路由器利用loopback接口实现物理冗余链路的IPSEC ***

1.拓扑图：

2.基本接口配置：

R1：

R1(config-if)#int f0/0
R1(config-if)#ip add 202.100.12.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int f0/1
R1(config-if)#ip add 202.100.14.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int l0
R1(config-if)#ip add 202.100.1.1 255.255.255.0
R1(config-if)#int l1
R1(config-if)#ip add 192.168.1.1 255.255.255.0

R2：

R2(config)#int f0/0
R2(config-if)#ip add 202.100.12.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int f0/1
R2(config-if)#ip add 202.100.23.2 255.255.255.0
R2(config-if)#no sh

R4：

R4(config)#int f0/0
R4(config-if)#ip add 202.100.14.4 255.255.255.0
R4(config-if)#no sh
R4(config-if)#int f0/1
R4(config-if)#ip add 202.100.34.4 255.255.255.0
R4(config-if)#no sh

R3：

R3(config)#int f0/0
R3(config-if)#ip add 202.100.23.3 255.255.255.0
R3(config-if)#no sh
R3(config-if)#int f0/1
R3(config-if)#ip add 202.100.34.3 255.255.255.0
R3(config-if)#no sh
R3(config-if)#int l0
R3(config-if)#ip add 202.100.3.3 255.255.255.0
R3(config-if)#int l1
R3(config-if)#ip add 192.168.3.3 255.255.255.0

3.路由配置：

由动态路由协议OSPF提供物理链路的冗余：

R1(config-if)#router ospf 10
R1(config-router)#net 202.100.12.1 0.0.0.0 a 0
R1(config-router)#net 202.100.1.1 0.0.0.0 a 0
R1(config-router)#net 202.100.14.1 0.0.0.0 a 0

R2(config-if)#router ospf 10
R2(config-router)#net 202.100.12.2 0.0.0.0 a 0
R2(config-router)#net 202.100.23.2 0.0.0.0 a 0

R4(config)#router ospf 10
R4(config-router)#net 202.100.14.4 0.0.0.0 a 0
R4(config-router)#net 202.100.34.4 0.0.0.0 a 0

R3(config-if)#router ospf 10
R3(config-router)#net 202.100.23.3 0.0.0.0 a 0
R3(config-router)#net 202.100.34.3 0.0.0.0 a 0
R3(config-router)#net 202.100.3.3 0.0.0.0 a 0

确认lookbackup加密点能互相ping通：

R1#ping 202.100.3.3 source 202.100.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.3.3, timeout is 2 seconds:
Packet sent with a source address of 202.100.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/91/160 ms

4.***配置：

A.第一阶段策略：

R1(config)#crypto isakmp policy 10
R1(config-isakmp)#au pr
R1(config-isakmp)#ha md
R1(config-isakmp)#gr 2
R1(config-isakmp)#en 3des
R1(config-isakmp)#exit
R1(config)#crypto isakmp key 0 cisco address 202.100.3.3

R3(config)#crypto isakmp policy 10
R3(config-isakmp)# encr 3des
R3(config-isakmp)# hash md5
R3(config-isakmp)# authentication pre-share
R3(config-isakmp)# group 2
R3(config-isakmp)#exit
R3(config)#crypto isakmp key 0 cisco add 202.100.1.1

B.第二阶段策略：

R1(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

R3(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

C.Profile关联第二阶段转换集：

R1(config)#crypto ipsec profile ipsecpro
R1(ipsec-profile)#set transform-set transet
R1(ipsec-profile)#exit

R3(config)#crypto ipsec profile ipsecpro
R3(ipsec-profile)#set transform-set transet
R3(ipsec-profile)#exit

D.静态VTI接口配置：

R1(config)#int tun 0
R1(config-if)#tun source loopback 0
R1(config-if)#tunnel destination 202.100.3.3
R1(config-if)#tunnel mode ipsec ipv4
R1(config-if)#tunnel protection ipsec profile ipsecpro
R1(config-if)#ip add 172.16.1.1 255.255.255.0

R3(config)#int tun 0
R3(config-if)#tunnel source loopback 0
R3(config-if)#tunnel destination 202.100.1.1
R3(config-if)#tun mode ipsec ipv4
R3(config-if)#tunnel protection ipsec profile ipsecpro
R3(config-if)#ip add 172.16.1.3 255.255.255.0

E.动态路由协议：

R1(config)#router eigrp 10
R1(config-router)#no auto-summary
R1(config-router)#net 172.16.1.0 0.0.0.255
R1(config-router)#net 192.168.1.0 0.0.0.255

R3(config)#router eigrp 10
R3(config-router)#no auto-summary
R3(config-router)#net 172.16.1.0 0.0.0.255
R3(config-router)#net 192.168.3.0 0.0.0.255

5.检验：

A.动态路由：

R1#show ip  route ospf
O    202.100.23.0/24 [110/20] via 202.100.12.2, 00:31:50, FastEthernet0/0
    202.100.3.0/32 is subnetted, 1 subnets
O       202.100.3.3 [110/21] via 202.100.14.4, 00:18:47, FastEthernet0/1
                   [110/21] via 202.100.12.2, 00:18:47, FastEthernet0/0
O    202.100.34.0/24 [110/20] via 202.100.14.4, 00:19:48, FastEthernet0/1
R1#show ip  route eigrp
D    192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:02:31, Tunnel0

R3#show ip route ospf
    202.100.1.0/32 is subnetted, 1 subnets
O       202.100.1.1 [110/21] via 202.100.34.4, 00:18:01, FastEthernet0/1
                   [110/21] via 202.100.23.2, 00:18:11, FastEthernet0/0
O    202.100.14.0/24 [110/20] via 202.100.34.4, 00:18:01, FastEthernet0/1
O    202.100.12.0/24 [110/20] via 202.100.23.2, 00:18:11, FastEthernet0/0
R3#show ip route ei  
R3#show ip route eigrp
D    192.168.1.0/24 [90/297372416] via 172.16.1.1, 00:01:39, Tunnel0

B.***状态查看:

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
202.100.1.1     202.100.3.3     QM_IDLE           1001    0 ACTIVE

IPv6 Crypto ISAKMP SA

R1#show crypto engine connections active
Crypto Engine Connections

  ID Interface  Type  Algorithm           Encrypt  Decrypt IP-Address
   1 Fa0/1      IPsec 3DES+SHA                  0       66 202.100.1.1
   2 Fa0/1      IPsec 3DES+SHA                 73        0 202.100.1.1
1001 Fa0/1      IKE   MD5+3DES                  0        0 202.100.1.1

R3#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
202.100.1.1     202.100.3.3     QM_IDLE           1001    0 ACTIVE

IPv6 Crypto ISAKMP SA

R3#show crypto engine connections active
Crypto Engine Connections

  ID Interface  Type  Algorithm           Encrypt  Decrypt IP-Address
   1 Tu0        IPsec 3DES+SHA                  0       90 202.100.3.3
   2 Tu0        IPsec 3DES+SHA                 84        0 202.100.3.3
1001 Tu0        IKE   MD5+3DES                  0        0 202.100.3.3

R3#

C.关闭一个物理接口，***连接不会终端：

R1(config)#int f0/1
R1(config-if)#shu
R1(config-if)#
*Mar  1 00:47:17.555: %OSPF-5-ADJCHG: Process 10, Nbr 202.100.34.4 on FastEthernet0/1 from FULL to DOWN, Neighbor Down: Interface down or detached
R1(config-if)#
*Mar  1 00:47:19.539: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down
*Mar  1 00:47:20.539: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
R1(config-if)#end

R1#ping 192.168.3.3 source 192.168.1.1  

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.3, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 116/147/180 ms
R1#