IPsec over GRE配置

IPsec over GRE配置

拓扑

实验步骤

1、配置ip地址

2、公网互通

IPSec配置（双方都配置）

3、配置高级ACL匹配双方私网地址

4、ike peoposal

5、ike keychain(地址用对方的tunnel地址标识)

6、ike profile（主模式；用双方tunnel地址标识身份）

7、ipsec tranform-set

8、ipsec polity（remote是对方tunnel接口地址）

GRE配置（双方均配置）

9、配置隧道模式；ip地址；源目IP（公网地址）

10、在tunnel下应用ipsec polity

动态路由协议配置（双方均配置）

11、创建ospf，宣告私网网段和隧道网段

实验配置

一、配置IP地址；使公网互通

略

二、在R1和R3上配置感兴趣流（匹配双方私网网段）

[R1]acl advanced 3000

[R1-acl-ipv4-adv-3000]rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

[R3]acl advanced 3000

[R3-acl-ipv4-adv-3000]rule permit ip source 192.168.2.0 0.0.0.255 destin

[R3-acl-ipv4-adv-3000]rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

三、在 R1、R3上创建 IKE 提议，使用默认配置即可

[R1]ike proposal 1

[R3]ike proposal  1

四、创建IKE keychain配置预共享密钥，地址使用对方的tunnel地址

[R1-ike-keychain-R3]pre-shared-key address 172.16.1.2 key simple 123456

[R3-ike-keychain-R1]pre-shared-key address 172.16.1.1 key simple 123456

五、创建ike profile，调用proposal和keychain，ike主模式，使用双方的tunnel标识身份

[R1]ike profile R3

[R1-ike-profile-R3]proposal 1

[R1-ike-profile-R3]keychain R3

[R1-ike-profile-R3]exchange-mode main

[R1-ike-profile-R3]local-identity address 172.16.1.1

[R1-ike-profile-R3]match remote identity address 172.16.1.2

[R3]ike profile R1

[R3-ike-profile-R1]keychain R1

[R3-ike-profile-R1]proposal 1

[R3-ike-profile-R1]exchange-mode main

[R3-ike-profile-R1]local-identity address 172.16.1.2

[R3-ike-profile-R1]match remote identity address 172.16.1.1

六、创建ipsec转换集

[R1]ipsec transform-set R3

[R1-ipsec-transform-set-R3]encapsulation-mode tunnel

[R1-ipsec-transform-set-R3]esp authentication-algorithm md5

[R1-ipsec-transform-set-R3]esp encryption-algorithm des-cbc

[R3]ipsec transform-set R1

[R3-ipsec-transform-set-R1]encapsulation-mode tunnel

[R3-ipsec-transform-set-R1]esp authentication-algorithm md5

[R3-ipsec-transform-set-R1]esp encryption-algorithm des-cbc

七、创建ipsec polity，调用转换集和ike配置文件，绑定acl，远端地址是对方的tunnel IP地址

[R1]ipsec policy R3 1 isakmp

[R1-ipsec-policy-isakmp-R3-1]ike-profile R3

[R1-ipsec-policy-isakmp-R3-1]transform-set R3

[R1-ipsec-policy-isakmp-R3-1]security acl 3000

[R1-ipsec-policy-isakmp-R3-1]remote-address 172.16.1.2

[R3]ipsec policy R1 1 isakmp

[R3-ipsec-policy-isakmp-R1-1]ike-profile R1

[R3-ipsec-policy-isakmp-R1-1]transform-set R1

[R3-ipsec-policy-isakmp-R1-1]security acl 3000

[R3-ipsec-policy-isakmp-R1-1]remote-address 172.16.1.1

八、配置隧道模式；ip地址；源目IP（公网地址）

[R1]int Tunnel 0 mode gre

[R1-Tunnel0]ip a 172.16.1.1 30

[R1-Tunnel0]source 100.1.1.1

[R1-Tunnel0]destination 100.2.2.3

[R3]int Tunnel 0 mode gre

[R3-Tunnel0]ip a 172.16.1.2 30

[R3-Tunnel0]source 100.2.2.3

[R3-Tunnel0]destination 100.1.1.1

九、在tunnel接口下调用ipsec polity

[R1-Tunnel0]ipsec apply policy R3

[R3-Tunnel0]ipsec apply policy R1

十、在R1和R3上创建ospf，宣告私网网段和tunnel网段

[R1]ospf 1 router-id 1.1.1.1

[R1-ospf-1]a 0

[R1-ospf-1-area-0.0.0.0]net 192.168.1.0 0.0.0.255

[R1-ospf-1-area-0.0.0.0]net 172.16.1.0 0.0.0.3

[R3]ospf 1 router-id 3.3.3.3

[R3-ospf-1]a 0

[R3-ospf-1-area-0.0.0.0]net 192.168.2.0 0.0.0.255

[R3-ospf-1-area-0.0.0.0]net 172.16.1.0 0.0.0.3

此时邻居关系建立

[R1]dis ospf peer

         OSPF Process 1 with Router ID 1.1.1.1

               Neighbor Brief Information

 Area: 0.0.0.0        

 Router ID       Address       Pri  Dead-Time   State           Interface

 3.3.3.3         172.16.1.2      1   35         Full/ -           Tun0

效果：PC4和PC5可以互通

补充：

reset ipsec sa

reset ike sa #清除VPN隧道