*** ike 模式的配置：

分别在路由和防火墙上配置***实现不同网段的通信。


（图1）

通过创建*** 实现不同网段的网络通过广域网使用可以通信。

R3.fw1上分别配置通道

三层交换机上划分vlan ，构造一个不同区域的网络模拟广域网。

配置交换机

Vlan 10

Port e 0/1

Int vlan 10

Ip add 10.10.10.2 30

 

Vlan 20

Int vlan 20

Ip add 10.10.10.5 30

Port access vlan 20

 

[sw12-Vlan-interface20]dis vlan 10

 VLAN ID: 10

 VLAN Type: static

 ARP proxy disabled.

 Route Interface: configured

 IP Address: 10.10.10.2

 Subnet Mask: 255.255.255.252

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged   Ports: none

 Untagged Ports:

             Ethernet0/1          

 

[sw12-Vlan-interface20]dis vlan 20

 VLAN ID: 20

 VLAN Type: static

 ARP proxy disabled.

 Route Interface: configured

 IP Address: 10.10.10.5

 Subnet Mask: 255.255.255.252

 Description: VLAN 0020

 Name: VLAN 0020

 Tagged   Ports: none

 Untagged Ports:

             Ethernet0/2          

 

[sw12-Vlan-interface20]

 

 配置***1

在路由r3的E0接口配置***

1.配置ip和默认路由

[R3-Ethernet0]ip add 10.10.10.1 30 sub

[R3]int e 1

[R3-Ethernet1]ip add 1.1.1.1 24

[R3]ip route-static 0.0.0.0 0 10.10.10.2

 2.配置acl

[R3]acl 3000

[R3-acl-3000]rule permit ip source 1.1.1.0 0.0.0.255 destination 2.2.2.0 0.0.0.255

[R3-acl-3000]rule deny ip source any dest any

 3.配置安全提议

[R3]ipsec proposal tran1

[R3-ipsec-proposal-tran1]encap tunnel

[R3-ipsec-proposal-tran1]esp-new authentication- md5 --指定ESP使用的验证算法

[R3-ipsec-proposal-tran1]esp enc des    指定ESP使用的加密算法 

 4.策略

[R3]ipsec policy p1  10  isakmp  说明使用IKE协商建立安全联盟     

[R3-ipsec-policy-p1-10]security acl 3000指定对符合规则条件的报文进行保护

[R3-ipsec-policy-p1-10]pro tran1

[R3-ipsec-policy-p1-10]tunnel local 10.10.10.1

[R3-ipsec-policy-p1-10]tunnel remote 10.10.10.6

[R3]ike pre-shared-key 123456 remote 10.10.10.6

 

5.应用

[R3-ipsec-policy-p1-10]int e0

[R3-Ethernet0]ipsec policy p1

[R3]dis cu

  Now create configuration...

  Current configuration!

    version 1.74

    local-user user1 service-type administrator password simple 123

    sysname R3

    undo pos-server addr-switch

    firewall enable

    aaa-enable

    aaa accounting-scheme optional

  !

  ike pre-shared-key 123456 remote 10.10.10.6

  !

  acl 3000 match-order auto

    rule normal permit ip source 1.1.1.0 0.0.0.255 destination 2.2.2.0 0.0.0.255

    rule normal deny ip source any destination any

  !

  ipsec proposal tran1

  !

  ipsec policy p1 10 isakmp

    security acl 3000

    tunnel local 10.10.10.1

    tunnel remote 10.10.10.6             

  !

  controller e1 0

  !

  interface Aux0

    async mode flow

    link-protocol ppp

  !

  interface Ethernet0

    ip address 192.168.100.3 255.255.255.0

    ip address 10.10.10.1 255.255.255.252 sub

    ipsec policy p1

  !

  interface Ethernet1

    ip address 1.1.1.1 255.255.255.0

  !

  interface Serial0

    link-protocol ppp

  !

  interface Serial1

    link-protocol ppp

  !

  quit

  ip route-static 0.0.0.0 0.0.0.0 10.10.10.2 preference 60

  !                                      

  return

[R3]

[R3]dis ipsec sa all

 

  interface name: Ethernet0

    path MTU: 1500

    ipsec policy name: p1

    ipsec policy sequence: 10

    negotiation mode: isakmp

    in use settings = {tunnel}

    local address: 10.10.10.1

    remote address: 10.10.10.6

 

    esp SAs(inbound):

      spi: 237707733 (0xe2b21d5)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa timing: remaining key duration (bytes/sec): (1887412028/3040)

      max received sequence-number: 1

 

    esp SAs(outbound):

      spi: 2736644835 (0xa31de2e3)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa timing: remaining key duration (bytes/sec): (1887403020/3040)

      max sent sequence-number: 564

[R3]

 

 

配置***2

1. 配置ip

[fw-1]int Ethernet 0/0

[fw-1-Ethernet0/0]ip add 10.10.10.6 30 sub

[fw-1]interface Ethernet0/1

[fw-1-Ethernet0/1]ip add 2.2.2.1 24

[fw-1]ip route-static 0.0.0.0 0 10.10.10.5

2. 配置acl

[fw-1]acl  number 3000

[fw-1-acl-adv-3000]rule permit ip source 2.2.2.0 0.0.0.255 dest 1.1.1.0 0.0.0.255

[fw-1-acl-adv-3000]rule deny ip sour any dest any

 3. 配置安全提议

[fw-1]ipsec proposal tran2

[fw-1-ipsec-proposal-tran2]encap tunnel     -- 指定对整个IP报文进行加密或验证

[fw-1-ipsec-proposal-tran2]esp authentication-algorithm md5       --指定ESP使用HMAC-MD5的验证算

[fw-1-ipsec-proposal-tran2]esp encryption-algorithm des -- 指定ESP使用des的加密算法

4. 配置策略

[fw-1]ike  peer hh     

[fw-1-ike-peer-hh]local-address 10.10.10.6 

[fw-1-ike-peer-hh]remote-address 10.10.10.1

[fw-1-ike-peer-hh]pre-shared-key 123456 

--在isakmp中引用hh

[fw-1]ipsec policy p2 20 isakmp    

[fw-1-ipsec-policy-isakmp-p2-20]securityacl    

[fw-1-ipsec-policy-isakmp-p2-20]security acl 3000  

[fw-1-ipsec-policy-isakmp-p2-20]proposal tran2

[fw-1-ipsec-policy-isakmp-p2-20]ike-peer hh

--等待对端建立共同的密钥才能建立成功。

5. 应用

[fw-1]interface Ethernet0/0

[fw-1-Ethernet0/0]ips  

[fw-1-Ethernet0/0]ipsec p  

[fw-1-Ethernet0/0]ipsec policy p2 

[fw-1]

[fw-1]dis cu

ike peer hh

 pre-shared-key 123456

 remote-address 10.10.10.1

 local-address 10.10.10.6

#

ipsec proposal tran2

ipsec policy p2 20 isakmp

 security acl 3000

 ike-peer hh

 proposal tran2

acl number 3000

 rule 0 permit ip source 2.2.2.0 0.0.0.255 destination 1.1.1.0 0.0.0.255

 rule 1 deny ip

interface Ethernet0/0                    

 ip address 192.168.100.41 255.255.255.0

 ip address 10.10.10.6 255.255.255.252 sub

 ipsec policy p2

interface Ethernet0/1

 ip address 2.2.2.1 255.255.255.0

ip route-static 0.0.0.0 0.0.0.0 10.10.10.5 preference 60

 [fw-1]


[R3-ipsec-policy-p1-10]dis ips po all

 

    ipsec policy name: p1

    ipsec policy sequence: 10

    negotiation mode: isakmp

    security acl: 3000

    remote address 0: 10.10.10.6

    Proposal name:

    ipsec sa duration: 3600 seconds

    ipsec sa duration: 1843200 kilobytes

    OutBound SA has NOT been established.

    InBound SA has NOT been established.

[R3-ipsec-policy-p1-10]dis ips po p1

--硬件反应太慢了，等很久才出现下面的结果

[R3]dis ips po all

    ipsec policy name: p1

    ipsec policy sequence: 10

    negotiation mode: isakmp

    security acl: 3000

    remote address 0: 10.10.10.6

    Proposal name:  tran1

    ipsec sa duration: 3600 seconds

    ipsec sa duration: 1843200 kilobytes

    OutBound SA has been established.

InBound SA has been established.

 

 

在两段网络里测试：

C:\Documents and Settings\Administrator>ipconfig

Windows IP Configuration

Ethernet adapter 本地连接:

        Connection-specific DNS Suffix  . :

        IP Address. . . . . . . . . . . . : 1.1.1.2

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 1.1.1.1

C:\Documents and Settings\Administrator>ping 2.2.2.1

Pinging 2.2.2.1 with 32 bytes of data:

Reply from 2.2.2.1: bytes=32 time=5ms TTL=254

Reply from 2.2.2.1: bytes=32 time=5ms TTL=254

Reply from 2.2.2.1: bytes=32 time=5ms TTL=254

Reply from 2.2.2.1: bytes=32 time=5ms TTL=254

Ping statistics for 2.2.2.1:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 5ms, Maximum = 5ms, Average = 5ms

C:\Documents and Settings\Administrator>ping 2.2.2.2

Pinging 2.2.2.2 with 32 bytes of data:

Reply from 2.2.2.2: bytes=32 time=9ms TTL=126

Reply from 2.2.2.2: bytes=32 time=9ms TTL=126

Reply from 2.2.2.2: bytes=32 time=8ms TTL=126

Reply from 2.2.2.2: bytes=32 time=8ms TTL=126

Ping statistics for 2.2.2.2:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 8ms, Maximum = 9ms, Average = 8ms

C:\Documents and Settings\Administrator>