GRE相关实验

gre相关实验

gre vpn配置完成后，在防火墙上能够看到相关会话协议为gre，抓包也能够看到报文进行了gre的封装，但是抓包显示的源目地址依然是报文的真实地址，而不是隧道地址，这是模拟器的bug吗？

gre over ipsec vpn配置完成后，在防火墙上能够看到相关会话协议为gre，ike sa和ipsec sa都建立成功，抓包能够看到隧道建立成功的过程以及报文经过了ipsec的封装，但是并未看出经过了gre的封装，从哪里可以体现出经过了gre的封装呢

接口ip地址、加入安全区域等基本配置略

gre vpn配置见图

gre over ipsec vpn配置：

#              
interface GigabitEthernet1/0/3
 port link-mode route
 combo enable copper
 ip address 1.1.1.1 255.255.255.0
 ipsec apply policy map1
#             
interface Tunnel0 mode gre
 ip address 10.1.2.1 255.255.255.0
 source 1.1.1.1
 destination 2.2.2.2
#        
 ip route-static 0.0.0.0 0 1.1.1.11
 ip route-static 10.1.3.0 24 Tunnel0
#              
acl number 3000
 rule 5 permit ip source 1.1.1.1 0 destination 2.2.2.2 0
#              
ipsec transform-set tran1
 esp encryption-algorithm aes-cbc-128
 esp authentication-algorithm sha1
#              
ipsec policy map1 10 isakmp
 transform-set tran1
 security acl 3000
 local-address 1.1.1.1
 remote-address 2.2.2.2
 ikev2-profile pro2  或ike-profile pro1
#              
ike profile pro1
 keychain key1
 match remote identity address 2.2.2.2 255.255.255.0
#              
ike keychain key1
 pre-shared-key address 2.2.2.2 255.255.255.0 key cipher $c$3$o5S+Sufy7JBH4G+gsqNnaX+gRFZYng==
#  

ikev2 keychain key2
 peer p1       
  address 2.2.2.2 255.255.255.0
  identity address 2.2.2.2
  pre-shared-key ciphertext $c$3$5+EbbPxS8gTHmzuZmcDStotMBFOR0Q==
#              
ikev2 profile pro2
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain key2
 match remote identity address 2.2.2.2 255.255.255.0
#

security-policy ip
 rule 1 name t-u
  action pass  
  source-zone trust
  destination-zone untrust
  source-ip-subnet 10.1.1.0 255.255.255.0
  destination-ip-subnet 10.1.3.0 255.255.255.0
  service ping
 rule 2 name u-l
  action pass  
  source-zone local
  source-zone untrust
  destination-zone local
  destination-zone untrust
  source-ip-host 1.1.1.1
  source-ip-host 2.2.2.2
  destination-ip-host 1.1.1.1
  destination-ip-host 2.2.2.2
  service ipsec-ah
  service ipsec-esp
  service gre  
#

采用ikev1或者ikev2都可以，能够看到ike sa/ikev2 sa和IPSec sa能够建立成功

1