侧边栏壁纸
博主头像
福福不服博主等级

孩子会穿过大雨,去懂人间的道理。

  • 累计撰写 76 篇文章
  • 累计创建 91 个标签
  • 累计收到 0 条评论

目 录CONTENT

文章目录

IPSec配置实验

Monster
2023-09-21 / 0 评论 / 2 点赞 / 36 阅读 / 14713 字 / 正在检测是否收录...
温馨提示:
请确保在评论和互动中保持礼貌和尊重。避免使用侮辱性、歧视性或攻击性语言。我们鼓励建设性的讨论和意见交流。

网络拓扑图

方法1:手工静态IPSEC隧道配置

1.配置两边PC的地址

湖南地区的PC1:192.168.10.1/24

深圳地区的PC2:192.168.20.1/24

PC>ipconfig

Link local IPv6 address...........: fe80::5689:98ff:fe9e:3b7d
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.10.1
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.10.254
Physical address..................: 54-89-98-9E-3B-7D
DNS server........................:

PC>

PC>ipconfig

Link local IPv6 address...........: fe80::5689:98ff:fe55:5ed6
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.20.1
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.20.254
Physical address..................: 54-89-98-55-5E-D6
DNS server........................:

PC>

2.配置两边出口路由的接口地址

湖南地区的AR1配置

g0/0/0:192.168.10.254/24

g0/0/1:100.1.1.1/30

默认路由指向运营商AR3的g0/0/0

配置acl匹配10网段,出口路由器上的出接口应用nat,是的湖南地区的PC可以访问互联网,配完可以用PC1ping一下2.2.2.2

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR1
[AR1]interface gigabitether 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 192.168.10.254 24
[AR1-GigabitEthernet0/0/0]quit
[AR1]interface gigabitether 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 100.1.1.1 30
[AR1-GigabitEthernet0/0/1]quit
[AR1]
[AR1]ip route-static 0.0.0.0 0 100.1.1.2
[AR1]acl 2000
[AR1-acl-basic-2000]rule 10 permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2000]quit
[AR1]interface gigabitether 0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 2000
[AR1-GigabitEthernet0/0/1]quit
[AR1]

深圳地区的AR2配置

g0/0/1:192.168.20.254/24

g0/0/0:200.1.1.1/30

默认路由指向运营商AR3的g0/0/1

配置acl匹配20网段,出口路由器上的出接口应用nat,是的深圳地区的PC可以访问互联网,配完可以用PC2ping一下2.2.2.2

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface gigabitether 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 200.1.1.1 30
[AR2-GigabitEthernet0/0/0]quit
[AR2]interface gigabitether 0/0/1
[AR2-GigabitEthernet0/0/1]ip address 192.168.20.254 24
[AR2-GigabitEthernet0/0/1]quit
[AR2]
[AR1]ip route-static 0.0.0.0 0 200.1.1.2
[AR2]acl 2000
[AR2-acl-basic-2000]rule 20 permit source 192.168.20.0 0.0.0.255
[AR2-acl-basic-2000]quit
[AR2]interface gigabitether 0/0/0
[AR2-GigabitEthernet0/0/0]nat outbound 2000
[AR2-GigabitEthernet0/0/0]quit
[AR2]

配置AR3路由器的接口地址

AR3是用来模拟运营商的,还有一个2.2.2.2的地址用来测试互联网的,实际当中你是不知道互联网的具体地址的,公网IP那么多

g0/0/0 100.1.1.2/30

g0/0/1 200.1.1.2/30

虚拟口le0:2.2.2.2/32模拟互联网地址

<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR3
[AR3]interface gigabitether 0/0/0
[AR3-GigabitEthernet0/0/0]ip address 100.1.1.2 30
[AR3-GigabitEthernet0/0/0]quit
[AR3]interface gigabitether 0/0/1
[AR3-GigabitEthernet0/0/1]ip address 200.1.1.2 30
[AR3-GigabitEthernet0/0/1]quit
[AR3]interface LoopBack 0
[AR3-LoopBack0]ip address 2.2.2.2 32
[AR3-LoopBack0]quit
[AR3]

测试接口连通性

PC1ping出口路由器两个地址以及互联网模拟2.2.2.2

PC>ping 192.168.10.254

Ping 192.168.10.254: 32 data bytes, Press Ctrl_C to break
From 192.168.10.254: bytes=32 seq=1 ttl=255 time=31 ms
From 192.168.10.254: bytes=32 seq=2 ttl=255 time=16 ms
From 192.168.10.254: bytes=32 seq=3 ttl=255 time<1 ms
From 192.168.10.254: bytes=32 seq=4 ttl=255 time=16 ms
From 192.168.10.254: bytes=32 seq=5 ttl=255 time=15 ms

--- 192.168.10.254 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 0/15/31 ms

PC>ping 100.1.1.1

Ping 100.1.1.1: 32 data bytes, Press Ctrl_C to break
From 100.1.1.1: bytes=32 seq=1 ttl=255 time=16 ms
From 100.1.1.1: bytes=32 seq=2 ttl=255 time=15 ms
From 100.1.1.1: bytes=32 seq=3 ttl=255 time<1 ms
From 100.1.1.1: bytes=32 seq=4 ttl=255 time<1 ms
From 100.1.1.1: bytes=32 seq=5 ttl=255 time<1 ms

--- 100.1.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 0/6/16 ms

PC>
PC>ping 2.2.2.2

Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
From 2.2.2.2: bytes=32 seq=1 ttl=254 time=16 ms
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=31 ms
From 2.2.2.2: bytes=32 seq=3 ttl=254 time=15 ms
From 2.2.2.2: bytes=32 seq=4 ttl=254 time=16 ms
From 2.2.2.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 2.2.2.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/21/31 ms

PC2ping 出口路由器两个地址以及互联网模拟2.2.2.2

PC>ping 192.168.20.254

Ping 192.168.20.254: 32 data bytes, Press Ctrl_C to break
From 192.168.20.254: bytes=32 seq=1 ttl=255 time=46 ms
From 192.168.20.254: bytes=32 seq=2 ttl=255 time=16 ms
From 192.168.20.254: bytes=32 seq=3 ttl=255 time=16 ms
From 192.168.20.254: bytes=32 seq=4 ttl=255 time=15 ms
From 192.168.20.254: bytes=32 seq=5 ttl=255 time=16 ms

--- 192.168.20.254 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/21/46 ms

PC>ping 200.1.1.1

Ping 200.1.1.1: 32 data bytes, Press Ctrl_C to break
From 200.1.1.1: bytes=32 seq=1 ttl=255 time<1 ms
From 200.1.1.1: bytes=32 seq=2 ttl=255 time<1 ms
From 200.1.1.1: bytes=32 seq=3 ttl=255 time=16 ms
From 200.1.1.1: bytes=32 seq=4 ttl=255 time=15 ms
From 200.1.1.1: bytes=32 seq=5 ttl=255 time=16 ms

--- 200.1.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 0/9/16 ms

PC>
PC>ping 2.2.2.2

Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
From 2.2.2.2: bytes=32 seq=1 ttl=254 time=16 ms
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=31 ms
From 2.2.2.2: bytes=32 seq=3 ttl=254 time=15 ms
From 2.2.2.2: bytes=32 seq=4 ttl=254 time=16 ms
From 2.2.2.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 2.2.2.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/21/31 ms

3.配置IPSec

现在两边公司的PC都可以访问互联网了,但是两边的私网不通的,湖南地区的10网段和深圳地区的20网段PC

第一步,匹配需要保护的流量

也就是打隧道的流量,湖南私网10网段的地址到达深圳总部的私网20网段,有源有目的所以得用高级ACL匹配

AR1配置

匹配湖南到深圳的流量

[AR1]acl 3000
[AR1-acl-adv-3000]rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 19
2.168.20.0 0.0.0.255
[AR1-acl-adv-3000]quit

AR2配置

匹配深圳到湖南的流量

[AR2]acl 3000
[AR2-acl-adv-3000]rule 20 permit ip source 192.168.20.0 0.0.0.255 destination 19
2.168.10.0 0.0.0.255
[AR2-acl-adv-3000]quit
[AR2]

第二步,配置IPSec提议

AR1配置

配置提议名称:如hunan

认证算法:如md5

加密算法:如des

可以用display ipsec proposal查看详情信息

[AR1]ipsec proposal hunan
[AR1-ipsec-proposal-hunan]esp authentication-algorithm md5
[AR1-ipsec-proposal-hunan]esp encryption-algorithm des
[AR1-ipsec-proposal-hunan]quit
[AR1]display ipsec proposal

Number of proposals: 1

IPSec proposal name: hunan                            
 Encapsulation mode: Tunnel                            
 Transform         : esp-new
 ESP protocol      : Authentication MD5-HMAC-96                             
                     Encryption     DES
[AR1]

AR2配置

配置提议名称:如shenzhen

认证算法:如md5

加密算法:如des

可以用display ipsec proposal查看详情信息

[AR2]ipsec proposal shenzhen
[AR2-ipsec-proposal-shenzhen]esp authentication-algorithm md5
[AR2-ipsec-proposal-shenzhen]esp encryption-algorithm des
[AR2-ipsec-proposal-shenzhen]quit
[AR2]display ipsec proposal

Number of proposals: 1

IPSec proposal name: shenzhen                            
 Encapsulation mode: Tunnel                            
 Transform         : esp-new
 ESP protocol      : Authentication MD5-HMAC-96                             
                     Encryption     DES
[AR2]

第三步,IPSec手动方式安全策略

自动的配置更复杂

AR1配置

策略名字叫hn,manual手动方式

安全acl3000

提议用前面配号的hunan

本地地址100.1.1.1,远端地址200.1.1.1

入方向SA编号54321,认证秘钥monster

出方向SA编号12345,认证秘钥monster

[AR1]ipsec policy hn 10 manual
[AR1-ipsec-policy-manual-hunan-10]security acl 3000
[AR1-ipsec-policy-manual-hunan-10]proposal hunan
[AR1-ipsec-policy-manual-hunan-10]tunnel local 100.1.1.1
[AR1-ipsec-policy-manual-hunan-10]tunnel remote 200.1.1.1
[AR1-ipsec-policy-manual-hunan-10]sa spi inbound esp 54321
[AR1-ipsec-policy-manual-hunan-10]sa string-key inbound esp cipher monster
[AR1-ipsec-policy-manual-hunan-10]sa spi outbound esp 123456
[AR1-ipsec-policy-manual-hunan-10]sa string-key outbound esp cipher monster
[AR1-ipsec-policy-manual-hunan-10]quit
[AR1]

AR2配置

和AR1相反

安全策略名叫sz

安全流量匹配acl3000

本地地址200.1.1.1,远端地址100.1.1.1

入方向SA编号12345,认证秘钥monster

出方向SA编号54321,认证秘钥monster

[AR2]ipsec policy sz 10 manual
[AR2-ipsec-policy-manual-shenzhen-10]security acl 3000
[AR2-ipsec-policy-manual-shenzhen-10]proposal shenzhen
[AR2-ipsec-policy-manual-shenzhen-10]tunnel local 200.1.1.1
[AR2-ipsec-policy-manual-shenzhen-10]tunnel remote 100.1.1.1
[AR2-ipsec-policy-manual-shenzhen-10]sa spi inbound esp 12345
[AR2-ipsec-policy-manual-shenzhen-10]sa string-key inbound esp cipher monster
[AR2-ipsec-policy-manual-shenzhen-10]sa spi outbound esp 54321
[AR2-ipsec-policy-manual-shenzhen-10]sa string-key outbound esp cipher monster
[AR2-ipsec-policy-manual-shenzhen-10]quit
[AR2]

第四步,接口上应用IPSec策略

AR1配置

应用ipsec策略叫hunan的

[AR1]interface gigabitether 0/0/1
[AR1-GigabitEthernet0/0/1]ipsec policy hn
[AR1-GigabitEthernet0/0/1]quit
[AR1]

AR2配置

应用ipsec策略叫shenzhen的

[AR2]interface gigabitether 0/0/0
[AR2-GigabitEthernet0/0/0]ipsec policy sz
[AR2-GigabitEthernet0/0/0]quit
[AR2]

4.配置静态路由

配完ipsec策略发现两边的私网地址还是不能互通,因为前面配置nat匹配了acl2000,需要排除去往深圳总部的流量,先把之前配置的删掉

AR1配置

进入接口删除nat,然后再把acl 2000 删掉

然后重新创建高级ACL3001,3000已经备用掉了,创建了两条规则,拒绝10到20,其它都允许(意思就是访问总部的私网地址就不做nat)

[AR1]interface gigabitether 0/0/1
[AR1-GigabitEthernet0/0/1]undo nat outbound 2000
[AR1-GigabitEthernet0/0/1]quit
[AR1]undo acl 2000
[AR1]acl 3001
[AR1-acl-adv-3001]rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 192.
168.20.0 0.0.0.255
[AR1-acl-adv-3001]rule 20 permit ip 
[AR1-acl-adv-3001]quit
[AR1]interface gigabitether 0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 3001
[AR1-GigabitEthernet0/0/1]quit
[AR1]

AR2配置

删除nat,再删除acl2000

然后重新创建高级ACL3001,3000已经备用掉了,创建了两条规则,拒绝20到10,其它都允许

[AR2]interface gigabitether 0/0/0
[AR2-GigabitEthernet0/0/0]undo nat outbound 2000
[AR2-GigabitEthernet0/0/0]quit
[AR2]undo acl 2000
[AR2]acl 3001
[AR2-acl-adv-3001]rule 10 deny ip source 192.168.20.0 0.0.0.255 destination 192.
168.10.0 0.0.0.255
[AR2-acl-adv-3001]rule 20 permit ip
[AR2-acl-adv-3001]quit
[AR2]interface gigabitether 0/0/0
[AR2-GigabitEthernet0/0/0]nat outbound 3001
[AR2-GigabitEthernet0/0/0]quit
[AR2]

验证两边私网是否相通

PC1,访问互联网和深圳地区私网都通

PC>ping 2.2.2.2

Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
From 2.2.2.2: bytes=32 seq=1 ttl=254 time<1 ms
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=16 ms
From 2.2.2.2: bytes=32 seq=3 ttl=254 time=15 ms
From 2.2.2.2: bytes=32 seq=4 ttl=254 time=32 ms
From 2.2.2.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 2.2.2.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 0/18/32 ms

PC>ping 192.168.20.1

Ping 192.168.20.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.20.1: bytes=32 seq=2 ttl=127 time=31 ms
From 192.168.20.1: bytes=32 seq=3 ttl=127 time=32 ms
From 192.168.20.1: bytes=32 seq=4 ttl=127 time=31 ms
From 192.168.20.1: bytes=32 seq=5 ttl=127 time=47 ms

--- 192.168.20.1 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/35/47 ms

PC>

PC2,访问互联网和湖南地区私网都通

PC>ping 2.2.2.2

Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
From 2.2.2.2: bytes=32 seq=1 ttl=254 time=15 ms
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=32 ms
From 2.2.2.2: bytes=32 seq=3 ttl=254 time=15 ms
From 2.2.2.2: bytes=32 seq=4 ttl=254 time=32 ms
From 2.2.2.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 2.2.2.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/25/32 ms

PC>ping 192.168.10.1

Ping 192.168.10.1: 32 data bytes, Press Ctrl_C to break
From 192.168.10.1: bytes=32 seq=1 ttl=127 time=31 ms
From 192.168.10.1: bytes=32 seq=2 ttl=127 time=31 ms
From 192.168.10.1: bytes=32 seq=3 ttl=127 time=31 ms
From 192.168.10.1: bytes=32 seq=4 ttl=127 time=32 ms
From 192.168.10.1: bytes=32 seq=5 ttl=127 time=31 ms

--- 192.168.10.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/31/32 ms

PC>

方法2:自动IPSEC隧道

比手动多了两个步骤,在第二部加入IKE的安全提议和IKE的对等体设置,其它和静态一样的

策略:manual表示手动,isakmp表示自动

2
  1. 支付宝打赏

    qrcode alipay
  2. 微信打赏

    qrcode weixin
  3. QQ打赏

    qrcode qq

评论区