CISCO IPsec VPN配置大全11824.docx

《CISCO IPsec VPN配置大全11824.docx》由会员分享，可在线阅读，更多相关《CISCO IPsec VPN配置大全11824.docx（19页珍藏版）》请在得力文库 - 分享文档赚钱的网站上搜索。

1、CISCO IPsec VPN配置大全红头发(aaka CCCIE#151001), ?3 xx* x/ ?6 i7 rrhttpp:/m% F/ G, i: 5 i22 F5 _wwww.91llab.ccom4 K: RR/ cH: r+ BB( G77 ! ewwww.91llab.ccom一.基于PSSK的IPPsec VPN配配置ZZ2 U+ n8 ?, vv* R y首先先IOS带带k的就可可以了,支支持加密特特性,拓扑扑如下:66 h: r4 ?, O00 g% n/ mm纽爱科网网络实验室室社区 topo.jpg (57.02 KKB)2008-10-111 200:147 /

2、 D bb+ Sx g+ _, p11.R1基基本配置:3 r# k, ! 2 u R11(connfig)#intterfaace lloopbback00/ P$ Q; w8 VV% b) 4 w! OOwww.91laab.coomR1(conffig-iif)#iip adddresss 100.1.11.1 2255.2255.2255.00R1(cconfiig-iff)#noo shuutdowwnR1(conffig-iif)#iinterrfacee serrial00/0# s, l aa3 ! d1 P% _* n# i_wwww.91llab.ccomR11(connf

3、ig-if)#ip aaddreess192.168.1.1 255.255.255.252RR1(coonfigg-if)#cloock rrate 560000, HH2 w66 x/ q4 nn) mRR1(coonfigg-if)#no shuttdownnR1(cconfiig-iff)#exxit8 & + R) y2 Y. / q# g* W2.定定义感兴趣趣流量与路路由协议:, R77 r# . pp t; f- CR1(conffig)#acceess-llist 100 permmit iip 100.1.11.0 00.0.00.2555 10.2.2.0 0.0.0.2

4、5588 S- M XX- A- # D/ llR1(cconfiig)#iip rooute 0.0.0.0 0.0.0.0 seriial0/05 JJ3 w. i3 R1 ( q33.全局启启用ISAAKMP并并定义对等等体及其PPSK(预预共享密钥钥):R11(connfig)#cryypto isakkmp eenablle R11(connfig)#cryypto isakkmp kkey 991labb adddresss 1922.1688.1.22 t66 Y?; zz! 00 A( V! JJ# l44.定义IIKE策略略:9 hh4 n/ e/ N gg( k77 g!

5、0 OOwww.91laab.coomR1(conffig)#cryppto iisakmmp poolicyy 10RR1(coonfigg-isaakmp)#enccrypttion aes 128 /-默认是DDES加密密-/R1(cconfiig-issakmpp)#haash ssha /-默认认是SHAA-1-/) s( - m/ rr% X11 w7 H纽爱科科网络实验验室社区RR1(coonfigg-isaakmp)#autthentticattion pre-sharre R11(connfig-isakkmp)#grouup 2 /-默认是7768位的的DH1-/) J a

6、9 zz0 U99 W9 h yRR1(coonfigg-isaakmp)#liffetimme 36600 /-默认认是864400秒-/RR1(coonfigg-isaakmp)#exiit0 xx: G44 P. b5 XX- _! 55.定义IIPSecc转换集(trannsforrm seet):RR1(coonfigg)#crryptoo ipssec ttranssformm-sett tt esp-aes 128 esp-sha-hmacc $ yy1 66 i! ; + b+ PR11(cfgg-cryypto-tranns)#mmode tunnnel 66 x O( 6

7、F/ gR1(cfg-cryppto-ttranss)#exxit* O0 vv! n11 |2 n$ FF - % n纽爱科科网络实验验室社区66.定义ccryptto maap并应用用在接口上上:3 CCHQ# m+ PP! a: % W2 qq* CRR1(coonfigg)#crryptoo mapp cissco 110 ippsec-isakkmp 99 N$ ?2 pp# R, Q6 J; DDR1(cconfiig-crryptoo-mapp)#maatch addrress 100 X+ w8 p* ZZ( a33 7 u% uuR1(cconfiig-crryptoo-ma

8、pp)#seet peeer 1192.1168.11.2 /-定定义要应用用cryppto mmap的对对等体地址址-/; Y+ o% D: XX+ ?# O9 M1 ?# sRR1(coonfigg-cryypto-map)#sett traansfoorm-sset ttt /-定义义cryppto mmap要应应用的IPPsec转转换集-/2 F! _9 s77 z- o. HHR1(cconfiig-crryptoo-mapp)#exxit# t+ jj: v11 e$ A. bb0 M+ RR1(coonfigg)#innterfface seriial0/0R1(conffig-

9、iif)#ccryptto maap ciisco/ S O4 9 d& u W& DD( _33 F. m4 WW& t44 T* ?EE* M k* j*Maar11 00:08:331.1331: %CRYPPTO-66-ISAAKMP_ON_OOFF: ISAKKMP iis ONN, W. ?/ f, NNv22 A5 lR1(conffig-iif)#eendR11#R1配配置完成.2 U. v& Y- xx( N( E dd3 Y33 00 j( S3 ?% B77 z. r同理,R2相关关配置如下下:! ; * W& D5 II( 纽纽爱科网络络实验室社社区!cryppto i

10、isakmmp poolicyy 10enccr aeesautthentticattion pre-sharregrooup 22z$ YY% X00 H- v* ppcryppto iisakmmp keey 911lab addrress 192.168.1.1!cryppto iipsecc traansfoorm-sset ttt essp-aees essp-shha-hmmac & : d9 ! N/ |0 Z* JJ7 r99 H!cryppto mmap cciscoo 10 ipseec-issakmpp sett peeer 1992.1668.1.1sett traan

11、sfoorm-sset ttt % q NN+ P! ? F; MM* x- xmaatch addrress 100!inteerfacce Looopbaack088 q$ Q$ tt/ A q. i/ aa1 Z纽爱爱科网络实实验室社区区ip aaddreess 110.2.2.1 255.255.255.02 _8 ( gg+ r, t+ m; nn+ h# x# uwwww.91llab.ccom!inteerfacce Seeriall0/0* k6 J) dd& q99 s- k3 ?6 44 Q Z) UUip aaddreess 1192.1168.11.2 2255.225

12、5.2255.2252- R. VV8 hT0 1 cryppto mmap cciscoo!( 00 U6 p# GG4 i33 Nipp rouute 00.0.00.0 00.0.00.0 SSeriaal0/009 S; 9 T* hh- q, Q( F# rr1 T!* U: $ c, II6 S! I纽爱爱科网络实实验室社区区acceess-llist 100 permmit iip 100.2.22.0 00.0.00.2555 10.1.1.0 0.0.0.255!二.采用积积极模式并并PSK的的IPseec VPPN配置33 |9 h6 WW8 h77 Y7 9 uuZ) k

13、! P3 / X44 c4 $ ?纽爱科网网络实验室室社区 1.R11基本配置置:R1(conffig)#inteerfacce looopbaack0RR1(coonfigg-if)#ip addrress 10.11.1.11 2555.2555.2555.0R11(connfig-if)#no sshutddownRR1(coonfigg-if)#intterfaace sseriaal0/003 a00 ?4 d/ KK5 D # L6 ; u& s, _R1(conffig-iif)#iip adddresss1192.1168.11.1 2255.2255.2255.2252R11

14、(connfig-if)#clocck raate 5560000* K, R4 P; ?# ?88 F3 IR1(conffig-iif)#nno shhutdoown. V$ ! I( 7 f# BB. O- R11(connfig-if)#exitt9 p V! aa* Q; d5 f( / _22 2 b3 XX, + Q8 r2.定义感感兴趣流量量与路由协协议:( 3 CC ; a1 pp$ Z$ E3 v+ cc& vRR1(coonfigg)#acccesss-lisst 1000 peermitt ip 10.11.1.00 0.00.0.2255 110.2.2.0 0.0.

15、0.2555/ 0 _$ z) g8 ii S# BR11(connfig)#ip routte 0.0.0.0 0.0.0.0 seeriall0/000 a. m/ hh- df u7 FF纽爱科网网络实验室室社区; u/ HH, Z11 Y5 n7 II4 v99 Y纽爱爱科网络实实验室社区区3.全局局启用ISSAKMPP并定义对对等体及其其PSK(预共享密密钥),采采用积极模模式:& G. OO( D22 i+ F) www.91laab.coomR1(conffig)#cryppto iisakmmp ennablee R1(conffig)#cryppto iisakmmp pee

16、er aaddreess 1192.1168.11.27 # nn1 v % G$ KK4 t33 FR11(connfig-isakkmp-ppeer)#sett agggresssive-modee cliient-endppointt ipvv4-adddresss 1992.1668.1.1 ( FF0 C* k7 b8 HH! + RR1(coonfigg-isaakmp-peerr)#seet agggresssivee-modde paasswoord 991labb5 J22 p. tt4 k% k8 k) YY1 c, w7 r* GG4.定义义IKE策策略:; D& AA-

17、 b44 f: N) ff- ?00 J. _. jj- mR1(cconfiig)#ccryptto issakmpp pollicy 10R11(connfig-isakkmp)#encrryptiion aaes 1128 /-默默认是DEES加密-/66 K1 B& QQ# e g) Y- rr8 z A7 S9 RRR1(cconfiig-issakmpp)#haash ssha /-默认认是SHAA-1-/+ K$ ww: N. L9 b1 kkR1(cconfiig-issakmpp)#auuthennticaationn pree-shaare RR1(coonfigg-isa

18、akmp)#grooup 22 /-默认是是768位位的DH11-/: p. P: y UU: r) A, E) CCyRR1(coonfigg-isaakmp)#liffetimme 36600 /-默认认是864400秒-/77 Q0 y6 4 X/ R2 |1 RRR1(cconfiig-issakmpp)#exxit5.定义IPPSec转转换集(ttranssformm sett):7 T/ TT! ?! B6 nn+ r33 N% T纽爱科科网络实验验室社区RR1(coonfigg)#crryptoo ipssec ttranssformm-sett tt esp-aes 128 e

19、sp-sha-hmacc R1(cfg-cryppto-ttranss)#moode ttunneel . x3 OO& H# L1 e FF- tRR1(cffg-crryptoo-traans)#exitt6 7 G) ii+ 99 v+ u9 qq! D66 ?6.定义crryptoo mapp并应用在在接口上:/ J66 Z) i$ cc$ h- i% N3 ii H纽纽爱科网络络实验室社社区R1(conffig)#cryppto mmap cciscoo 10 ipseec-issakmpp JJ; H55 z: f1 DD q q+ ER1(conffig-ccryptto-maa

20、p)#mmatchh adddresss 1000 R1(conffig-ccryptto-maap)#sset ppeer 192.168.1.2 /-定义要应应用cryypto map的的对等体地地址-/! |* , p& G$ dd) C( U! d- SSR1(cconfiig-crryptoo-mapp)#seet trransfform-set tt /-定定义cryypto map要要应用的IIPsecc转换集-/RR1(coonfigg-cryypto-map)#exiit4 7 t00 N- $ zz纽爱科网网络实验室室社区R11(connfig)#intterfaace s

21、seriaal0/00R1(cconfiig-iff)#crryptoo mapp cissco / WW; W* R3 / SS/ ?55 Z*MMar1 000:08:31.1131: %CRYYPTO-6-ISSAKMPP_ON_OFF: ISAAKMP is OONR1(conffig-iif)#eendR11#- mm2 f, M$ T2 qq, n纽纽爱科网络络实验室社社区R1配配置完成.d99 I) R/ dd2 m同理,RR2配置如如下:! !cryppto iisakmmp poolicyy 10. C# _ jj7 p88 O0 T6 + - eenncr aaesauut

22、hennticaationn pree-shaaregrroup 2!; N E+ _ ?8 E( Bcrryptoo isaakmp peerr adddresss 1922.1688.1.11set aggrressiive-mmode passswordd 91llab; k6 uu3 S44 w: r+ eeset aggrressiive-mmode clieent-eendpooint ipv44-adddresss 1922.1688.1.11 !cryppto iipsecc traansfoorm-sset ttt essp-aees essp-shha-hmmac !cry

23、ppto mmap cciscoo 10 ipseec-issakmpp sett peeer 1992.1668.1.19 kk: h88 Z. z8 |( _- F1 u. UU% fsset ttranssformm-sett tt ) n22 ?* G9 VV: k|8 m% CCmatcch adddresss 10009 UU# G+ q$ Y+ xx/ ?) C7 9 CC5 |!inteerfacce Looopbaack0iip adddresss 100.2.22.1 2255.2255.2255.00 t* G6 j5 . R11 h/ v!7 x* d J & R; i

24、nnterfface Seriial0/0/ ee% j55 f! R6 zz! Aripp adddresss 1922.1688.1.22 2555.2555.2555.2522cryppto mmap cciscoo3 y) v1 cc. ?! h7 d# XX!ip rroutee 0.00.0.00 0.00.0.00 Serrial00/0% n% rr5 O99 M8 k, ss# m22 G( v!& N33 FJ3 PP0 A: U3 C2 QQ; - u纽爱爱科网络实实验室社区区acceess-llist 100 permmit iip 100.2.22.0 00.0.00

25、.2555 10.1.1.0 0.0.0.255!三.GREE隧道与IIPsecc的结合GGRE隧道道本身不带带安全特性性,可以通通过结合基基于PSKK的IPssec来实实现安全功功能.拓扑扑如下:55 X % M88 n5 b; nn& _( u. J+ DD$ n11 % q, XX( r J1 wwwww.91llab.ccom1.R1基本本配置:RR1(coonfigg)#innterfface looppbackk0R1(conffig-iif)#iip adddresss 100.1.11.1 2255.2255.2255.00R1(cconfiig-iff)#noo shuutd

26、owwn$ $ _88 - ? pp% i99 j/ VR1(conffig-iif)#iinterrfacee serrial00/00 s, ee. S33 R6 V8 ss6 s33 URR1(coonfigg-if)#ip addrress1922.1688.1.11 2555.2555.2555.2522R1(cconfiig-iff)#cllock ratee 560000R11(connfig-if)#no sshutddown% |/ h/ gg* - FR11(connfig)#intterfaace ttunneel 0RR1(coonfigg-if)#ip unnuumb

27、erred sseriaal0/00R1(cconfiig-iff)#tuunnell souurce seriial0/0R1(conffig-iif)#ttunneel deestinnatioon 1992.1668.1.1# bb5 # D/ O% R1(cconfiig-iff)#tuunnell modde grre ipp /-可可以不打,默认即为为GRE-/ I& AA% S. n( T$ PP G55 RR1(coonfigg-if)#no shuttdownn& N+ b& d/ # K# QRR1(coonfigg-if)#exiit+ zz a! i5 C* bb8 E

28、+ 0 u2.定定义感兴趣趣流量与路路由协议:R1(cconfiig)#aaccesss-liist 1100 ppermiit grre hoost 1192.1168.11.1 hhost 192.168.1.2! s! u# YY/ d% t) I( WWR1(cconfiig)#iip rooute 0.0.0.0 0.0.0.0 seriial0/0( zz/ o22 H3 c4 nn. S: bR11(connfig)#ip routte 100.2.22.0 2255.2255.2255.00 serrial00/0: |9 - H99 9 R AA7 ?$ P$ C; FF.

29、WG4 % # m3.全局局启用ISSAKMPP并定义对对等体及其其PSK(预共享密密钥):RR1(coonfigg)#crryptoo isaakmp enabble RR1(coonfigg)#crryptoo isaakmp key 91laab adddresss 1992.1668.1.21 9 v& |2 p1 kk3 & w4.定义IKKE策略:% d) M/ HH( P11 t3 B. PP g纽纽爱科网络络实验室社社区R1(conffig)#cryppto iisakmmp poolicyy 10RR1(coonfigg-isaakmp)#enccrypttion aes 1

30、28 /-默认是DDES加密密-/: q* w( F, |, Y( X/ q; rr纽爱科网网络实验室室社区R11(connfig-isakkmp)#hashh shaa /-默认是SSHA-11-/) |B4 ?$ tt O f# eeR1(cconfiig-issakmpp)#auuthennticaationn pree-shaare RR1(coonfigg-isaakmp)#grooup 22 /-默认是是768位位的DH11-/ j E4 4 dd: $ |) LL2 mR1(cconfiig-issakmpp)#liifetiime 33600 /-默默认是866400秒秒-/R

31、1(cconfiig-issakmpp)#exxit( nn& t% q( m( OO; x% g- e4 TT8 N, k+ $ cc! c I55.定义IIPSecc转换集(trannsforrm seet):RR1(coonfigg)#crryptoo ipssec ttranssformm-sett tt esp-aes 128 esp-sha-hmacc / ZZ, I22 f; $ RR1(cffg-crryptoo-traans)#modee tunnnel R1(ccfg-ccryptto-trrans)#exiit5 KK9 S. ?+ g# hh8 d* r6.定定义cry

32、ypto map并并应用在接接口上:RR1(coonfigg)#crryptoo mapp cissco 110 ippsec-isakkmp RR1(coonfigg-cryypto-map)#mattch aaddreess 1100 RR1(coonfigg-cryypto-map)#sett peeer 1992.1668.1.2 /-定义义要应用ccryptto maap的对等等体地址-/RR1(coonfigg-cryypto-map)#sett traansfoorm-sset ttt /-定义义cryppto mmap要应应用的IPPsec转转换集-/! U+ DD8 ; o

33、pp& z11 MR11(connfig-cryppto-mmap)#exittR1(cconfiig)#iinterrfacee serrial00/0: g0 CC$ Q! I+ P$ PP3 h00 mR11(connfig-if)#cryppto mmap cciscoo. B- B+ $ rr4 l- a z# vv1 77 ?*MMar1 000:08:31.1131: %CRYYPTO-6-ISSAKMPP_ON_OFF: ISAAKMP is OON2 ww( T- H4 H( KK7 _99 x* |/ X77 I0 jR1(conffig-iif)#eend7 e4 QQ8

34、 r! 4 b; KK) i- JR11#/ CC/ Q$ z7 I; PP, h# R11配置完成成. 6 r# X y! mm2 A33 U同同理,R22相关配置置如下:; I0 e+ RR/ O: U+ L6 / S99 P5 M纽爱科科网络实验验室社区! !. L55 R/ G/ FF% L55 z7 d4 pp L纽纽爱科网络络实验室社社区cryypto isakkmp ppoliccy 1001 P& y# y5 tt i22 d! z ggencrr aessauthhentiicatiion ppre-sshareegrouup 20 TT: H$ U8 D7 HH% Pmcr

35、yppto iisakmmp keey 911lab addrress 192.168.1.166 N+ G4 _# r! * k2 cc) ! E( R! F! xx9 _88 Q! y* WW!cryppto iipsecc traansfoorm-sset ttt essp-aees essp-shha-hmmac !5 s; N9 ( nn% q* k# 3 zzcryppto mmap cciscoo 10 ipseec-issakmpp $ ee1 K; ?) n% PP( l99 |A0 AAset peerr 1922.1688.1.11! S& s0 C3 * ?: c7 e

36、sett traansfoorm-sset ttt maatch addrress 100!f. x% h4 aa8 g! x纽爱爱科网络实实验室社区区!, c66 G$ g* TT; C; b: g# ccwww.91laab.coom!7 D99 W9 t3 VVc* C/ intterfaace TTunneel0ipp unnnumbeered Seriial0/0tunnnel sourrce SSeriaal0/00/ O33 e k+ YY3 J dtuunnell desstinaationn 1922.1688.1.11!6 M, G8 M8 J99 U Z5 NN Piin

37、terrfacee Looopbacck0ipp adddresss 10.2.2.1 2555.2555.2555.0!inteerfacce Seeriall0/0, f% % nn+ a. W% wwip aaddreess 1192.1168.11.2 2255.2255.2255.2252. E1 RR( q11 P l+ qq1 q- 9 Q3 OOcryppto mmap cciscoo!( a00 7 D. ?: f11 SPip routte 0.0.0.0 0.0.0.0 Seeriall0/0& x5 eJJ- K# P) K& CC8 g& J!acceess-llis

38、t 100 permmit ggre hhost 10.22.2.11 hosst 100.1.11.1* T; AA) K99 J0 O3 II% s# Y( ywwww.91llab.ccom!四.IPssec VVPN的高高可用性通通常情况下下,我们希希望IPssec VVPN流量量可以在主主从路由器器之间做到到无缝切换换,可以通通过HSRRP与SSSO相结合合的方式来来达到此目目的.HSSRP用于于保证接入入流量的热热备份.一一旦主路由由器dowwn掉后,HSRPP立即将IIKE信息息与SA传传递给备份份路由器;而SSOO允许主从从路由器之之间共享IIKE与SSA信息.* O& P g

39、+ CC/ f66 A0 Iwwww.91llab.ccom7 j u: i- I5 kk7 _+ / V$ bb w topo.jpg (66.28 KKB)2008-10-115 199:48SPOKEE配置如下下:1.定定义感兴趣趣流量与路路由协议:SPOKKE(coonfigg)#acccesss-lisst 1000 peermitt ip 10.11.1.00 0.00.0.2255 110.2.2.0 0.0.0.2555SPOOKE(cconfiig)#iip rooute 0.0.0.0 0.0.0.0 seriial0/07 rr2 U44 m# I7 CC) h! 22.

40、全局启启用ISAAKMP并并定义对等等体及其PPSK(预预共享密钥钥):SPPOKE(conffig)#cryppto iisakmmp ennablee & 6 a66 x. G8 MMQ; A/ A8 ii4 I# _. RSPOOKE(cconfiig)#ccryptto issakmpp keyy 91llab aaddreess 00.0.00.0 00.0.00.02 G3 - F# 6 W5 ll纽爱科网网络实验室室社区3.定义IKKE策略:SPOKKE(coonfigg)#crryptoo isaakmp poliicy 110( AA7 L+ P5 x; BB N. y# l

41、SPOOKE(cconfiig-issakmpp)#enncrypptionn aess 1288 /-默认是是DES加加密-/SPOOKE(cconfiig-issakmpp)#haash ssha /-默认认是SHAA-1-/% 5 XX9 f66 z+ FZZ+ HmSPOKKE(coonfigg-isaakmp)#autthentticattion pre-sharre 4 d% ww6 Z00 k8 Fwwww.91llab.ccomSPPOKE(conffig-iisakmmp)#ggroupp 2 /-默默认是7668位的DDH1-/- F: AA+ h; Z: j/ : Z; h纽爱爱科网络实实验室社区区SPOKKE(coonfigg-isaakmp)#liffetimme 36600 /-默认认是864400秒-/SSPOKEE(connfig-isakkmp)#exitt4.定义义IPSeec转换集集(traansfoorm sset):SPOKKE(coonfigg)#crryptoo ipssec ttranssformm-sett nuaaiko esp-aes 128 esp-sha-hmacc SPOOKE(ccfg