VPN技术配置实例（gns3模拟环境）

responabilty

于 2024-03-05 15:18:10 发布

阅读量945

点赞数 9

分类专栏： gns3 文章标签：思科网络

本文链接：https://blog.csdn.net/szw737389785/article/details/136479294

版权

gns3 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

这是我以前的大作业的内容，我将其分享出来。

实验内容

物理网络拓扑图如下：
在这里插入图片描述
本实验的主要目的是在三个站点间使用DMVPN技术，建立站点到站点的IPSec VPN。
1.按照拓扑图构建网络并连接；以下拓扑模拟一个总公司和两个分公司，其中，总公司出口设备Hub-R1-zdc01，两个分公司出口设备分别为Spoke-R2-zdc01和Spoke-R3-zdc01，inside1-zdc01模拟模拟总公司内部网络，inside2-zdc01和inside3-zdc01分别模拟两个分公司内部网络；
Internet-R4 和Internet-R5为公网设备，要求在公网上运行ospf路由协议，其中，Internet-R4作为DHCP服务器，创建两个地址池，分别为24.1.1.0/24和34.1.1.0/24，分别排除24.1.1.1-24.1.1.10和34.1.1.1-34.1.1.10，Spoke-R2和Spoke-R3的公网口IP地址为自动获取；
测试公网连通性。
2. 172.16.1.0/24为mGRE隧道网络，具体IP地址与设备编号保持一致。在各出口设备上配置mGRE和NHRP，并测试NHRP注册情况。使用DMVPN技术在各站点间动态建立隧道，以实现分公司间网络畅通。其中，隧道认证密钥为01，nhrp网络号为01，nhrp认证密码为zdc01；
测试隧道连通性。
3. 在mGRE隧道网络和各站点内部网络运行动态路由协议EIGRP，调整EIGRP，使得分公司间能够建立邻居关系，并关闭“next-help-self”特性，使得分公司间能够直接学习到对方路由；
测试局域网连通性。
4. 配置 IPSec VPN保护数据流，配置中transform-set名称用zdcset，ipsec profile名称用zdcprof；
查看出口设备安全关联情况。

配置

1.按照拓扑图构建网络并连接；以下拓扑模拟一个总公司和两个分公司，其中，总公司出口设备Hub-R1-zdc01，两个分公司出口设备分别为Spoke-R2-zdc01和Spoke-R3-zdc01，inside1-zdc01模拟模拟总公司内部网络，inside2-zdc01和inside3-zdc01分别模拟两个分公司内部网络；

【拓扑里面所有设备】
Would you like to enter the initial configuration dialog? [yes/no]: no
【Hub-R1】
Router>enable
Router#configure terminal 
Router(config)#hostname Hub-R1-zdc01 
Hub-R1-zdc01(config)#interface ethernet 0/0
Hub-R1-zdc01(config-if)#ip address 15.1.1.1 255.255.255.0
Hub-R1-zdc01(config-if)#no shutdown
Hub-R1-zdc01(config-if)#exit
Hub-R1-zdc01(config)#interface ethernet 0/1
Hub-R1-zdc01(config-if)#ip address 192.168.1.1 255.255.255.0
Hub-R1-zdc01(config-if)#no shutdown
Hub-R1-zdc01(config-if)#exit

【Spoke-R2】
Router>enable
Router#configure terminal
Router(config)#hostname Spoke-R2-zdc01
Spoke-R2-zdc01(config)#interface ethernet 0/1
Spoke-R2-zdc01(config-if)#ip address 192.168.2.1 255.255.255.0
Spoke-R2-zdc01(config-if)#no shutdown
Spoke-R2-zdc01(config-if)#exit

【Spoke-R3】
Router>enable
Router#configure terminal
Router(config)#hostname Spoke-R3-zdc01
Spoke-R3-zdc01(config)#interface ethernet 0/1
Spoke-R3-zdc01(config-if)#ip address 192.168.3.1 255.255.255.0
Spoke-R3-zdc01(config-if)#no shutdown
Spoke-R3-zdc01(config-if)#exit

【inside1】
Router>enable
Router#configure terminal
Router(config)#hostname inside1-zdc01
inside1-zdc01(config)#interface ethernet 0/0
inside1-zdc01(config-if)#ip address 192.168.1.100 255.255.255.0
inside1-zdc01(config-if)#no shutdown
inside1-zdc01(config-if)#exit
inside1-zdc01(config)#interface loopback 0 
inside1-zdc01(config-if)#ip address 1.1.1.1 255.255.255.255
inside1-zdc01(config-if)#exit

【inside2】
Router>enable
Router#configure terminal
Router(config)#hostname inside2-zdc01
inside2-zdc01(config)#interface ethernet 0/0
inside2-zdc01(config-if)#ip address 192.168.2.100 255.255.255.0 
inside2-zdc01(config-if)#no shutdown
inside2-zdc01(config-if)#exit
inside2-zdc01(config)#interface loopback 0
inside2-zdc01(config-if)#ip address 2.2.2.2 255.255.255.255
inside2-zdc01(config-if)#exit

【inside3】
Router>enable
Router#configure terminal
Router(config)#hostname inside3-zdc01
inside3-zdc01(config)#interface ethernet 0/0                
inside3-zdc01(config-if)#ip address 192.168.3.100 255.255.255.0
inside3-zdc01(config-if)#no shutdown
inside3-zdc01(config-if)#exit
inside3-zdc01(config)#interface loopback 0 
inside3-zdc01(config-if)#ip address 3.3.3.3 255.255.255.255
inside3-zdc01(config-if)#exit

【Internet-R4】
Router>enable
Router#configure terminal
Router(config)#hostname Internet-R4
Internet-R4(config)#interface ethernet 0/0
Internet-R4(config-if)#ip address 45.1.1.4 255.255.255.0
Internet-R4(config-if)#no shutdown
Internet-R4(config-if)#exit
Internet-R4(config)#interface ethernet 0/1
Internet-R4(config-if)#ip address 24.1.1.4 255.255.255.0
Internet-R4(config-if)#no shutdown
Internet-R4(config-if)#exit
Internet-R4(config)#interface ethernet 0/2
Internet-R4(config-if)#ip address 34.1.1.4 255.255.255.0
Internet-R4(config-if)#no shutdown
Internet-R4(config-if)#exit

【Internet-R5】
Router>enable
Router#configure terminal
Router(config)#hostname Internet-R5
Internet-R5(config)#interface ethernet 0/0
Internet-R5(config-if)#ip address 15.1.1.5 255.255.255.0 
Internet-R5(config-if)#no shutdown
Internet-R5(config-if)#exit
Internet-R5(config)#interface ethernet 0/1
Internet-R5(config-if)#ip address 45.1.1.5 255.255.255.0
Internet-R5(config-if)#no shutdown
Internet-R5(config-if)#exit

Internet-R4 和Internet-R5为公网设备，要求在公网上运行ospf路由协议，其中，Internet-R4作为DHCP服务器，创建两个地址池，分别为24.1.1.0/24和34.1.1.0/24，分别排除24.1.1.1-24.1.1.10和34.1.1.1-34.1.1.10，Spoke-R2和Spoke-R3的公网口IP地址为自动获取；

【Internet-R4】
Internet-R4(config)#router ospf 1
Internet-R4(config-router)#network 24.1.1.0 0.0.0.255 area 0
Internet-R4(config-router)#network 34.1.1.0 0.0.0.255 area 0
Internet-R4(config-router)#network 45.1.1.0 0.0.0.255 area 0
Internet-R4(config-router)#exit
Internet-R4(config)#ip dhcp pool toR2
Internet-R4(dhcp-config)#network 24.1.1.0 255.255.255.0
Internet-R4(dhcp-config)#default-router 24.1.1.4
Internet-R4(dhcp-config)#exit
Internet-R4(config)#ip dhcp pool toR3
Internet-R4(dhcp-config)#network 34.1.1.0 255.255.255.0
Internet-R4(dhcp-config)#default-router 34.1.1.4
Internet-R4(dhcp-config)#exit
Internet-R4(config)#ip dhcp excluded-address 24.1.1.1 24.1.1.10
Internet-R4(config)#ip dhcp excluded-address 34.1.1.1 34.1.1.10
Internet-R4(config)#service dhcp

【Internet-R5】
Internet-R5(config)#router ospf 1
Internet-R5(config-router)#network 15.1.1.0 0.0.0.255 area 0
Internet-R5(config-router)#network 45.1.1.0 0.0.0.255 area 0
Internet-R5(config-router)#exit

【Hub-R1】
Hub-R1-zdc01(config)#router ospf 1
Hub-R1-zdc01(config-router)#network 15.1.1.0 0.0.0.255 area 0
Hub-R1-zdc01(config-router)#exit

【Spoke-R2】
Spoke-R2-zdc01(config)#router ospf 1
Spoke-R2-zdc01(config-router)#network 24.1.1.0 0.0.0.255 area 0 
Spoke-R2-zdc01(config-router)#exit
Spoke-R2-zdc01(config)#interface ethernet 0/0
Spoke-R2-zdc01(config-if)#ip address dhcp 
Spoke-R2-zdc01(config-if)#no shutdown
Spoke-R2-zdc01(config-if)#exit

【Spoke-R3】
Spoke-R3-zdc01(config)#router ospf 1
Spoke-R3-zdc01(config-router)#network 34.1.1.0 0.0.0.255 area 0 
Spoke-R3-zdc01(config-router)#exit
Spoke-R3-zdc01(config)#interface ethernet 0/0
Spoke-R3-zdc01(config-if)#ip address dhcp
Spoke-R3-zdc01(config-if)#no shutdown
Spoke-R3-zdc01(config-if)#exit

测试公网连通性。

Spoke-R2-zdc01#ping 15.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms

Spoke-R3-zdc01#ping 15.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/6 ms

172.16.1.0/24为mGRE隧道网络，具体IP地址与设备编号保持一致。在各出口设备上配置mGRE和NHRP，并测试NHRP注册情况。使用DMVPN技术在各站点间动态建立隧道，以实现分公司间网络畅通。其中，隧道认证密钥为01，nhrp网络号为01，nhrp认证密码为zdc01；

【Hub-R1】
Hub-R1-zdc01(config)#interface tunnel 0
Hub-R1-zdc01(config-if)#ip address 172.16.1.1 255.255.255.0
Hub-R1-zdc01(config-if)#tunnel mode gre multipoint
Hub-R1-zdc01(config-if)#tunnel source ethernet 0/0
Hub-R1-zdc01(config-if)#tunnel key 1
Hub-R1-zdc01(config-if)#ip nhrp network-id 1
Hub-R1-zdc01(config-if)#ip nhrp authentication zdc01
Hub-R1-zdc01(config-if)#ip nhrp map multicast dynamic
Hub-R1-zdc01(config-if)#exit

【Spoke-R2】
Spoke-R2-zdc01(config)#interface tunnel 0
Spoke-R2-zdc01(config-if)#ip address 172.16.1.2 255.255.255.0
Spoke-R2-zdc01(config-if)#tunnel mode gre multipoint
Spoke-R2-zdc01(config-if)#tunnel source ethernet 0/0
Spoke-R2-zdc01(config-if)#tunnel key 1
Spoke-R2-zdc01(config-if)#ip nhrp network-id 1
Spoke-R2-zdc01(config-if)#ip nhrp authentication zdc01
Spoke-R2-zdc01(config-if)#ip nhrp map 172.16.1.1 15.1.1.1
Spoke-R2-zdc01(config-if)#ip nhrp map multicast 15.1.1.1
Spoke-R2-zdc01(config-if)#ip nhrp nhs 172.16.1.1
Spoke-R2-zdc01(config-if)#exit

【Sopke-R3】
Spoke-R3-zdc01(config)#interface tunnel 0
Spoke-R3-zdc01(config-if)#ip address 172.16.1.3 255.255.255.0
Spoke-R3-zdc01(config-if)#tunnel mode gre multipoint 
Spoke-R3-zdc01(config-if)#tunnel source ethernet 0/0
Spoke-R3-zdc01(config-if)#tunnel key 1
Spoke-R3-zdc01(config-if)#ip nhrp network-id 1
Spoke-R3-zdc01(config-if)#ip nhrp authentication zdc01
Spoke-R3-zdc01(config-if)#ip nhrp map 172.16.1.1 15.1.1.1
Spoke-R3-zdc01(config-if)#ip nhrp map multicast 15.1.1.1
Spoke-R3-zdc01(config-if)#ip nhrp nhs 172.16.1.1
Spoke-R3-zdc01(config-if)#exit

测试隧道连通性。

Spoke-R2-zdc01#ping 172.16.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/5 ms
Hub-R1-zdc01#show ip nhrp
172.16.1.2/32 via 172.16.1.2
   Tunnel0 created 00:10:38, expire 01:58:48
   Type: dynamic, Flags: unique registered used nhop 
   NBMA address: 24.1.1.11 
172.16.1.3/32 via 172.16.1.3
   Tunnel0 created 00:06:27, expire 01:53:32
   Type: dynamic, Flags: unique registered used nhop 
   NBMA address: 34.1.1.11

3.在mGRE隧道网络和各站点内部网络运行动态路由协议EIGRP，调整EIGRP，使得分公司间能够建立邻居关系，并关闭“next-help-self”特性，使得分公司间能够直接学习到对方路由；

【Hub-R1】
Hub-R1-zdc01(config)#router eigrp 1
Hub-R1-zdc01(config-router)#no auto-summary
Hub-R1-zdc01(config-router)#network 192.168.1.0 0.0.0.255
Hub-R1-zdc01(config-router)#network 172.16.1.0 0.0.0.255
Hub-R1-zdc01(config-router)#exit
Hub-R1-zdc01(config)#interface tunnel 0 
Hub-R1-zdc01(config-if)#no ip next-hop-self eigrp 1
Hub-R1-zdc01(config-if)#no ip split-horizon eigrp 1
Hub-R1-zdc01(config-if)#exit

【Spoke-R2】
Spoke-R2-zdc01(config)#router eigrp 1
Spoke-R2-zdc01(config-router)#no auto-summary
Spoke-R2-zdc01(config-router)#network 192.168.2.0 0.0.0.255
Spoke-R2-zdc01(config-router)#network 172.16.1.0 0.0.0.255
Spoke-R2-zdc01(config-router)#exit

【Spoke-R3】
Spoke-R3-zdc01(config)#router eigrp 1
Spoke-R3-zdc01(config-router)#no auto-summary 
Spoke-R3-zdc01(config-router)#network 172.16.1.0 0.0.0.255
Spoke-R3-zdc01(config-router)#network 192.168.3.0 0.0.0.255
Spoke-R3-zdc01(config-router)#exit

【inside1】
inside1-zdc01(config)#router eigrp 1
inside1-zdc01(config-router)#no auto-summary
inside1-zdc01(config-router)#network 192.168.1.0 0.0.0.255
inside1-zdc01(config-router)#network 1.1.1.1 0.0.0.0
inside1-zdc01(config-router)#exit

【inside2】
inside2-zdc01(config)#router eigrp 1
inside2-zdc01(config-router)#no auto-summary
inside2-zdc01(config-router)#network 192.168.2.0 0.0.0.255
inside2-zdc01(config-router)#network 2.2.2.2 0.0.0.0
inside2-zdc01(config-router)#exit

【inside3】
inside3-zdc01(config)#router eigrp 1
inside3-zdc01(config-router)#no auto-summary
inside3-zdc01(config-router)#network 192.168.3.0 0.0.0.255
inside3-zdc01(config-router)#network 3.3.3.3 0.0.0.0
inside3-zdc01(config-router)#exit

测试局域网连通性。

inside2-zdc01#ping 3.3.3.3 source 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/5/7 ms
Spoke-R2-zdc01#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 24.1.1.4 to network 0.0.0.0

S*    0.0.0.0/0 [254/0] via 24.1.1.4
      2.0.0.0/32 is subnetted, 1 subnets
D        2.2.2.2 [90/409600] via 192.168.2.100, 00:02:29, Ethernet0/1
      3.0.0.0/32 is subnetted, 1 subnets
D        3.3.3.3 [90/28313600] via 172.16.1.3, 00:01:49, Tunnel0
      15.0.0.0/24 is subnetted, 1 subnets
O        15.1.1.0 [110/30] via 24.1.1.4, 00:08:50, Ethernet0/0
      24.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        24.1.1.0/24 is directly connected, Ethernet0/0
L        24.1.1.11/32 is directly connected, Ethernet0/0
      34.0.0.0/24 is subnetted, 1 subnets
O        34.1.1.0 [110/20] via 24.1.1.4, 00:08:50, Ethernet0/0
      45.0.0.0/24 is subnetted, 1 subnets
O        45.1.1.0 [110/20] via 24.1.1.4, 00:08:50, Ethernet0/0
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.1.0/24 is directly connected, Tunnel0
L        172.16.1.2/32 is directly connected, Tunnel0
D     192.168.1.0/24 [90/26905600] via 172.16.1.1, 00:07:57, Tunnel0
      192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.2.0/24 is directly connected, Ethernet0/1
L        192.168.2.1/32 is directly connected, Ethernet0/1
D     192.168.3.0/24 [90/28185600] via 172.16.1.3, 00:07:53, Tunnel0

配置 IPSec VPN保护数据流，配置中transform-set名称用zdcset，ipsec profile名称用zdcprof；

【Hub-R1】
Hub-R1-zdc01(config)#crypto isakmp policy 1
Hub-R1-zdc01(config-isakmp)#authentication pre-share
Hub-R1-zdc01(config-isakmp)#exit
Hub-R1-zdc01(config)#crypto isakmp key cisco address 0.0.0.0 0.0.0.0
Hub-R1-zdc01(config)#crypto ipsec transform-set zdcset esp-3des esp-sha-hmac
Hub-R1-zdc01(cfg-crypto-trans)#mode transport
Hub-R1-zdc01(cfg-crypto-trans)#exit
Hub-R1-zdc01(config)#crypto ipsec profile zdcprof
Hub-R1-zdc01(ipsec-profile)#set transform-set zdcset
Hub-R1-zdc01(ipsec-profile)#exit
Hub-R1-zdc01(config)#interface tunnel 0
Hub-R1-zdc01(config-if)#tunnel protection ipsec profile zdcprof
Hub-R1-zdc01(config-if)#exit

【Spoke-R2】
Spoke-R2-zdc01(config)#crypto isakmp policy 1
Spoke-R2-zdc01(config-isakmp)#authentication pre-share
Spoke-R2-zdc01(config-isakmp)#exit
Spoke-R2-zdc01(config)#
Spoke-R2-zdc01(config)#crypto isakmp key cisco address 0.0.0.0 0.0.0.0
Spoke-R2-zdc01(config)# crypto ipsec transform-set zdcset esp-3des esp-sha-hmac         
Spoke-R2-zdc01(cfg-crypto-trans)#mode transport
Spoke-R2-zdc01(cfg-crypto-trans)#exit
Spoke-R2-zdc01(config)#crypto ipsec profile zdcprof
Spoke-R2-zdc01(ipsec-profile)#set transform-set zdcset 
Spoke-R2-zdc01(ipsec-profile)#exit
Spoke-R2-zdc01(config)#interface tunnel 0
Spoke-R2-zdc01(config-if)#tunnel protection ipsec profile zdcprof
Spoke-R2-zdc01(config-if)#exit

【Spoke-R3】
Spoke-R3-zdc01(config)#crypto isakmp policy 1
Spoke-R3-zdc01(config-isakmp)#authentication pre-share
Spoke-R3-zdc01(config-isakmp)#exit
Spoke-R3-zdc01(config)#crypto isakmp key cisco address 0.0.0.0 0.0.0.0
Spoke-R3-zdc01(config)#crypto ipsec transform-set zdcset esp-3des esp-sha-hmac
Spoke-R3-zdc01(cfg-crypto-trans)#mode transport
Spoke-R3-zdc01(cfg-crypto-trans)#exit
Spoke-R3-zdc01(config)#crypto ipsec profile zdcprof
Spoke-R3-zdc01(ipsec-profile)#set transform-set zdcset
Spoke-R3-zdc01(ipsec-profile)#exit
Spoke-R3-zdc01(config)#interface tunnel 0 
Spoke-R3-zdc01(config-if)#tunnel protection ipsec profile zdcprof
Spoke-R3-zdc01(config-if)#exit

查看出口设备安全关联情况。

inside2-zdc01#ping 3.3.3.3 source 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/12 ms
Spoke-R2-zdc01#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
15.1.1.1        24.1.1.11       QM_IDLE           1001 ACTIVE
24.1.1.11       15.1.1.1        QM_IDLE           1002 ACTIVE
34.1.1.11       24.1.1.11       QM_IDLE           1004 ACTIVE
24.1.1.11       34.1.1.11       QM_IDLE           1003 ACTIVE

IPv6 Crypto ISAKMP SA
Spoke-R2-zdc01#show crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 24.1.1.11

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (24.1.1.11/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (34.1.1.11/255.255.255.255/47/0)
   current_peer 34.1.1.11 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
    #pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

备注：【拓扑图加载方法】

1.首先打开VM的2张网卡，确保虚拟机获取到IP地址
在这里插入图片描述

2.加载IOU镜像文件以及拓扑图
3层IOU镜像机器上已默认加载好，不需要手动加载。然后会发拓扑图的压缩包。

3.修改设备名并打开（这里就使用1号作为说明，自己学号会发生地址冲突问题）
需要使用CRT打开的请先跳转到底4步进行操作
在这里插入图片描述

*4.启动窗口使用CRT