实验拓扑:
R2 模拟运营商设备,将AR1所有数据进行nat
相关配置
AR2:
sysname r2
acl number 2000
rule 5 permit
interface GigabitEthernet0/0/0
ip address 23.0.0.2 255.255.255.0
nat outbound 2000
#
interface GigabitEthernet0/0/1
ip address 12.0.0.2 255.255.255.0
AR1:
sysname r1
acl number 3000
rule 10 permit ip source 192.168.10.0 0.0.0.255
destination 192.168.20.0 0.0.0.255
ipsec proposal 1
esp encryption-algorithm 3des
esp authentication-algorithm md5
ike local-name rta //配置本地标识
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
ike peer 1 v1
exchange-mode aggressive
pre-shared-key simple 12345678
ike-proposal 1
local-id-type name
remote-name rtb
remote-address 23.0.0.3
nat traversal
ipsec policy ipsec_po 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
interface GigabitEthernet0/0/1
ip address 12.0.0.1 255.255.255.0
ipsec policy ipsec_po
#
interface GigabitEthernet0/0/2
ip address 192.168.10.1 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 12.0.0.2
AR3:
sysname r3
acl number 3000
rule 5 permit ip source 192.168.20.0 0.0.0.255
destination 192.168.10.0 0.0.0.255
#
ipsec proposal 1
esp encryption-algorithm 3des
esp authentication-algorithm md5
ike local-name rtb
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key simple 12345678
ike-proposal 1
local-id-type name
remote-name rta
nat traversal
#
ipsec policy-template 1 1
ike-peer 1
proposal 1
#
ipsec policy ipsec_po 1 isakmp template 1
#
interface GigabitEthernet0/0/0
ip address 23.0.0.3 255.255.255.0
ipsec policy ipsec_po
interface GigabitEthernet0/0/2
ip address 192.168.20.1 255.255.255.0
#
# 指向 私网的回程路由
ip route-static 192.168.10.0 255.255.255.0 23.0.0.2
排错:
一开始 在ike 中 未配置 nat traversal(有文档说华为默认开启nat穿越)。
pc1 ping pc2 通过wireshark 抓包
AR2 G0/0/0 接口抓包分析:
AR2查看 nat session 情况
查看AR1 G0/0/01 接口数据:
可以看到IPsec数据包在AR1 出接口方向封装,到达AR2 上经过nat 将源地址改变继续传往AR3.
AR3 的G0/0/2查看数据是否到达:
可以看到数据包,经过AR3 将Ipsec 数据包解封装后将数据传给pc2,并且pc2也回复了数据.
思考:
pc2将数据返回后,数据到达AR2 后,数据能否通过nat session,返回AR1.
通过数据包发现数据到达AR2 后,数据就再没向下传递.没有走nat session.
解决:
查看 ipsec sa
AR3 查看ipsec sa
发现nat 穿越未开启.
修改AR1 和 AR3 配置 启用nat穿越
[r1]ike pe 1 v1
[r1-ike-peer-1]nat traversal
配置完成后,重启设备再次查看
测试:
pc1 ping pc2
查看数据包 AR2上G0/0/0 口
pc1 ping pc2 数据 AR2接口 g0/0/0 抓包。