vpn-5cisco的路由VPN技术.ppt

《vpn-5cisco的路由VPN技术.ppt》由会员分享，可在线阅读，更多相关《vpn-5cisco的路由VPN技术.ppt（40页珍藏版）》请在得力文库 - 分享文档赚钱的网站上搜索。

1、 Cisco 路由器的路由器的VPN技术技术一般我们设计VPN网络的设备选择依据我们一般用路由器做site-tosite的VPN我们一般用VPN3000这样的集中器做remoteVPN（价格考虑）路由器起VPN的优势1.数据传输IPSEC有一些局限性，但是路由器不光支持IPSEC，他还支持GRE2.可以采用动态的多点VPN DMVPN技术可以对RIP.,IGRP,EGIRP,BGP的支持，只有路由器可以做，PIX不支持，只支持隧道，但是IOS7.0 版本以上的除外。3.介质的转换ATM,FR,ISDN,DSL,以太网，点对点4.QOS支持比如说两点之间起语音和视频路由器上支持的QOS1.FIF

2、O2.CBWFQ3.CQ定制队列4.CBLLQ基于类别的低延迟队列5.IP RTP 多媒体应用程序6.WRRQ权重的轮循队列7.PQ优先级队列路由器的ISAKMP/IKE阶段一的建立过程1.允许IPsec的流量hssj(config)#access-list 101 per udp any any eq 500 hssj(config)#access-list 101 per ahp any any hssj(config)#access-list 101 per esp any anyhssj(config)#access-list 101 per udp any any eq 45002.

3、定义一个isakmp/ike的策略 启用isakmp：hssj(config)#crypto isakmp enable 建立策略：（对管理的连接建立的验证和保护）hssj(config)#crypto isakmp policy 10其中序号的作用是越小越优先，可以有多个策略的存在hssj(config-isakmp)#encryption 3des选择加密的格式hssj(config-isakmp)#hash md5对HMAC的建立hssj(config-isakmp)#authentication pre-share 选择共享密钥hssj(config-isakmp)#group?1 D

4、iffie-Hellman group 1 2 Diffie-Hellman group 2 5 Diffie-Hellman group 5hssj(config-isakmp)#lifetime 86400*策略越低越优先，最安全的策略是1，最不安全的策略是10000hssj#show crypto isakmp policy Global IKE policyProtection suite of priority 10 encryption algorithm:Three key triple DES hash algorithm:Message Digest 5 authentica

5、tion method:Pre-Shared Key Diffie-Hellman group:#1(768 bit)lifetime:86400 seconds,no volume limitDefault protection suite encryption algorithm:DES-Data Encryption Standard(56 bit keys).hash algorithm:Secure Hash Standard authentication method:Rivest-Shamir-Adleman Signature Diffie-Hellman group:#1(7

6、68 bit)lifetime:86400 seconds,no volume limit对等体协商的策略b#sh crypto isakmp policy Global IKE policyProtection suite of priority 2 encryption algorithm:Three key triple DES hash algorithm:Secure Hash Standard authentication method:Pre-Shared Key Diffie-Hellman group:#2(1024 bit)lifetime:3600 seconds,no

7、volume limitProtection suite of priority 1 encryption algorithm:DES-Data Encryption Standard(56 bit keys).hash algorithm:Message Digest 5 authentication method:Pre-Shared Key Diffie-Hellman group:#1(768 bit)lifetime:86400 seconds,no volume limitB：b#sh crypto isakmp policy Global IKE policyProtection

8、 suite of priority 2 encryption algorithm:Three key triple DES hash algorithm:Secure Hash Standard authentication method:Pre-Shared Key Diffie-Hellman group:#2(1024 bit)lifetime:3600 seconds,no volume limitProtection suite of priority 1 encryption algorithm:DES-Data Encryption Standard(56 bit keys).

9、hash algorithm:Message Digest 5 authentication method:Pre-Shared Key Diffie-Hellman group:#1(768 bit)lifetime:86400 seconds,no volume limit当2个对等体之间发生策略的比较的时候，他们不光看序号，他们要比较策略的相同性A 策略1B策略1比较，不同 A策略1B策略2比较，相同，连接*注意的一点：lifetime:86400 seconds,no volume limit这个数值可以不同，他取最小的那个值为标准。启动IKE的死亡对等体DPD，作用就是用keepal

10、ive报文，来验证对方是否存在周期性：周期的发送keepalive报文按需：按照需要去发送a(config)#crypto isakmp keepalive?Number of seconds between keep alives这个值可以手动设置，他也有默认的值a#debug crypto isakmpCrypto ISAKMP debugging is onISAKMP/IKE阶段一的设备验证Cisco支持3种：pre-share Pre-Shared Key 预共享密钥 rsa-encr Rivest-Shamir-Adleman Encryption RSA加密随机数 rsa-sig

11、 Rivest-Shamir-Adleman Signature RSA签名（证书）命令：a(config)#crypto isakmp identity?address Use the IP address of the interface for the identity dn Use the distinguished name of the router cert for the identity hostname Use the hostname of the router for the identity你可以利用hostname来建立验证表，IP add最多可以到8个ipadd预

12、共享密钥1.预共享密钥a(config)#crypto isakmp key hssj address 10.1.1.2 对对段的设备加以密码控制2.保护预共享密钥a(config)#key config-key?Configuration key number把明文变成密文3.查看预共享密钥a#show crypto isakmp key Keyring Hostname/Address Preshared Keydefault 10.1.1.2 hssjRSA加密随机数理论思路：1.建立公钥和私钥的密钥对2.共享公钥实验的过程：1.产生RSA的加密随机数hssj-1(config)#hos

13、tname hssj-1hssj-1(config)#ip domain-name hssj-1(config)#crypto key generate rsa?general-keys Generate a general purpose RSA key pair for signing and encryption usage-keys Generate separate RSA key pairs for signing and encryption 测试hssj-1(config)#crypto key generate rsa usage-keys hssj-1#sh crypto

14、key mypubkey rsa%Key pair was generated at:04:02:21 UTC Mar 1 1993Key name:hssj- Usage:Signature Key Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A6CE21 20C133F9 A17B07EC 7380C7D2 79B2DBEF 4085D444 3BB2CDB6 E86B17D3 34F83843 B344D938 2DC0A3D8 8B11797D 9A8F569D 4969C110 A5084526 B

15、C551FFA 23020301 0001%Key pair was generated at:04:02:50 UTC Mar 1 1993Key name:hssj- Usage:Encryption Key Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C8470C F4E56F4A D619BD46 BC5DCEDD DB48A82B 9ECE0407 270C31E9 7228CC51 72665657 2C28E138 C45D368B 9FEA11CF 1ECAB924 83C7EC82 A8BF

16、ABA3 4F75DB37 4D020301 0001hssj-1#测试hssj-1(config)#crypto key generate rsa general-keys modulus 2048hssj-1#sh crypto key mypubkey rsa%Key pair was generated at:14:09:14 UTC Jul 23 2007Key name:hssj-1.cisco Usage:General Purpose Key Key is not exportable.Key Data:30820122 300D0609 2A864886 F70D0101 0

17、1050003 82010F00 3082010A 02820101 00BF03C6 49BDF5C8 B348C82B A1F11D75 AD5F293A C307FD15 ED81AC82 78AF00AB 8A96CD8F 902D8176 E1DF5782 1D3D9FEF 8367EA32 66084D2D 05454DA2 C54091E3 6A0AE514 477422CE F52F7287 89DF1AE9 84FB085A EFD6813C 1423BB9B D93C5790 CAB5DF83 5C424B1D 4630E0AF 43109EEA 53473823 5072

18、B265 0C88E1CD 88BEA970 491B2FF7 DF600DA2 D616C610 BF4AC287 9491AB74 06EAD46E D3C01EE4 5BEAD907 5AD90497 15896DD2 3C5B2AA5 0F31A22D DC296916 CA89056E 6657595A C500273D E4B3718B 997CB2F9 F385081D 87B635EF F28EAEC4 50084536 E96A54DD 7EED5C09 84B84831 78C2977E 39FD2247 C8B2E2C0 7C9B6A0E C6EBEA81 370092D

19、B DC4864FC 77020301 0001%Key pair was generated at:14:09:15 UTC Jul 23 2007Key name:hssj-1.cisco.server Usage:Encryption Key Key is not exportable.Key Data:307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00E31191 3F85143F F1337C68 B034EBD7 8B0E3A2A 91C19088 BFDCCE53 9A5A3457 85145FEF EA068764

20、3E9AEB04 72130F94 EF5731E6 CA739549 E04BEEC3 ACE93F6A 0FB2FC82 1ECB62F0 735098DE B3442138 D0477B13 E6637A0E 6B4A5A93 A936B832 2F020301 0001RSA可以产生多个RSA密钥对要求：IOS的版本是在12.2(8)T可以用对等设备的公钥hssj-1(config)#crypto key pubkey-chain rsa pubkey-chain（16进制的密钥）hssj-1#sh crypto key pubkey-chain rsaCodes:M-Manually

21、 configured,C-Extracted from certificateCode Usage IP-Address/VRF Keyring NameM General 10.1.1.2 default cisco 第三种方法数字证书和签名注册数字证书不会像其他的对等体共享密钥分手动申请和简单申请SCEP两种，而SCEP最常用1.使用SCEP手动申请证书路由器不能使用超过2048位的公钥，必须使用ISKMP/IKE和IPSEC动态的建立管理和数据连接步骤：1.核实证书是否可以容纳到nvram中Show runhssj(config)#crypto ca certificate query

22、 打开路由器查询CA模式hssj#copy running-config startup-config 下载的CA保存到nvram中2.配置主机名和域名hostname 分配名字ip domain-name 建立一个域名3.产生一个产生一个rsa密钥队密钥队hssj(config)#crypto key generate rsa 建立密钥对hssj-1#sh crypto key mypubkey rsa%Key pair was generated at:04:22:40 UTC Mar 1 1993Key name:hssj- Usage:General Purpose Key Key D

23、ata:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00BB082E 83D48F8A ADE30F7B EC6E3A43 53E7AA07 F28809E8 B84DC09B 0AF7BE8F B3A6E2C0 76DB2ECF 548AA4B9 FFA76A5E 97E28407 F7DC39CF A4FDEBCB 7336A699 3D020301 00014.定义一个CA和证书授权hssj(config)#crypto ca trustpoint fxhhssj(ca-trustpoint)#enrollment url

24、与ca交互的URLhssj(ca-trustpoint)#enrollment mode ra 不需要配置，是否支持RA的命令hssj(ca-trustpoint)#enrollment retry period 再次请求CA的时间间隔，默认是1分钟5.下载和验证CAhssj(config)#crypto ca authenticate fxh6.请求路由器的身份验证hssj(config)#crypto ca enroll fxh7.存储CA的身份证书8.核实证书的操作hssj#show crypto ca trustpointshssj#show crypto ca certificates hssj#show crypto ca crls debug crypto pki