一、理论基础
　 IPSec ××× 即指采用 IPSec 协议来实现远程接入的一种 ××× 技术 ,IPSec 是 IETF(Internet Engineer Task Force) 正在完善的安全标准， IPSec 协议是一个范围广泛、开放的虚拟专用网安全协议 , 它提供所有在网络层上的数据保护，提供透明的安全通信。 IPSec 是基于网络层的，不能穿越通常的 NAT 、防火墙。 <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

首先先具体介绍一下 IPsec 协议：

　　 IP_SECURITY 协议 (IPSec) ，通过相应的隧道技术，可实现 ××× 。 IPSec 有两种模式：隧道模式和传输模式。 IPSec 协议不是一个单独的协议，它给出了应用于 IP 层上网络数据安全的一整套体系结构，包括网络认证协议 Authentication Header （ AH ）、封装安全载荷协议 Encapsulating Security Payload （ ESP ）、密钥管理协议 Internet Key Exchange （ IKE ）和用于网络认证及加密的一些算法等。 IPSec 规定了如何在对等层之间选择安全协议、确定安全算法和密钥交换，向上提供了访问控制、数据源认证、数据加密等网络安全服务。
　　 IPSec 的安全特性主要有：

　　不可否认性： " 不可否认性 " 可以证实消息发送方是唯一可能的发送者，发送者不能否认发送过消息。 " 不可否认性 " 是采用公钥技术的一个特征，当使用公钥技术时，发送方用私钥产生一个数字签名随消息一起发送，接收方用发送者的公钥来验证数字签名。由于在理论上只有发送者才唯一拥有私钥，也只有发送者才可能产生该数字签名，所以只要数字签名通过验证，发送者就不能否认曾发送过该消息。但 " 不可否认性 " 不是基于认证的共享密钥技术的特征，因为在基于认证的共享密钥技术中，发送方和接收方掌握相同的密钥。

　　反重播性： " 反重播 " 确保每个 IP 包的唯一性，保证信息万一被截取复制后，不能再被重新利用、重新传输回目的地址。该特性可以防止***者截取破译信息后，再用相同的信息包冒取非法访问权（即使这种冒取行为发生在数月之后）。

　　数据完整性：防止传输过程中数据被篡改，确保发出数据和接收数据的一致性。 IPSec 利用 Hash 函数为每个数据包产生一个加密检查和，接收方在打开包前先计算检查和，若包遭篡改导致检查和不相符，数据包即被丢弃。

　　数据可靠性（加密）：在传输前，对数据进行加密，可以保证在传输过程中，即使数据包遭截取，信息也无法被读。该特性在 IPSec 中为可选项，与 IPSec 策略的具体设置相关。 　　

　　认证：数据源发送信任状，由接收方验证信任状的合法性，只有通过认证的系统才可以建立通信连接。

二、网络实例图

<?xml:namespace prefix = v ns = "urn:schemas-microsoft-com:vml" />

三、路由器配置

router1:
r1#show run
Building configuration...

 

Current configuration : 725 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
!
!
interface FastEthernet0/0
 ip address <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />10.10.11.1 255.255.255.0
 duplex full
!
interface POS1/0
 ip address 10.10.10.1 255.255.255.0
 encapsulation ppp
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
interface FastEthernet3/0
 no ip address
 shutdown
 duplex half
!
ip classless
no ip http server
no ip http secure-server
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

r1#

 

 

router2:
r2#show run
Building configuration...

 

*Sep  3 14:10:46.631: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 1359 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
!
!

 

r2# show run
Building configuration...

 

Current configuration : 1359 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
!
!
crypto isakmp policy 10
 authentication pre-share
crypto isakmp key abc2001 address 10.10.10.2
!

!

crypto ipsec transform-set abc-des esp-des esp-sha-hmac

!
crypto map abc local-address FastEthernet0/0
crypto map abc 20 ipsec-isakmp
 set peer 10.10.10.2
 set transform-set abc-des
 match address 105
!
!
!
!
interface FastEthernet0/0
 ip address 10.10.11.2 255.255.255.0
 ip nat outside
 duplex full
 crypto map abc
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex half
!
interface FastEthernet2/0
 ip address 10.10.12.1 255.255.255.0
 ip nat inside
 duplex full
!
interface POS3/0
 no ip address
 shutdown
!
ip nat inside source route-map abc interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.11.1
no ip http server
no ip http secure-server
!
!
access-list 105 permit ip host 4.4.4.4 host 5.5.5.5
access-list 150 deny   ip host 4.4.4.4 host 5.5.5.5
access-list 150 permit ip host 4.4.4.4 any
!
route-map abc permit 10
 match ip address 150
!
router3:
r3#show run
Building configuration...

 

Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r3
!
 boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
                          !
!
!
crypto isakmp policy 10
 authentication pre-share
crypto isakmp key abc2001 address 10.10.11.2
!

!

crypto ipsec transform-set abc-des esp-des esp-sha-hmac

 mode transport

!

crypto map abc local-address POS3/0

crypto map abc 20 ipsec-isakmp

  set peer 10.10.11.2
 set transform-set abc-des
 match address 105
!
!
!
!
interface FastEthernet0/0
 ip address 10.10.9.1 255.255.255.0
 ip nat inside
 duplex full
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex half
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
interface POS3/0
 ip address 10.10.10.2 255.255.255.0
 ip nat outside
 encapsulation ppp
 crypto map abc
!
ip nat inside source route-map abc interface POS3/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.1
ip route 5.5.5.5 255.255.255.255 10.10.9.2
no ip http server
no ip http secure-server
!
!
access-list 105 permit ip host 5.5.5.5 host 4.4.4.4
access-list 150 deny   ip host 5.5.5.5 host 4.4.4.4
access-list 150 permit ip any any
!
route-map abc permit 10
 match ip address 150
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

r3#

 

router4:

 

r4#show run
Building configuration...

 

Current configuration : 788 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
!
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.10.12.2 255.255.255.0
 duplex full
!
interface POS1/0
 no ip address
 shutdown
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
interface FastEthernet3/0
 no ip address
 shutdown
 duplex half
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.12.1
no ip http server
no ip http secure-server
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

r4#

 

router5:
r5#show run
Building configuration...

 

Current configuration : 786 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r5
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
ip audit po max-events 100
!
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.10.9.2 255.255.255.0
 duplex full
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex half
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
interface POS3/0
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.9.1
no ip http server
no ip http secure-server
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

四、业务测试

r5#ping
Protocol [ip]:
Target IP address: 4.4.4.4
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 5.5.5.5
Type of service [0]:
Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 504/1323/1936 ms
r5#

 

r4#ping
Protocol [ip]:
Target IP address: 5.5.5.5
Repeat count [5]: 10
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 4.4.4.4
Type of service [0]:
Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 10, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
.!!!.!!!!!
Success rate is 80 percent (8/10), round-trip min/avg/max = 872/1371/1872 ms

 

 

r4#ping
Protocol [ip]:
Target IP address: 10.10.11.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 4.4.4.4
Type of service [0]:
Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.11.1, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 84/419/1288 ms
r4#ping

 

r5#ping
Protocol [ip]:
Target IP address: 10.10.11.2
Repeat count [5]: 10
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 5.5.5.5
Type of service [0]:
Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 10, 100-byte ICMP Echos to 10.10.11.2, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!!!!!!
Success rate is 100 percent (10/10), round-trip min/avg/max = 376/1158/1656 ms
r5#