1

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 2.2.2.2 255.255.255.0

 ipsec apply policy use1

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 10.1.2.1 255.255.255.0

 nat outbound

 ip policy-based-route aaa

#

interface GigabitEthernet0/2

 port link-mode route

 combo enable copper

 ip address 10.1.1.1 255.255.255.0

#

 ip route-static 10.1.1.0 24 GigabitEthernet0/0 2.2.2.1

#

acl advanced 3000

 rule 0 permit ip source 10.1.2.2 0 destination 10.1.1.2 0

#

acl advanced 3101

 rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

#

ipsec transform-set tran1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1

#

ipsec policy use1 10 isakmp

 transform-set tran1

 security acl 3101

 local-address 2.2.2.2

 remote-address 2.2.2.1

 ike-profile profile1

#

ike profile profile1

 keychain keychain1

 match remote identity address 2.2.2.1 255.255.255.0

#

ike keychain keychain1

 pre-shared-key address 2.2.2.1 255.255.255.0 key cipher $c$3$FmI8sXpm7iD4vhMvu4cbssfcsSqiIQ==

验证：

[PC1]ping 10.1.2.2

Ping 10.1.2.2 (10.1.2.2): 56 data bytes, press CTRL_C to break

Request time out

56 bytes from 10.1.2.2: icmp_seq=1 ttl=253 time=12.063 ms

56 bytes from 10.1.2.2: icmp_seq=2 ttl=253 time=16.215 ms

56 bytes from 10.1.2.2: icmp_seq=3 ttl=253 time=2.534 ms

56 bytes from 10.1.2.2: icmp_seq=4 ttl=253 time=2.178 ms

--- Ping statistics for 10.1.2.2 ---

5 packet(s) transmitted, 4 packet(s) received, 20.0% packet loss

round-trip min/avg/max/std-dev = 2.178/8.248/16.215/6.073 ms

[PC1]%Apr  6 22:16:22:794 2017 PC1 PING/6/PING_STATISTICS: Ping statistics for 10.1.2.2: 5 packet(s) transmitted, 4 packet(s) received, 20.0% packet loss, round-trip min/avg/max/std-dev = 2.178/8.248/16.215/6.073 ms.

ipsec网络，当两端局域网ip重叠，可以通过PBR+nat outbound方式解决两端局域网访问不通的问题。