作业十七:IPSec的防火墙配置
文章目录
实验环境
实验思路
- 规划并配置IP
- 划分区域
- OSPF配置
- VPN配置
- 安全策略配置
- 检查连通性
- 加入公网设备PC3后实验环境
- IP配置
- NAT配置
- 安全策略配置
- 检查连通性
- NAT配置
- 检查连通性
实验步骤
规划并配置IP
PC1:
PC2:
FW1:
[FW1]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 192.168.1.254 24
[FW1-GigabitEthernet1/0/1]int g1/0/2
[FW1-GigabitEthernet1/0/2]ip add 200.10.1.1 24
R2:
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 200.10.1.2 24
[R2-GigabitEthernet0/0/0]int g0/0/1
[R2-GigabitEthernet0/0/1]ip add 200.10.2.2 24
FW3:
[FW3]int g1/0/1
[FW3-GigabitEthernet1/0/1]ip add 200.10.2.3 24
[FW3-GigabitEthernet1/0/1]int g1/0/0
[FW3-GigabitEthernet1/0/0]ip add 172.16.1.254 24
划分区域
FW1:
[FW1]firewall zone trust
[FW1-zone-trust]add int g1/0/1
[FW1-zone-trust]firewall zone untrust
[FW1-zone-untrust]add int g1/0/2
FW3:
[FW3]firewall zone trust
[FW3-zone-trust]add int g1/0/0
[FW3-zone-trust]firewall zone untrust
[FW3-zone-untrust]add int g1/0/1
OSPF配置
FW1:
[FW1]ospf
[FW1-ospf-1]area 0
[FW1-ospf-1-area-0.0.0.0]int g1/0/2
[FW1-GigabitEthernet1/0/2]os e a 0
R2:
[R2]ospf
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]int g0/0/0
[R2-GigabitEthernet0/0/0]os e a 0
[R2-GigabitEthernet0/0/0]int g0/0/1
[R2-GigabitEthernet0/0/1]os e a 0
FW3:
[FW3]ospf
[FW3-ospf-1]area 0
[FW3-ospf-1-area-0.0.0.0]int g1/0/1
[FW3-GigabitEthernet1/0/1]os e a 0
VPN配置
FW1:
//感兴趣流
[FW1]acl 3000
[FW1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination 172.16
.1.0 0.0.0.255
//ike安全提议
[FW1]ike proposal 1
[FW1-ike-proposal-1]di th //验证与加密算法使用默认配置如下
2021-03-31 08:23:53.010
#
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
//ike对等体
[FW1]ike peer fw3
[FW1-ike-peer-fw3]pre-shared-key cipher huawei
[FW1-ike-peer-fw3]ike-proposal 1
[FW1-ike-peer-fw3]remote-address 200.10.2.3
//ipsec安全提议
[FW1]ipsec proposal 2
[FW1-ipsec-proposal-2]di th //验证与加密算法使用默认配置如下
2021-03-31 08:30:25.450
#
ipsec proposal 2
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
//ipsec策略
[FW1]ipsec policy runtime 10 isakmp
[FW1-ipsec-policy-isakmp-runtime-10]security acl 3000
[FW1-ipsec-policy-isakmp-runtime-10]ike-peer fw3
[FW1-ipsec-policy-isakmp-runtime-10]proposal 2
//绑定接口
[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]ipsec policy runtime
//静态配置
[FW1]ip route-static 172.16.1.0 24 200.10.1.2
FW3:
//感兴趣流
[FW1]acl 3000
[FW1-acl-adv-3000]rule permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
//ike安全提议
[FW3]ike proposal 1
[FW3-ike-proposal-1]di th //验证与加密算法使用默认配置如下
2021-03-31 08:37:43.780
#
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
//ike对等体
[FW3]ike peer fw1
[FW3-ike-peer-fw1]pre-shared-key cipher huawei
[FW3-ike-peer-fw1]ike-proposal 1
[FW3-ike-peer-fw1]remote-address 200.10.1.1
//ipsec安全提议
[FW3]ipsec proposal 2
[FW3-ipsec-proposal-2]di th //验证与加密算法使用默认配置如下
2021-03-31 08:44:56.380
#
ipsec proposal 2
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
//ipsec策略
[FW3]ipsec policy aaa 10 isakmp
[FW3-ipsec-policy-isakmp-runtime-10]security acl 3000
[FW3-ipsec-policy-isakmp-runtime-10]ike-peer fw1
[FW3-ipsec-policy-isakmp-runtime-10]proposal 2
//绑定接口
[FW3]int g1/0/1
[FW3-GigabitEthernet1/0/1]ipsec policy aaa
//静态配置
[FW3]ip route-static 192.168.1.0 24 200.10.2.2
安全策略配置
FW1:
[FW1]security-policy
[FW1-policy-security]rule name t_u
[FW1-policy-security-rule-t_u]source-zone trust
[FW1-policy-security-rule-t_u]destination-zone untrust
[FW1-policy-security-rule-t_u]source-address 192.168.1.0 24
[FW1-policy-security-rule-t_u]destination-address 172.16.1.0 24
[FW1-policy-security-rule-t_u]service icmp
[FW1-policy-security-rule-t_u]action permit
[FW1-policy-security-rule-t_u]q
[FW1-policy-security]rule name u_l
[FW1-policy-security-rule-u_l]source-zone untrust
[FW1-policy-security-rule-u_l]destination-zone local
[FW1-policy-security-rule-u_l]source-address 200.10.2.3 32
[FW1-policy-security-rule-u_l]destination-address 200.10.1.1 32
[FW1-policy-security-rule-u_l]service esp
[FW1-policy-security-rule-u_l]action permit
[FW1-policy-security-rule-u_l]q
[FW1-policy-security]q
[FW1]ip service-set isakmp type object 16
[FW1-object-service-set-isakmp]service protocol udp source-port 500
[FW1-object-service-set-isakmp]q
[FW1]security-policy
[FW1-policy-security]rule name isakmp
[FW1-policy-security-rule-isakmp]source-zone local
[FW1-policy-security-rule-isakmp]source-zone untrust
[FW1-policy-security-rule-isakmp]destination-zone local
[FW1-policy-security-rule-isakmp]destination-zone untrust
[FW1-policy-security-rule-isakmp]source-address 200.10.2.3 32
[FW1-policy-security-rule-isakmp]source-address 200.10.1.1 32
[FW1-policy-security-rule-isakmp]destination-address 200.10.1.1 32
[FW1-policy-security-rule-isakmp]destination-address 200.10.2.3 32
[FW1-policy-security-rule-isakmp]service isakmp
[FW1-policy-security-rule-isakmp]action permit
FW3:
[FW3]security-policy
[FW3-policy-security]rule name t_u
[FW3-policy-security-rule-t_u]source-zone trust
[FW3-policy-security-rule-t_u]source-zone untrust
[FW3-policy-security-rule-t_u]destination-zone trust
[FW3-policy-security-rule-t_u]destination-zone untrust
[FW3-policy-security-rule-t_u]source-address 192.168.1.0 24
[FW3-policy-security-rule-t_u]source-address 172.16.1.0 24
[FW3-policy-security-rule-t_u]destination-address 172.16.1.0 24
[FW3-policy-security-rule-t_u]destination-address 192.168.1.0 24
[FW3-policy-security-rule-t_u]service icmp
[FW3-policy-security-rule-t_u]action permit
[FW3-policy-security-rule-t_u]q
[FW3-policy-security]rule name u_l
[FW3-policy-security-rule-u_l]source-zone untrust
[FW3-policy-security-rule-u_l]destination-zone local
[FW3-policy-security-rule-u_l]source-address 200.10.1.1 32
[FW3-policy-security-rule-u_l]destination-address 200.10.2.3 32
[FW3-policy-security-rule-u_l]service esp
[FW3-policy-security-rule-u_l]action permit
[FW3-policy-security-rule-u_l]q
[FW3-policy-security]q
[FW3]ip service-set isakmp type object 16
[FW3-object-service-set-isakmp]service protocol udp source-port 500
[FW3-object-service-set-isakmp]q
[FW3-policy-security]rule name isakmp
[FW3-policy-security-rule-isakmp]source-zone local
[FW3-policy-security-rule-isakmp]source-zone untrust
[FW3-policy-security-rule-isakmp]destination-zone local
[FW3-policy-security-rule-isakmp]destination-zone untrust
[FW3-policy-security-rule-isakmp]source-address 200.10.2.3 32
[FW3-policy-security-rule-isakmp]source-address 200.10.1.1 32
[FW3-policy-security-rule-isakmp]destination-address 200.10.1.1 32
[FW3-policy-security-rule-isakmp]destination-address 200.10.2.3 32
[FW3-policy-security-rule-isakmp]service isakmp
[FW3-policy-security-rule-isakmp]action permit
检查连通性
PC1 ping PC2:
PC>ping 172.16.1.1
Ping 172.16.1.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 172.16.1.1: bytes=32 seq=2 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=3 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=4 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=5 ttl=126 time=15 ms
--- 172.16.1.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/15/15 ms
对R2的g0/0/0抓包:
加入公网设备PC3后实验环境
IP配置
PC3:
R2:
[R2]int g0/0/2
[R2-GigabitEthernet0/0/2]ip add 200.10.3.254 24
NAT配置
FW1:
//配置地址池
[FW1]nat address-group 1
[FW1-address-group-1]section 200.10.1.10 200.10.1.10
//配置NAT策略
[FW1]nat-policy
[FW1-policy-nat-rule-no_nat]q
[FW1-policy-nat]rule name t_u
[FW1-policy-nat-rule-t_u]source-zone trust
[FW1-policy-nat-rule-t_u]destination-zone untrust
[FW1-policy-nat-rule-t_u]source-address 192.168.1.0 24
[FW1-policy-nat-rule-t_u]action source-nat address-group 1
配置安全策略
FW1:
//配置安全策略
[FW1]security-policy
[FW1-policy-security]rule name nat
[FW1-policy-security-rule-nat]source-zone trust
[FW1-policy-security-rule-nat]destination-zone untrust
[FW1-policy-security-rule-nat]source-address 192.168.1.0 24
[FW1-policy-security-rule-nat]service icmp
[FW1-policy-security-rule-nat]action permit
//配置静态路由
[FW1]ip route-static 0.0.0.0 0 200.10.1.2
检查连通性
PC1 ping PC3
PC>ping 200.10.3.3
Ping 200.10.3.3: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 200.10.3.3: bytes=32 seq=2 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=3 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=4 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=5 ttl=126 time<1 ms
--- 200.10.3.3 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/12/16 ms
对R2的g0/0/0抓包
此时用PC1 ping PC2无法成功,因为NAT协议将封装后的包源地址改变为公网地址,路由表无法转发,因此需要禁止对源目地址为192.168.1.1和172.16.1.1的包实行NAT策略。
配置NAT
FW1:
[FW1]nat-policy
[FW1-policy-nat]rule name no_nat
[FW1-policy-nat-rule-no_nat]source-zone trust
[FW1-policy-nat-rule-no_nat]destination-zone untrust
[FW1-policy-nat-rule-no_nat]source-address 192.168.1.0 24
[FW1-policy-nat-rule-no_nat]destination-address 172.16.1.0 24
[FW1-policy-nat-rule-no_nat]action no-nat
//将no_nat移到t_u之前
[FW1-policy-nat]rule move no_nat before t_u
检查连通性
PC1 ping PC2
PC>ping 172.16.1.1
Ping 172.16.1.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 172.16.1.1: bytes=32 seq=2 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=3 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=4 ttl=126 time=15 ms
From 172.16.1.1: bytes=32 seq=5 ttl=126 time=15 ms
--- 172.16.1.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/15/15 ms
PC1 ping PC3
PC>ping 200.10.3.3
Ping 200.10.3.3: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 200.10.3.3: bytes=32 seq=2 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=3 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=4 ttl=126 time=16 ms
From 200.10.3.3: bytes=32 seq=5 ttl=126 time=31 ms
--- 200.10.3.3 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/19/31 ms
实验总结
本次实验学习了IPSec的防火墙配置方法。相较于路由器而言,防火墙则需要多出的步骤就是划分区域和配置安全策略。配置安全策略需要多配置一个isakmp策略用于让封装VPN的包来回传递。若要让私网的主机访问公网的主机需要进行地地址转换,配置NAT,注意策略的顺序,策略匹配从前往后,先匹配的要放在前面。