思科路由器动态VTI IPSec***配置

1.拓扑图：

2.基本接口配置：

A.R1:

R1(config)#int f0/0
R1(config-if)#ip add 202.100.12.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int l0
R1(config-if)#ip add 172.16.1.1 255.255.255.0
R1(config-if)#int l1
R1(config-if)#ip add 192.168.1.1 255.255.255.0

B.R2:

R2(config)#int f0/0
R2(config-if)#ip add 202.100.12.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int f0/1
R2(config-if)#ip add 202.100.23.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int f1/0
R2(config-if)#ip add 202.100.24.2 255.255.255.0
R2(config-if)#no sh

C.R3:

R3(config)#int f0/0
R3(config-if)#ip add 202.100.23.3 255.255.255.0
R3(config-if)#no sh
R3(config-if)#int l0
R3(config-if)#ip add 172.16.1.3 255.255.255.0
R3(config-if)#int l1
R3(config-if)#ip add 192.168.3.3 255.255.255.0

D.R4:

R4(config)#int f1/0
R4(config-if)#ip add 202.100.24.4 255.255.255.0
R4(config-if)#no sh
R4(config-if)#int l0
R4(config-if)#ip add 172.16.1.4 255.255.255.0
R4(config-if)#int l1
R4(config-if)#ip add 192.168.4.4 255.255.255.0

3.静态路由配置

R1(config)#ip route 0.0.0.0 0.0.0.0 202.100.12.2

R3(config)#ip route 0.0.0.0 0.0.0.0 202.100.23.2

R4(config)#ip route 0.0.0.0 0.0.0.0 202.100.24.2

4.动态VTI配置：

A.HUB:

①第一阶段：

R1(config)#crypto isakmp policy 10
R1(config-isakmp)#au pre
R1(config-isakmp)#ha md
R1(config-isakmp)#en 3des
R1(config-isakmp)#gr 2
R1(config-isakmp)#exit

R1(config)#crypto keyring R1
R1(conf-keyring)#pre-shared-key address 202.100.23.3 key cisco
R1(conf-keyring)#pre-shared-key address 202.100.24.4 key cisco

R1(config)#crypto isakmp profile isakmppro
R1(conf-isa-prof)#keyring R1
R1(conf-isa-prof)#match identity address 202.100.23.3
R1(conf-isa-prof)#match identity address 202.100.24.4
R1(conf-isa-prof)#virtual-template 1

②第二阶段：

R1(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

③ipsec profile关联第一阶段和第二阶段策略：

R1(config)#crypto ipsec profile ipsecpro  
R1(ipsec-profile)#set isakmp-profile isakmppro
R1(ipsec-profile)#set transform-set transet

④VTI配置

R1(config)#int virtual-template 1 type tunnel
R1(config-if)#ip unnumbered loopback 0
R1(config-if)#tunnel mode ipsec ipv4
R1(config-if)#tunnel protection ipsec profile ipsecpro

B.Spoke1:

①第一阶段：

R3(config)#crypto isakmp policy 10
R3(config-isakmp)#au pr
R3(config-isakmp)#en 3des
R3(config-isakmp)#gr 2
R3(config-isakmp)#ha md
R3(config-isakmp)#exit
R3(config)#crypto isakmp key 0 cisco address 202.100.12.1

②第二阶段：

R3(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

③ipsec profile关联第二阶段策略：

R3(config)#crypto ipsec profile ipsecpro
R3(ipsec-profile)#set transform-set transet
R3(ipsec-profile)#exit

④VTI配置

R3(config)#int tunnel 0
R3(config-if)#ip unnumbered loopback 0
R3(config-if)#tunnel source f0/0
R3(config-if)#tunnel destination 202.100.1.1
R3(config-if)#tunnel mode ipsec ipv4
R3(config-if)#tunnel protection ipsec profile ipsecpro
R3(config-if)#exit

C.Spoke2:

①第一阶段：

R4(config)#crypto isakmp policy 10
R4(config-isakmp)#au pr
R4(config-isakmp)#au pre-share
R4(config-isakmp)#ha md
R4(config-isakmp)#en 3de
R4(config-isakmp)#gr 2
R4(config-isakmp)#exit
R4(config)#crypto isakmp key 0 cisco address 202.100.12.1

②第二阶段：

R4(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac
R4(cfg-crypto-trans)#exit

③ipsec profile关联第二阶段策略：

R4(config)#crypto ipsec profile ipsecpro
R4(ipsec-profile)#set transform-set transet
R4(ipsec-profile)#exit

④VTI配置

R4(config-if)#int tun 0
R4(config-if)#ip unnumbered loopback 0
R4(config-if)#tunnel source f1/0
R4(config-if)#tunnel destination 202.100.12.1
R4(config-if)#tunnel mode ipsec ipv4
R4(config-if)#tunnel protection ipsec profile ipsecpro

5.动态路由配置：

R1(config)#router eigrp 10
R1(config-router)#no auto-summary
R1(config-router)#net 172.16.1.0 0.0.0.255
R1(config-router)#net 192.168.1.0 0.0.0.255

R3(config)#router eigrp 10
R3(config-router)#no auto-summary
R3(config-router)#net 172.16.1.0 0.0.0.255
R3(config-router)#net 192.168.3.0 0.0.0.255

R4(config)#router eigrp 10
R4(config-router)#no auto-summary
R4(config-router)#net 172.16.1.0 0.0.0.255
R4(config-router)#net 192.168.4.0 0.0.0.255

6.验证：

R1#show ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            202.100.12.1    YES NVRAM  up                    up      
FastEthernet0/1            unassigned      YES NVRAM  administratively down down    
Virtual-Access1            unassigned      YES unset  down                  down    
Virtual-Template1          172.16.1.1      YES TFTP   down                  down    
Virtual-Access2            172.16.1.1      YES TFTP   up                    up      
Virtual-Access3            172.16.1.1      YES TFTP   up                    up      
Loopback0                  172.16.1.1      YES manual up                    up      
Loopback1                  192.168.1.1     YES manual up                    up  

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
202.100.12.1    202.100.23.3    QM_IDLE           1001    0 ACTIVE
202.100.12.1    202.100.24.4    QM_IDLE           1002    0 ACTIVE

R1#show crypto engine connections active
Crypto Engine Connections

  ID Interface  Type  Algorithm           Encrypt  Decrypt IP-Address
   1 Fa0/0      IPsec 3DES+SHA                  0      422 202.100.12.1
   2 Fa0/0      IPsec 3DES+SHA                426        0 202.100.12.1
   5 Fa0/0      IPsec 3DES+SHA                  0      103 202.100.12.1
   6 Fa0/0      IPsec 3DES+SHA                205        0 202.100.12.1
1001 Fa0/0      IKE   MD5+3DES                  0        0 202.100.12.1
1002 Fa0/0      IKE   MD5+3DES                  0        0 202.100.12.1

R1#ping 192.168.3.3 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.3, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 84/116/136 ms

R1#ping 192.168.4.4 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.4.4, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 88/105/128 ms

R1#show ip route eigrp
D    192.168.4.0/24 [90/297372416] via 172.16.1.4, 00:13:59, Virtual-Access3
D    192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:14:50, Virtual-Access2

R3#show ip route eigrp
D    192.168.4.0/24 [90/310172416] via 172.16.1.1, 00:13:46, Tunnel0
D    192.168.1.0/24 [90/297372416] via 172.16.1.1, 00:14:55, Tunnel0

R4#show ip route eigrp
D    192.168.1.0/24 [90/297372416] via 172.16.1.1, 00:01:14, Tunnel0
D    192.168.3.0/24 [90/310172416] via 172.16.1.1, 00:00:55, Tunnel0