×××（GRE over IPSEC ×××）

最新推荐文章于 2024-12-17 17:05:06 发布

转载最新推荐文章于 2024-12-17 17:05:06 发布 · 82 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://blog.51cto.com/crystals/289246

本文介绍了一种通过配置IPSEC和GRE隧道实现跨网络通信的方法。为了支持动态路由协议并确保数据安全性，文中详细展示了如何搭建GRE隧道及IPSEC加密通道，并提供了具体的Cisco路由器配置示例。

实验拓扑:

   由于IPSEC ×××不能支持组播和广播,因此不能运行动态路由协议,由于我们需要把一条×××链路作为一条专线使用,还必须建立GRE tunnel隧道,以支持动态路由协议.基本配置步骤如下:
   1:配置基本路由和需保护流量的感兴趣访问列表 (注意这里感兴趣流量设为GRE隧道流量)
   2:配置GRE Tunnel隧道.
   3:配置IPSEC ×××.
   4 :配置动态路由协议

具体配置文件如下，不做过多解释！

VPCS 1 >ip 10.1.1.2 10.1.1.1 /24

PC1 : 10.1.1.2 255.255.255.0 gateway 10.1.1.1

VPCS 1 >2

VPCS 2 >ip 192.168.1.2 192.168.1.1 /24

PC2 : 192.168.1.2 255.255.255.0 gateway 192.168.1.1

VPCS 2 >ping 192.168.1.1

192.168.1.1 icmp_seq=1 time=31.000 ms

192.168.1.1 icmp_seq=2 time=47.000 ms

192.168.1.1 icmp_seq=3 time=47.000 ms

192.168.1.1 icmp_seq=4 time=47.000 ms

192.168.1.1 icmp_seq=5 time=31.000 ms

VPCS 2 >1

VPCS 1 >ping 10.1.1.1

10.1.1.1 icmp_seq=1 time=47.000 ms

10.1.1.1 icmp_seq=2 time=46.000 ms

10.1.1.1 icmp_seq=3 time=31.000 ms

10.1.1.1 icmp_seq=4 time=47.000 ms

10.1.1.1 icmp_seq=5 time=31.000 ms

r1#show run

Building configuration...

Current configuration : 1511 bytes

version 12.3

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname r1

boot-start-marker

boot-end-marker

memory-size iomem 5

no aaa new-model

ip subnet-zero

no ip domain lookup

ip cef

ip ips po max-events 100

no ftp-server write-enable

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key cisco address 193.1.1.2

crypto ipsec transform-set set esp-3des esp-sha-hmac

mode transport

crypto map map 10 ipsec-isakmp

set peer 193.1.1.2

set transform-set set

match address list

interface Tunnel0

ip address 172.16.1.1 255.255.255.0

tunnel source Serial1/0

tunnel destination 193.1.1.2

interface FastEthernet0/0

ip address 10.1.1.1 255.255.255.0

duplex auto

speed auto

interface Serial1/0

ip address 192.1.1.1 255.255.255.0

serial restart-delay 0

crypto map map

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

router eigrp 100

network 10.0.0.0

network 172.16.0.0

no auto-summary

ip http server

no ip http secure-server

ip classless

ip route 0.0.0.0 0.0.0.0 Serial1/0

ip access-list extended list

permit ip host 192.1.1.1 host 193.1.1.2

control-plane

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

end

r1# show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.1.0 is directly connected, Tunnel0

10.0.0.0/24 is subnetted, 1 subnets

C 10.1.1.0 is directly connected, FastEthernet0/0

C 192.1.1.0/24 is directly connected, Serial1/0

D 192.168.1.0/24 [90/297246976] via 172.16.1.2, 00:54:41, Tunnel0

S* 0.0.0.0/0 is directly connected, Serial1/0

r2#show run

Building configuration...

Current configuration : 842 bytes

version 12.3

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname r2

boot-start-marker

boot-end-marker

memory-size iomem 5

no aaa new-model

ip subnet-zero

no ip domain lookup

ip cef

ip ips po max-events 100

no ftp-server write-enable

interface Serial0/0

ip address 192.1.1.2 255.255.255.0

serial restart-delay 0

interface Serial0/1

ip address 193.1.1.1 255.255.255.0

serial restart-delay 0

interface Serial0/2

no ip address

shutdown

serial restart-delay 0

interface Serial0/3

no ip address

shutdown

serial restart-delay 0

ip http server

no ip http secure-server

ip classless

control-plane

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

end

r2#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 193.1.1.0/24 is directly connected, Serial0/1

C 192.1.1.0/24 is directly connected, Serial0/0

r3#show run

Building configuration...

Current configuration : 1517 bytes

version 12.3

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname r3

boot-start-marker

boot-end-marker

memory-size iomem 5

no aaa new-model

ip subnet-zero

no ip domain lookup

ip cef

ip ips po max-events 100

no ftp-server write-enable

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key cisco address 192.1.1.1

crypto ipsec transform-set set esp-3des esp-sha-hmac

mode transport

crypto map map 10 ipsec-isakmp

set peer 192.1.1.1

set transform-set set

match address list

interface Tunnel0

ip address 172.16.1.2 255.255.255.0

tunnel source Serial1/0

tunnel destination 192.1.1.1

interface FastEthernet0/0

ip address 192.168.1.1 255.255.255.0

duplex auto

speed auto

interface Serial1/0

ip address 193.1.1.2 255.255.255.0

serial restart-delay 0

crypto map map

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

router eigrp 100

network 172.16.0.0

network 192.168.1.0

no auto-summary

ip http server

no ip http secure-server

ip classless

ip route 0.0.0.0 0.0.0.0 Serial1/0

ip access-list extended list

permit ip host 193.1.1.2 host 192.1.1.1

control-plane

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

end

r3#

r3#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.1.0 is directly connected, Tunnel0

10.0.0.0/24 is subnetted, 1 subnets

D 10.1.1.0 [90/297246976] via 172.16.1.1, 00:54:37, Tunnel0

C 193.1.1.0/24 is directly connected, Serial1/0

C 192.168.1.0/24 is directly connected, FastEthernet0/0

S* 0.0.0.0/0 is directly connected, Serial1/0

转载于:https://blog.51cto.com/crystals/289246