1．1、IPsec ×××

1.1.1、实验描述

在配制ipsec ***时一般按照以下几个频骤

第一．R1发送感兴流量到R2（设定感兴流量即ACL）

第二．R1和R2协商IKE 第一阶段（phase 1）

   * 确定密钥分发方式

   * 确定验证方式

   * 对等方确定ISAKMP策略（加密算法、hash算法、IKE SA生存期）

第三．R1和R2协商IKE 第二阶段（phase 2）

第四．通过IPsec信道交互信息

第五．在无数据发送的时候自动关团信道

 

1.1.2、拓扑

 

 

如图所示，R1和R2为两个路由器，它们是通过internet连一起的，（但实验是通过串口直接连在一起），R1的loopback 0模拟R1这边的内网，R2的loopback 0模拟R2的内网，最后实现两边的loopback是通过×××实现互连的

1.1.3、基本配制

R1=========================

host R1

no ip domain-lookup

line con 0

logg sy

exec-time 0 0

!

int s1/1

ip add 200.200.100.1 255.255.255.252

no sh

int loopback 0

ip add 10.1.1.1 255.255.255.0

exit

 

R2=================================

host R2

no ip domain-lookup

line con 0

logg sy

exec-time 0 0

!

int s1/0

ip add 200.200.100.2 255.255.255.252

cl ra 56000

no sh

int loopback 0

ip add 10.2.2.1 255.255.255.0

exit

!

1.1.4、×××配制

 

R1=================================================

access-list 101 permit ip host 10.1.1.1 host 10.2.2.1

crypto isakmp policy 1

  authentication pre-share

  hash md5

exit

!

crypto isakmp key 0 cisco address 200.200.100.2 255.255.255.0

!    

crypto ipsec transform-set shanghai esp-des esp-md5-hmac

!

crypto map ***_to_shanghai 10 ipsec-isakmp

  match add 101

  set peer 200.200.100.2

  set transform shanghai

!

ip route 10.2.2.0 255.255.255.0 200.200.100.2

 

int s1/1

crypto map ***_to_shanghai

 

R2 ================================================

access-list 101 permit ip host 10.2.2.1 host 10.1.1.1

crypto isakmp policy 1

  authentication pre-share

  hash md5

  exit

!

crypto isakmp key 0 cisco address 200.200.100.1 255.255.255.0

!

crypto ipsec transform-set shanghai esp-des esp-md5-hmac

!

crypto map ***_to_shanghai 10 ipsec-isakmp

  match add 101

  set peer 200.200.100.1

  set transform shanghai

!

ip route 10.1.1.0 255.255.255.0 200.200.100.1

!

int s1/0

crypto map ***_to_shanghai

!

 

 

1.1.5、校验

在R1上扩展ping   10.2.2.1

R1#ping

Protocol [ip]:

Target IP address: 10.2.2.1

Repeat count [5]:

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface: loo 0

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:

Packet sent with a source address of 10.1.1.1

..!!!

Success rate is 60 percent (3/5), round-trip min/avg/max = 172/238/288 ms

R1#show crypto map

Crypto Map "***_to_shanghai" 10 ipsec-isakmp

        Peer = 200.200.100.2

        Extended IP access list 101

            access-list 101 permit ip host 10.1.1.1 host 10.2.2.1

        Current peer: 200.200.100.2

        Security association lifetime: 4608000 kilobytes/3600 seconds

        PFS (Y/N): N

        Transform sets={

                shanghai,

        }

        Interfaces using crypto map ***_to_shanghai:

                Serial1/1

R1#show crypto ipsec sa

 

interface: Serial1/1

    Crypto map tag: ***_to_shanghai, local addr 200.200.100.1

 

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (10.1.1.1/255.255.255.255/0/0)

   remote ident (addr/mask/prot/port): (10.2.2.1/255.255.255.255/0/0)

   current_peer 200.200.100.2 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3

    #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 2, #recv errors 0

 

     local crypto endpt.: 200.200.100.1, remote crypto endpt.: 200.200.100.2

     path mtu 1500, ip mtu 1500

     current outbound spi: 0xC57F1ABD(3313441469)

 

     inbound esp sas:

      spi: 0x9C8542B5(2625979061)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 2001, flow_id: SW:1, crypto map: ***_to_shanghai

        sa timing: remaining key lifetime (k/sec): (4416419/3493)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

 

     inbound ah sas:

 

     inbound pcp sas:

 

     outbound esp sas:

      spi: 0xC57F1ABD(3313441469)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 2002, flow_id: SW:2, crypto map: ***_to_shanghai

        sa timing: remaining key lifetime (k/sec): (4416419/3492)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

 

     outbound ah sas:

 

     outbound pcp sas:

R1#show crypto isakmp sa

dst             src             state          conn-id      slot     status

200.200.100.2   200.200.100.1   QM_IDLE              1    0      ACTIVE