DSVPN的基本配置和IPSEC的基础概念以及MGRE的基础配置

最新推荐文章于 2024-04-30 16:34:46 发布

雨季小朋友

最新推荐文章于 2024-04-30 16:34:46 发布

阅读量609

点赞数

文章标签：网络服务器智能路由器

本文链接：https://blog.csdn.net/j2941174356/article/details/132144728

版权

第一步·实现网络可达

1.在除了R2以外所有的路由去配一条缺省指向 R2 实现网络可达。

2.配置好后检验网络是否可达，避免第二步配置隧道的时候导致问题的堆积无法查找

3.网络接口的地址如图所示，x代表路由器的编号如R1 的 x 代表 1

4.其中图结构为R1为心，R3,R6 为分支第一级MGRE ；之后R3为中心，R4，R5为分支；R6为中心 R7，R8为分支的第二级MGRE。

第二步：实现以R1为中心的MGRE

1.R1的配置如下

R1
interface Tunnel0/0/0
 ip address 10.0.0.1 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 nhrp authentication cipher pt123
 nhrp redirect
 nhrp entry multicast dynamic
 nhrp network-id 100

ospf 1 router-id 1.1.1.1 
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.1.1.0 0.0.0.255

2.R3的配置如下

R3
interface Tunnel0/0/0
 ip address 10.0.0.3 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 ospf dr-priority 0
 nhrp authentication cipher pt123
 nhrp shortcut
 nhrp network-id 100
 nhrp entry 10.0.0.1 100.1.21.1 register

ospf 1 router-id 1.1.1.1
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.1.1.0 0.0.0.255

3.R6的配置如下

R6
interface Tunnel0/0/0
 ip address 10.0.0.6 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 ospf dr-priority 0
 nhrp authentication cipher pt123
 nhrp shortcut
 nhrp network-id 100
 nhrp entry 10.0.0.1 100.1.21.1 register

ospf 1 router-id 6.6.6.6 
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.6.6.0 0.0.0.255

第三步：配置R3，R6为中心的第二级 MGRE

R3，R6的配置如下：添加配置

interface Tunnel0/0/0
  nhrp redirect
  nhrp entry multicast dynamic

R4的配置如下：

interface Tunnel0/0/0
 ip address 10.0.0.4 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 nhrp authentication cipher pt123
 nhrp shortcut
 nhrp network-id 100
 nhrp entry 10.0.0.3 100.1.23.1 register

ospf 1 router-id 4.4.4.4
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.4.4.0 0.0.0.255

R5的配置如下：

interface Tunnel0/0/0
 ip address 10.0.0.5 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 nhrp shortcut
 nhrp authentication cipher pt123
 nhrp network-id 100
 nhrp entry 10.0.0.3 100.1.23.1 register

ospf 1 router-id 5.5.5.5
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.5.5.0 0.0.0.255

R7的配置如下：

interface Tunnel0/0/0
 ip address 10.0.0.7 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 nhrp shortcut
 nhrp authentication cipher pt123
 nhrp network-id 100
 nhrp entry 10.0.0.6 100.1.26.1 register

ospf 1 router-id 7.7.7.7 
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.7.7.0 0.0.0.255

R8的配置如下：

interface Tunnel0/0/0
 ip address 10.0.0.8 255.255.255.0 
 tunnel-protocol gre p2mp
 source GigabitEthernet0/0/0
 gre key 1
 ospf network-type p2mp
 nhrp shortcut
 nhrp authentication cipher pt123
 nhrp network-id 100
 nhrp entry 10.0.0.6 100.1.26.1 register

ospf 1 router-id 8.8.8.8 
 area 0.0.0.0 
  network 10.0.0.0 0.255.255.255 
  network 10.8.8.0 0.0.0.255

第四步配置 IPSec

.1,每个路由器的配置相同（每一段命令需要早视图模式下（sysname下））

ike proposal 1
 encryption-algorithm aes-cbc-128
 dh group5
 authentication-algorithm md5

ike peer dsvpn v1
 exchange-mode aggressive
 pre-shared-key cipher key123
 ike-proposal 1
 remote-name dsvpn

ike local-name dsvpn          本地名字

ipsec proposal dsvpn
 encapsulation-mode transport
 transform ah-esp
 ah authentication-algorithm sha1
 esp encryption-algorithm aes-128
 esp authentication-algorithm md5   (默认)

ipsec profile dsvpn
 ike-peer dsvpn
 proposal dsvpn

interface Tunnel0/0/0
 ipsec profile dsvpn

2.加密结果