华为路由器ipsec.doc

华为路由器ipsec-vpn实战-公网全静态ip2013-11-19 18:06:09#配置访问控制列表，定义vpn的数据流，注意在没有建立vpn之前，两个客户端是不通的。acl number 3000 rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 172.16.10.0 0.0.0.255 rule 10 deny ip #创建安全提议tran1，默认是隧道模式和esp的封装，加密算法是des，总之两端一样就行了。ipsec proposal tran1esp authentication-algorithm sha1#配置对等体，共享密钥，对端的ip地址ike peer peer v2pre-shared-key simple 12345678remote-address 222.1.1.2#创建安全策略map1，ipsec policy map1 10 isakmpsecurity acl 3000 引用aclike-peer peer 引用ike的对待体proposal tran1 引用安全提议#在wan口上应用安全策略。#interface GigabitEthernet0/0/0ip address 211.1.1.2 255.255.255.0 ipsec policy map1#中间的路由器只需要接口配个ip即可，模拟公网。对端的路由器配置参考以上配置。检测：在client1上ping对端的client2：PCping 172.16.10.10Ping 172.16.10.10: 32 data bytes, Press Ctrl_C to breakFrom 172.16.10.10: bytes=32 seq=1 ttl=127 time=16 msFrom 172.16.10.10: bytes=32 seq=2 ttl=127 time=31 msFrom 172.16.10.10: bytes=32 seq=3 ttl=127 time=15 msFrom 172.16.10.10: bytes=32 seq=4 ttl=127 time=15 msFrom 172.16.10.10: bytes=32 seq=5 ttl=127 time=15 ms遗憾的是在vpn路由器上无法进行这样的ping。查看安全联盟r1dis ipsec sa=Interface: GigabitEthernet0/0/0Path MTU: 1500 注意vpn经常因为mtu的原因导致不稳定，可以修改适合的mtu=-IPSec policy name: map1Sequence number : 10Acl Group : 3000Acl rule : 5Mode : ISAKMP-Connection ID : 8Encapsulation mode: TunnelTunnel local : 211.1.1.2Tunnel remote : 222.1.1.2Flow source : 192.168.10.0/255.255.255.0 0/0Flow destination : 172.16.10.0/255.255.255.0 0/0Qos pre-classify : DisableOutbound ESP SAs SPI: 197300795 (0xbc2923b)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-SHA1SA remaining key duration (bytes/sec): 1887434148/2480Max received sequence-number: 30Anti-replay window size: 32UDP encapsulation used for NAT traversal: N查看安全提议，这里没有建立成vpn也能查看r1dis ipsec proposalNumber of proposals: 1IPSec proposal name: tran1 Encapsulation mode: Tunnel Transform : esp-newESP protocol : Authentication SHA1-HMAC-96 Encryption DES查看安全策略r1dis ipsec policy=IPSec policy group: map1Using interface: GigabitEthernet0/0/0=Sequence number: 10Security data flow: 3000Peer name : peerPerfect forward secrecy: NoneProposal name: tran1IPSec SA local duration(time based): 3600 secondsIPSec SA local duration(traffic based): 1843200 kilobytesAnti-replay window size: 32SA trigger mode: AutomaticRoute inject: NoneQos pre-classify: Disable查看ike安全联盟（第二阶段）r1dis ike sa v2Conn-ID Peer VPN Flag(s) Phase -8 222.1.1.2 0 RD 2 7 222.1.1.2 0 RD 1 Flag Description:RD-READY ST-STAYALIVE RL-REPLACED FD-FADING TO-TIMEOUTHRT-HEARTBEAT LKG-LAST KNOWN GOOD SEQ NO. BCK-BACKED UP查看ike安全安全提议，注意这里是使用的华为默认的ike安全提议，也可以自己建一个，默认的优先级是最低的。为了兼容其他品牌的设备，往往可以建立多个ike安全提议。r1dis ike propoNumber of IKE Proposals: 1-IKE Proposal: DefaultAuthentication method : pre-sharedAuthentication algorithm : SHA1Encryption algorithm : DES-CBCDH group : MODP-768SA duration : 86400PRF : PRF-HMAC-SHA-扩展：如果总部还有个网段10.10.10.0的话也需要互通怎么弄？很简单。在acl中加入兴趣流就行了，经过测试了。dis acl allTotal quantity of nonempty ACL number is 1Advanced ACL 3000, 3 rulesAcls step is 5rule 5 permit ip source 172.16.10.0 0.0.0.255 destination 192.168.10.0 0.0.0.255 rule 6 permit ip source 10.10.10.0 0.0.0.255 destination 192.168.10.0 0.0.0.255 rule 10 deny ipdis ipsec sa=Interface: GigabitEthernet0/0/0Path MTU: 1500=-IPSec policy name: use1Sequence number : 10Acl Group : 3000Acl rule : 5Mode : ISAKMP-Connection ID : 11Encapsulation mode: TunnelTunnel local : 222.1.1.2Tunnel remote : 211.1.1.2Flow source : 172.16.10.0/255.255.255.0 0/0Flow destination : 192.168.10.0/255.255.255.0 0/0Qos pre-classify : DisableOutbound ESP SAs SPI: 3416128951 (0xcb9dfdb7)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-SHA1SA remaining key duration (bytes/sec): 1887436800/2357Max sent sequence-number: 0UDP encapsulation used for NAT traversal: NInbound ESP SAs SPI: 962890874 (0x39648c7a)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-SHA1SA remaining key duration (bytes/sec): 1887436800/2357Max received sequence-number: 0Anti-replay window size: 32UDP encapsulation used for NAT traversal: N-IPSec policy name: use1Sequence number : 10Acl Group : 3000Acl rule : 6Mode : ISAKMP-Connection ID : 14Encapsulation mode: TunnelTunnel local : 222.1.1.2Tunnel remote : 211.1.1.2Flow source : 10.10.10.0/255.255.255.0 0/0Flow destination : 192.168.10.0/255.255.255.0 0/0Qos pre-classify : DisableOutbound ESP SAs SPI: 2919121066 (0xadfe40aa)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-SHA1SA remaining key duration (bytes/sec): 1887390720/3424Max sent sequence-number: 3UDP encapsulation used for NAT traversal: NInbound