vyos VPN配置

配置R1和R5之间的VPN。
一、R1和R5网络层连通
这里是通过BGP把地址发布出去
R1
set protocols bgp 200 network 1.1.1.1/32 
set protocols bgp 200 network 1.1.12.0/24
commit
save

R5
set protocols bgp 300 network 5.5.5.5/32 
set protocols bgp 300 network 1.1.35.0/24
commit
save

R1上ping测试，确认联通性
ping 5.5.5.5 interface 1.1.1.1

二、配置IPSEC VPN
R1
配置ESP组
set vpn ipsec esp-group ipsec_test mode tunnel
set vpn ipsec esp-group ipsec_test pfs enable
set vpn ipsec esp-group ipsec_test  proposal 1 encryption aes256 
set vpn ipsec esp-group ipsec_test proposal 1 hash sha1
配置 ike 组
set vpn ipsec ike-group ipsec_test key-exchange ikev1
set vpn ipsec ike-group ipsec_test proposal 1 encryption 'aes256'
set vpn ipsec ike-group ipsec_test proposal 1 hash sha1
配置 ipsec 接口
set vpn ipsec ipsec-interfaces interface eth0
配置 ipsec 远端信息
set vpn ipsec site-to-site peer 1.1.35.5 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 1.1.35.5 authentication pre-shared-secret qhqh310
set vpn ipsec site-to-site peer 1.1.35.5 ike-group ipsec_test 
set vpn ipsec site-to-site peer 1.1.35.5 local-address '1.1.12.1'
set vpn ipsec site-to-site peer 1.1.35.5 tunnel 0 esp-group ipsec_test
set vpn ipsec site-to-site peer 1.1.35.5 tunnel 0 local prefix '10.0.1.0/24'
set vpn ipsec site-to-site peer 1.1.35.5 tunnel 0 remote prefix '10.0.2.0/24'

R5
配置ESP组
set vpn ipsec esp-group ipsec_test mode tunnel
set vpn ipsec esp-group ipsec_test pfs enable
set vpn ipsec esp-group ipsec_test  proposal 1 encryption aes256 
set vpn ipsec esp-group ipsec_test proposal 1 hash sha1
配置 ike 组
set vpn ipsec ike-group ipsec_test key-exchange ikev1
set vpn ipsec ike-group ipsec_test proposal 1 encryption 'aes256'
set vpn ipsec ike-group ipsec_test proposal 1 hash sha1
配置 ipsec 接口
set vpn ipsec ipsec-interfaces interface eth1
配置 ipsec 远端信息
set vpn ipsec site-to-site peer 1.1.12.1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 1.1.12.1 authentication pre-shared-secret qhqh310
set vpn ipsec site-to-site peer 1.1.12.1 ike-group ipsec_test 
set vpn ipsec site-to-site peer 1.1.12.1 local-address '1.1.35.5'
set vpn ipsec site-to-site peer 1.1.12.1 tunnel 0 esp-group ipsec_test
set vpn ipsec site-to-site peer 1.1.12.1 tunnel 0 local prefix '10.0.2.0/24'
set vpn ipsec site-to-site peer 1.1.12.1 tunnel 0 remote prefix '10.0.1.0/24'

R1的NAT配置去除目的地址
set nat source rule 99 outbound-interface eth0
set nat source rule 99 destination address 10.0.2.0/24
set nat source rule 99 exclude

GRE
R1
set interfaces tunnel tun0 address 192.168.1.1/30
set interfaces tunnel tun0 local-ip 1.1.12.1 
set interfaces tunnel tun0 remote-ip 1.1.35.5
set interfaces tunnel tun0 encapsulation gre
set protocols static route 10.0.2.0/24 next-hop 192.168.1.2 
R5
set interfaces tunnel tun0 address 192.168.1.2/30
set interfaces tunnel tun0 local-ip 1.1.35.5
set interfaces tunnel tun0 remote-ip 1.1.12.1
set interfaces tunnel tun0 encapsulation gre
set protocols static route 10.0.1.0/24 next-hop 192.168.1.1

VXLAN
R1
set interfaces vxlan vxlan101 remote 1.1.35.5
set interfaces vxlan vxlan101 link eth0
set interfaces vxlan vxlan101 vni 101
set interfaces bridge br1
set interface ethernet eth1 bridge-group bridge br1
set interfaces vxlan vxlan101 bridge-group bridge br1

R5
set interfaces vxlan vxlan101 remote 1.1.12.1
set interfaces vxlan vxlan101 link eth1
set interfaces vxlan vxlan101 vni 101
set interfaces bridge br1
set interface ethernet eth2 bridge-group bridge br1
set interfaces vxlan vxlan101 bridge-group bridge br1