野蛮模式ipsec的典型组网和配置.pdf-得力文库

资源描述

《野蛮模式ipsec的典型组网和配置.pdf》由会员分享，可在线阅读，更多相关《野蛮模式ipsec的典型组网和配置.pdf（11页珍藏版）》请在得力文库 - 分享文档赚钱的网站上搜索。

1、野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 1 页,共 11 页资料编码产品名称编写部门华为3 C o m T S C 资料版本 IPSEC野蛮模式典型组网和配置拟制李丹杜奕山日期 2004.2 审核日期审核日期批准日期版权所有侵权必究野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 2 页,共 11 页 1.1 目录 1 IPSEC 野蛮模式典型组网和配置.1 1.1 目录.2 1.2 中端路由器所

2、需版本 VRP3.3-002.3 1.3 常用的组网.3 1.4 IPSEC 配置前的参数选择.3 1.4.1 选择安全协议加密算法认证算法.3 1.4.2 选择报文封装形式.4 1.4.3 选择安全策略的协商方式.4 1.5 配置.4 1.5.1 配置前的准备工作.4 1.5.2 中心 C 的配置.4 1.5.3 分部 A 的配置.6 1.5.4 分部 B 的配置.7 1.5.5 上面配置的简单说明.8 1.6 完成后的确认.9 1.6.1 分部路由器 B.9 1.6.2 分部路由器 A.9 1.6.3 中心路由器 C.10 1.6.4 几个结论.11 野蛮模式 IPSec 的典型组网和配置

3、内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 3 页,共 11 页 1.2 中端路由器所需版本 VRP3.3-002 1.3 常用的组网图 1 IPSEC 野蛮模式典型组网 A企业分部普通 modem 或者 adsl 拨号从 ISP 处获得公网 IP B企业分部以太接入 internet从 ISP 的 DHCP 服务器自动获取 IP C总部固定 IP(必须固定 IP)所谓野蛮模式即是指分部没有固定 IP又要强行与总部建立 IPSEC 连接很野蛮 ABC 可以上 Internet三者内网数据加密处理两两互通 1.4 IPSEC 配置前的参数选择以下内容的具

5、散第 4 页,共 11 页 1.4.2 选择报文封装形式表 2 选择报文封装形式加密协议传输模式 transport tunnel ah-new IP AH data IP AH IP data esp-new IP ESP data ESP-T IP ESP IP data ESP-T ah-esp-new IP AH ESP data ESP-T IP AH ESP IP data ESP-T 1.4.3 选择安全策略的协商方式表 3 选择安全策略的协商方式安全策略的协商方式 manual isakmp 1.5 配置 1.5.1 配置前的准备工作表 4 配置前的参数选择 loc

6、al id 协商方式 pre-shared-key 安全协议加密算法认证算法 C Center isakmp abcdefg esp des sha1 A P1 isakmp abcdefg esp des sha1 B P2 isakmp abcdefg esp des sha1 表 5 加密数据流的指定 C C-A B-A C-B A-B acl number 100 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 rule 1 permit ip source 192.16

7、8.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 rule 2 deny ip acl number 101 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 rule 1 permit ip source 192.168.0.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 rule 2 deny ip A A-B A-C acl number 100 rule 1 permit ip sou

8、rce 192.168.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 rule 2 deny ip B B-A B-C acl number 100 rule 0 permit ip source 192.168.0.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 rule 1 permit ip source 192.168.0.0 0.0.

9、0.255 destination 192.168.1.0 0.0.0.255 rule 2 deny ip 因试验环境所限内网一律使用 loopback 口代替原理丝毫不变 1.5.2 中心 C 的配置 disp cur#sysname Center#tcp window 8#ike local id Center#ike peer other exchange-mode aggressive 野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 5 页,共 11 页 pre-shared-key abcdefg id-typ

10、e name remote-id P2 local single-subnet peer single-subnet#ike peer p1 exchange-mode aggressive pre-shared-key abcdefg id-type name remote-id P1 local single-subnet peer single-subnet#ipsec proposal center-1 esp authentication-algorithm sha1#ipsec proposal center-2 esp authentication-algorithm sha1#

11、ipsec policy center_1 1 isakmp security acl 101 ike-peer p1 proposal center-1#ipsec policy center_1 2 isakmp security acl 100 ike-peer other proposal center-2#controller E1 3/0 channel-set 0 timeslot-list 1#controller E1 3/1#interface Aux0 async mode flow link-protocol ppp#interface Ethernet1/0#inte

12、rface Ethernet1/1#interface Serial3/0:0 link-protocol ppp ip address 61.1.1.2 255.255.255.0 nat outbound 102 ipsec policy center_1#interface NULL0#interface LoopBack1 ip address 192.168.2.1 255.255.255.0#acl number 100 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 野

13、蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 6 页,共 11 页 rule 1 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 rule 2 deny ip acl number 101 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 rule 1 permit ip source 192.168.0.0 0.0.

14、0.255 destination 192.168.1.0 0.0.0.255 rule 2 deny ip acl number 102 rule 0 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255 rule 1 permit ip source 192.168.2.0 0.0.0.255 rule 2 deny ip#ip route-static 0.0.0.0 0.0.0.0 61.1.1.1#user-interface con 0 user-interface aux 0 user

15、-interface vty 0 4 authentication-mode none user privilege level 3 set authentication password simple a#return 1.5.3 分部 A 的配置 disp cur#sysname P1#super password level 3 simple a#local-user a password simple a local-user a level 3#tcp window 8#ike local id P1#ike peer ike-peer exchange-mode aggressiv

16、e pre-shared-key abcdefg id-type name remote-id Center remote-address 61.1.1.2 local single-subnet peer single-subnet#ipsec proposal center esp authentication-algorithm sha1#ipsec policy center 1 isakmp security acl 100 ike-peer ike-peer proposal center#controller E1 1/0#野蛮模式 IPSec 的典型组网和配置内部公开 200

17、3-12-06 华为 3Com 版权所有未经许可不得扩散第 7 页,共 11 页 controller E1 1/1#interface Aux0 async mode flow link-protocol ppp#interface Ethernet0/0#interface Ethernet0/1#interface Serial2/0 clock DTECLK1 link-protocol ppp ip address ppp-negotiate nat outbound 101 ipsec policy center#interface Serial2/1 clock DTECLK

18、1 link-protocol ppp#interface NULL0#interface LoopBack0 ip address 192.168.1.1 255.255.255.0#acl number 100 rule 1 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 rule 2 deny ip acl number 101 ru

19、le 0 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255 rule 1 permit ip source 192.168.1.0 0.0.0.255 rule 2 deny ip#ip route-static 0.0.0.0 0.0.0.0 Serial 2/0#user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode local set authentication passwo

20、rd simple a#return 1.5.4 分部 B 的配置 disp cur#sysname P2-1760#tcp window 8#ike local id P2#ike peer part-1 exchange-mode aggressive 野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 8 页,共 11 页 pre-shared-key abcdefg id-type name remote-id Center remote-address 61.1.1.2 local single-subnet pee

21、r single-subnet#ipsec proposal part-1 esp authentication-algorithm sha1#ipsec policy part_1 1 isakmp security acl 100 ike-peer part-1 proposal part-1#interface Aux0 async mode protocol link-protocol ppp#interface Ethernet0/0 ip address dhcp-alloc nat outbound 101 ipsec policy part_1#interface Serial

22、0/0 clock DTECLK1 link-protocol ppp#interface NULL0#interface LoopBack0 ip address 192.168.0.1 255.255.255.0#acl number 100 rule 0 permit ip source 192.168.0.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 rule 1 permit ip source 192.168.0.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 rule 2 deny ip a

23、cl number 101 rule 0 deny ip source 192.168.0.0 0.0.0.255 destination 192.168.0.0 0.2.55.255 rule 1 permit ip source 192.168.0.0 0.0.0.255 rule 2 deny ip#ip route-static 0.0.0.0 0.0.0.0 218.1.1.1#user-interface con 0 user-interface aux 0 user-interface vty 0 4 user privilege level 3 set authenticati

24、on password simple a#return 1.5.5 上面配置的简单说明除了 ike local id P2 中的 P2 是网络中必须确定唯一的其他的参数如野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 9 页,共 11 页 ipsec proposal part-1 ipsec policy part_1 1 isakmp ike peer part-1 中的黑体部分均是本机有效名字可以任意指定但必须注意上下文的对应关系 1.6 完成后的确认 1.6.1 分部路由器 B disp ipsec sa=In

25、terface:Ethernet0/0 path MTU:1500=-IPsec policy name:part_1 sequence number:1 mode:isakmp -connection id:3 encapsulation mode:tunnel tunnel local:218.1.1.2 tunnel remote:61.1.1.2 inbound ESP SAs spi:2299476677(0 x890f3ac5)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):18

26、87432448/1650 max received sequence-number:64 outbound ESP SAs spi:1393596162(0 x53109702)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887430920/1650 max sent sequence-number:71 1.6.2 分部路由器 A disp ipsec sa=Interface:Serial2/0 path MTU:1500=-IPsec policy name:center se

27、quence number:1 mode:isakmp -connection id:5 encapsulation mode:tunnel tunnel local:202.1.1.2 tunnel remote:61.1.1.2 inbound ESP SAs spi:1346805567(0 x50469f3f)野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 10 页,共 11 页 proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(byt

28、es/sec):1887432584/2860 max received sequence-number:62 outbound ESP SAs spi:3356390205(0 xc80e733d)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887431844/2860 max sent sequence-number:60 1.6.3 中心路由器 C disp ipsec sa=Interface:Serial3/0:0 path MTU:1500=-IPsec policy na

29、me:center_1 sequence number:1 mode:isakmp -connection id:6 encapsulation mode:tunnel tunnel local:61.1.1.2 tunnel remote:202.1.1.2 inbound ESP SAs spi:3356390205(0 xc80e733d)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887432788/2835 max received sequence-number:59 ou

30、tbound ESP SAs spi:1346805567(0 x50469f3f)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887431592/2835 max sent sequence-number:63 -IPsec policy name:center_1 sequence number:2 mode:isakmp -connection id:2 encapsulation mode:tunnel tunnel local:61.1.1.2 tunnel remote:2

31、18.1.1.2 inbound ESP SAs spi:1393596162(0 x53109702)proposal:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887432040/1611 max received sequence-number:70 outbound ESP SAs spi:2299476677(0 x890f3ac5)野蛮模式 IPSec 的典型组网和配置内部公开 2003-12-06 华为 3Com 版权所有未经许可不得扩散第 11 页,共 11 页 proposal

32、:ESP-ENCRYPT-DES ESP-AUTH-SHA1 sa remaining key duration(bytes/sec):1887431424/1611 max sent sequence-number:65 ping a 192.168.2.1 192.168.0.1 PING 192.168.0.1:56 data bytes,press CTRL_C to break Reply from 192.168.0.1:bytes=56 Sequence=1 ttl=255 time=55 ms Reply from 192.168.0.1:bytes=56 Sequence=2

33、 ttl=255 time=49 ms Reply from 192.168.0.1:bytes=56 Sequence=3 ttl=255 time=47 ms Reply from 192.168.0.1:bytes=56 Sequence=4 ttl=255 time=54 ms Reply from 192.168.0.1:bytes=56 Sequence=5 ttl=255 time=50 ms -192.168.0.1 ping statistics-5 packet(s)transmitted 5 packet(s)received 0.00%packet loss round

34、-trip min/avg/max=47/51/55 ms ping-a 192.168.2.1 192.168.1.1 PING 192.168.1.1:56 data bytes,press CTRL_C to break Reply from 192.168.1.1:bytes=56 Sequence=1 ttl=255 time=97 ms Reply from 192.168.1.1:bytes=56 Sequence=2 ttl=255 time=92 ms Reply from 192.168.1.1:bytes=56 Sequence=3 ttl=255 time=89 ms

35、Reply from 192.168.1.1:bytes=56 Sequence=4 ttl=255 time=93 ms Reply from 192.168.1.1:bytes=56 Sequence=5 ttl=255 time=89 ms -192.168.1.1 ping statistics-5 packet(s)transmitted 5 packet(s)received 0.00%packet loss round-trip min/avg/max=89/92/97 ms 1.6.4 几个结论 11.6.4 节显示延时 51ms1.6.5 节显示延时 92ms因为 A 用的是 R3640EB 用的是 R1760运算速度与 CPU 主频和内存有很大关系在可能的情况下中心尽量使用高主频大内存的路由器 2每个数据包加密一次或者解密一次(含封装 IP 头)的时间大约是 20ms 3组网确定了配置的主要任务其实是把表 4 和表 5 填完整路由器的命令配置无甚难度

展开阅读全文