Efficient VPN Network-plus方式建立IPSec隧道配置

 

R1为公司分支网关，R2为公司总部网关，分公司与总部通过公网建立通信，并且总部与分公司 的网络已统一规划。分公司子网为：10.1.1.0/24，总部子网为：10.1.2.0/24.现希望对分公司子网与总部子网之间相互访问的流量进行安全保护，并让分公司网关配置能够尽量简单，由总部网关对分公司网关进行集中管理，管理和维护方式采用Ping、Telnet命令。

思路分析

根据分公司子网与总部子网的IP地址经过统一规划，不存在重叠ip情况，由于公司希望总部对分公司能进行集中管理，可以在分公司与总部之间采用Efficient VPN Network-plus模式建立IPSec 隧道来实现保护，更便于维护。

配置步骤

一、在R1与R2上配置各接口的IP地址，以及到达到对端公网、子网的静态路由。

【R1】

[Huawei]sysname R1

[R1-GigabitEthernet0/0/1]ip address 70.1.1.1 24

[R1-GigabitEthernet0/0/2]ip address 10.1.1.1 24

[R1]ip route-static 70.1.2.0 24 70.1.1.2 //配置到达公网的静态路由
[R1]ip route-static 10.1.2.0 24 70.1.1.2

【R2】

[Huawei]sysname R2

[R2-GigabitEthernet0/0/1]ip address 70.1.2.1 24

[R2-GigabitEthernet0/0/2]ip address 10.1.2.1 24

[R2-LoopBack0]ip address 100.1.1.1 24

[R2]ip route-static 70.1.1.0 24 70.1.2.2 //配置到达公网的静态路由
[R2]ip route-static 10.1.1.0 24 70.1.2.2

【Internet】

[Huawei]sysname Internet  //模拟公网的路由器配置

[Internet-GigabitEthernet0/0/1]ip address 70.1.1.2 24

[Internet-GigabitEthernet0/0/2]ip address 70.1.2.2 24

二、在R2上配置IP地址池，推送的资源属性、（DNS/WINS）用于动态分配给建立的IPSec隧道,配置IPSec、IKE安全提议、IKE对等体，基于策略模板的安全策略。并用应用公网接口上。

【R2】

[R2]ip pool po1 //配置IP地址池动态分配给IPSec隧道

[R2-ip-pool-po1]network 100.1.1.0 mask 24

[R2-ip-pool-po1]gateway-list 100.1.1.1

[R2]aaa

[R2-aaa]service-scheme sch1 //配置推送资源属性给IPSec隧道

[R2-aaa-service-sch1]ip-pool po1

[R2-aaa-service-sch1]dns-name huawei.com  //配置DNS域名

[R2-aaa-service-sch1]dns 2.2.2.2    //配置DNS

[R2-aaa-service-sch1]dns 2.2.2.3 secondary  //配置备用DNS

[R2-aaa-service-sch1]wins 3.3.3.2 / /配置WINS

[R2-aaa-service-sch1]wins 3.3.3.3 secondary //配置备用WINS

[R2]ike proposal 5 //配置IKE安全提议

[R2-ike-proposal-5]dh group2 //配置应用组 策略要求只在group2上

[R2-ike-proposal-5]encryption-algorithm 3des-cbc //配置加密算法

[R2]ike peer rut3 v1 //配置IKE对等体采用V1版本

[R2-ike-peer-rut3]exchange-mode aggressive   //IKEV1版本中必须为野蛮模式

[R2-ike-peer-rut3]pre-shared-key simple huawei

[R2-ike-peer-rut3]ike-proposal 5 //引用安全提议

[R2-ike-peer-rut3]service-scheme sch1 //引用aaa中资源推送。

[R2]ipsec proposal tra1 //配置IPSec安全提议 采用缺省值

[R2-ipsec-proposal-tra1]q

[R2]ipsec policy-template use1 10 //配置策略模板

[R2-ipsec-policy-templet-use1-10]ike-peer rut3  //引用对等体

[R2-ipsec-policy-templet-use1-10]proposal tra1 //引用安全提议

[R2]ipsec policy policy1 10 isakmp template use1 //在策略模板基础上配置安全策略

[R2-GigabitEthernet0/0/1]ipsec policy policy1  //应用安全策略

三、在R1上采用Network-plus模式配置Efficient VPN策略与R2建立IPSec隧道，并在策略中向总部推送需要IPSec保护的数据流，并将策略应用到公网接口上。

【R1】

[R1]acl number 3001  //定义需保护的数据流

[R1-acl-adv-3001]rule 1 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0  0.0.0.255

[R1]ipsec efficient-vpn evpn mode network-plus  //配置efficient vpn的模式为 network-plus 

[R1-ipsec-efficient-vpn-evpn]security acl 3001 //引用ACL

[R1-ipsec-efficient-vpn-evpn]remote-address 70.1.2.1 v1 //指定对端公网IP

[R1-ipsec-efficient-vpn-evpn]pre-shared-key simple huawei

[R1-GigabitEthernet0/0/1]ipsec efficient-vpn evpn //应用efficient vpn

四、验证测试

<R1>dis ike sa

  Conn-ID  Peer            VPN   Flag(s)                Phase  
  ---------------------------------------------------------------
       37    70.1.2.1        0     RD|ST                  2     
       36    70.1.2.1        0     RD|ST                  1        

  Flag Description:
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP

<R1>display ipsec sa

===============================
Interface: GigabitEthernet0/0/1
 Path MTU: 1500
===============================

  -----------------------------
  IPSec efficient-vpn name: "evpn"
  Mode                    : EFFICIENTVPN-NETWORKPLUS MODE
  -----------------------------
    Connection ID     : 37
    Encapsulation mode: Tunnel
    Tunnel local      : 70.1.1.1
    Tunnel remote     : 70.1.2.1
    Qos pre-classify  : Disable

    [Outbound ESP SAs]
      SPI: 1345866727 (0x50384be7)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887436800/3541
      Max sent sequence-number: 0
      UDP encapsulation used for NAT traversal: N

    [Inbound ESP SAs]
      SPI: 2757755882 (0xa46003ea)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887436800/3541
      Max received sequence-number: 0
      Anti-replay window size: 32
      UDP encapsulation used for NAT traversal: N

  -----------------------------
  IPSec efficient-vpn name: "evpn"
  Mode                    : EFFICIENTVPN-NETWORKPLUS MODE
  -----------------------------
    Connection ID     : 38
    Encapsulation mode: Tunnel
    Tunnel local      : 70.1.1.1
    Tunnel remote     : 70.1.2.1
    Qos pre-classify  : Disable

    [Outbound ESP SAs]
      SPI: 1201968941 (0x47a4972d)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887436800/3541
      Max sent sequence-number: 0
      UDP encapsulation used for NAT traversal: N

    [Inbound ESP SAs]
      SPI: 1006124986 (0x3bf83fba)
      Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
      SA remaining key duration (bytes/sec): 1887436800/3541
      Max received sequence-number: 0
      Anti-replay window size: 32
      UDP encapsulation used for NAT traversal: N

<R1>display ipsec efficient-vpn
===========================================
IPSec efficient-vpn name: evpn
Using interface         : GigabitEthernet0/0/1
===========================================
 IPSec Efficient-vpn Name  : evpn
 IPSec Efficient-vpn Mode  : 3 (1:Client 2:Network 3:Network-plus)
 ACL Number                : 3001
 Auth Method               : 8 (8:PSK 9:RSA)
 VPN name                  :
 Local ID Type             : 1 (1:IP 2:Name)
 IKE Version               : 1 (1:IKEv1 2:IKEv2)
 Remote Address            : 70.1.2.1  (selected)
 Pre Shared Key            : huawei
 PFS Type                  : 0 (0:Disable 1:Group1 2:Group2 5:Group5 14:Group14)
 Local Address             :
 Remote Name               :
 PKI Object                :
 Anti-replay window size   : 32
 Qos pre-classify          : 0 (0:Disable 1:Enable)
 Interface loopback        : LoopBack100
 Interface loopback IP     : 100.1.1.254/24
 Dns server IP             : 2.2.2.2, 2.2.2.3
 Wins server IP            : 3.3.3.2, 3.3.3.3
 Dns default domain name   : huawei.com
 Auto-update url           :
 Auto-update version       :

查看结果IKE sa 、IPSec sa 、ipsec efficient-vpn都已完成建立。

PC1(10.1.1.2)与PC2（10.1.2.2）也能相互Ping 通。

PC1>ping 10.1.2.2

Ping 10.1.2.2: 32 data bytes, Press Ctrl_C to break
From 10.1.2.2: bytes=32 seq=1 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=2 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=3 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=4 ttl=127 time=16 ms
From 10.1.2.2: bytes=32 seq=5 ttl=127 time=31 ms

--- 10.1.2.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 16/28/31 ms

PC2>ping 10.1.1.2

Ping 10.1.1.2: 32 data bytes, Press Ctrl_C to break
From 10.1.1.2: bytes=32 seq=1 ttl=127 time=31 ms
From 10.1.1.2: bytes=32 seq=2 ttl=127 time=32 ms
From 10.1.1.2: bytes=32 seq=3 ttl=127 time=15 ms
From 10.1.1.2: bytes=32 seq=4 ttl=127 time=31 ms
From 10.1.1.2: bytes=32 seq=5 ttl=127 time=32 ms

--- 10.1.1.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/28/32 ms