Site-to-Site ××× 配置实例（RSA-ENCR）-CSDN博客

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

1、路由配置

R1#show running-config

Building configuration...

Current configuration : 1554 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R1

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

!

ip cef

ip domain name xuanbo.com

!

crypto key pubkey-chain rsa

addressed-key 99.1.1.2

address 99.1.1.2

key-string

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D0190A 044B49FA

88A7E324 E048B769 DC1412DF FBD0BA62 3A47A91C 1B7AE863 D506D9C4 3766AD07

6D1A1C15 4C7A2E03 B61B8737 42EFE7CE 3E675599 68698BC6 F1020301 0001

quit

!

crypto isakmp policy 110

encr 3des

authentication rsa-encr

group 5

!

crypto ipsec transform-set *** esp-des esp-md5-hmac

!

crypto map rsa*** 10 ipsec-isakmp

set peer 99.1.1.2

set transform-set ***

match address 110

!

interface Loopback0

ip address 172.16.1.1 255.255.255.0

!

interface FastEthernet0/0

ip address 99.1.1.1 255.255.255.252

duplex half

crypto map rsa***

!

interface Ethernet1/0

no ip address

shutdown

duplex half

!

interface Ethernet1/1

no ip address

shutdown

duplex half

!

interface Ethernet1/2

no ip address

shutdown

duplex half

!

interface Ethernet1/3

no ip address

shutdown

duplex half

!

ip classless

ip route 0.0.0.0 0.0.0.0 99.1.1.2

!

no ip http server

no ip http secure-server

!

access-list 110 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255

!

control-plane

!

gatekeeper

shutdown

!

line con 0

stopbits 1

line aux 0

line vty 0 4

!

end

R2#show running-config

Building configuration...

Current configuration : 1554 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

!

ip cef

ip domain name xuanbo.com

!

crypto key pubkey-chain rsa

addressed-key 99.1.1.1

address 99.1.1.1

key-string

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E44D7B B694AE99

AF1863B5 E4144B75 05A5DD1B 2CFD95FA 82787618 372BBD92 7D185C00 BA020E56

DD33BEE9 7875B122 F084C84C 0D28D0DF 55CD0BAD C4948B61 CF020301 0001

quit

!

crypto isakmp policy 110

encr 3des

authentication rsa-encr

group 5

!

crypto ipsec transform-set *** esp-des esp-md5-hmac

!

crypto map rsa*** 10 ipsec-isakmp

set peer 99.1.1.1

set transform-set ***

match address 110

!

interface Loopback0

ip address 172.16.2.1 255.255.255.0

!

interface FastEthernet0/0

ip address 99.1.1.2 255.255.255.252

duplex half

crypto map rsa***

!

interface Ethernet1/0

no ip address

shutdown

duplex half

!

interface Ethernet1/1

no ip address

shutdown

duplex half

!

interface Ethernet1/2

no ip address

shutdown

duplex half

!

interface Ethernet1/3

no ip address

shutdown

duplex half

!

ip classless

ip route 0.0.0.0 0.0.0.0 99.1.1.1

!

no ip http server

no ip http secure-server

!

access-list 110 permit ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255

!

control-plane

!

gatekeeper

shutdown

!

line con 0

stopbits 1

line aux 0

line vty 0 4

!

end

2、验证配置

R1#debug crypto isakmp

Crypto ISAKMP debugging is on

R1#debug crypto ipsec

Crypto IPSEC debugging is on

R1#ping 172.16.2.1 source 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.2.1, timeout is 2 seconds:

Packet sent with a source address of 172.16.1.1

*Dec 11 22:25:58.363: IPSEC(sa_request): ,

(key eng. msg.) OUTBOUND local= 99.1.1.1, remote= 99.1.1.2,

local_proxy= 172.16.1.0/255.255.255.0/0/0 (type=4),

remote_proxy= 172.16.2.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),

lifedur= 3600s and 4608000kb,

spi= 0xCF6D5959(3480050009), conn_id= 0, keysize= 0, flags= 0x400A

*Dec 11 22:25:58.371: ISAKMP: received ke message (1/1)

*Dec 11 22:25:58.371: ISAKMP:(0:0:N/A:0): SA request profile is (NULL)

*Dec 11 22:25:58.375: ISAKMP: Created a peer struct for 99.1.1.2, peer port 500

*Dec 11 22:25:58.375: ISAKMP: New peer created peer = 0x657A94B0 peer_handle = 0x80000002

*Dec 11 22:25:58.375: ISAKMP: Locking peer struct 0x657A94B0, IKE refcount 1 for isakmp_initiator

*Dec 11 22:25:58.379: ISAKMP: local port 500, remote port 500

*Dec 11 22:25:58.379: ISAKMP: set new node 0 to QM_IDLE

*Dec 11 22:25:58.379: insert sa successfully sa = 66228134

*Dec 11 22:25:58.379: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode.

*Dec 11 22:25:58.383: ISAKMP:(0:0:N/A:0):Looking for a matching key for 99.1.1.2 in default

*Dec 11 22:25:58.383: ISAKMP:(0:0:N/A:0):No pre-shared key with 99.1.1.2!

*Dec 11 22:25:58.387: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-07 ID

*Dec 11 22:25:58.387: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-03 ID

*Dec 11 22:25:58.387: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-02 ID

*Dec 11 22:25:58.391: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

*Dec 11 22:25:58.391: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1

*Dec 11 22:25:58.391: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange

*Dec 11 22:25:58.395: ISAKMP:(0:0:N/A:0): sending packet to 99.1.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE

*Dec 11 22:25:58.655: ISAKMP (0:0): received packet from 99.1.1.2 dport 500 sport 500 Global (I) MM_NO_STATE

*Dec 11 22:25:58.667: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Dec 11 22:25:58.667: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_I_MM2

*Dec 11 22:25:58.671: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0

*Dec 11 22:25:58.675: ISAKMP:(0:0:N/A:0): processing .!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 8/76/216 ms

R1#vendor id payload

*Dec 11 22:25:58.675: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch

*Dec 11 22:25:58.675: ISAKMP (0:0): vendor ID is NAT-T v7

*Dec 11 22:25:58.679: ISAKMP : Scanning profiles for xauth ...

*Dec 11 22:25:58.679: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 110 policy

*Dec 11 22:25:58.679: ISAKMP: encryption 3DES-CBC

*Dec 11 22:25:58.679: ISAKMP: hash SHA

*Dec 11 22:25:58.679: ISAKMP: default group 5

*Dec 11 22:25:58.679: ISAKMP: auth RSA encr

*Dec 11 22:25:58.683: ISAKMP: life type in seconds

*Dec 11 22:25:58.683: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80

*Dec 11 22:25:58.687: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0

*Dec 11 22:25:58.823: ISAKMP:(0:1:SW:1): processing vendor id payload

*Dec 11 22:25:58.823: ISAKMP:(0:1:SW:1): vendor ID seems Unity/DPD but major 245 mismatch

*Dec 11 22:25:58.827: ISAKMP (0:134217729): vendor ID is NAT-T v7

*Dec 11 22:25:58.827: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Dec 11 22:25:58.831: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2

*Dec 11 22:25:58.895: ISAKMP:(0:1:SW:1):Unable to get router cert or routerdoes not have a cert: needed to find DN!

*Dec 11 22:25:58.895: ISAKMP:(0:1:SW:1):SA is doing RSA encryption authentication using id type ID_IPV4_ADDR

*Dec 11 22:25:58.899: ISAKMP (0:134217729): ID payload

next-payload : 10

type : 1

address : 99.1.1.1

protocol : 17

port : 500

length : 12

*Dec 11 22:25:58.919: ISAKMP:(0:1:SW:1):length after encryption 64

*Dec 11 22:25:58.919: ISAKMP:(0:1:SW:1):Total payload length: 68

*Dec 11 22:25:58.927: ISAKMP:(0:1:SW:1): sending packet to 99.1.1.2 my_port 500 peer_port 500 (I) MM_SA_SETUP

*Dec 11 22:25:58.931: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Dec 11 22:25:58.931: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3

*Dec 11 22:25:59.315: ISAKMP (0:134217729): received packet from 99.1.1.2 dport 500 sport 500 Global (I) MM_SA_SETUP

*Dec 11 22:25:59.315: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Dec 11 22:25:59.319: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4

*Dec 11 22:25:59.323: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0

*Dec 11 22:25:59.479: ISAKMP:(0:1:SW:1): processing ID payload. message ID = 0

*Dec 11 22:25:59.619: ISAKMP (0:134217729): ID payload

next-payload : 10

type : 1

address : 99.1.1.2

protocol : 17

port : 500

length : 68

*Dec 11 22:25:59.623: ISAKMP:(0:1:SW:1):: peer matches *none* of the profiles

*Dec 11 22:25:59.623: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0

*Dec 11 22:25:59.687: ISAKMP:(0:1:SW:1):SKEYID state generated

*Dec 11 22:25:59.687: ISAKMP:(0:1:SW:1): processing vendor id payload

*Dec 11 22:25:59.691: ISAKMP:(0:1:SW:1): vendor ID is Unity

*Dec 11 22:25:59.691: ISAKMP:(0:1:SW:1): processing vendor id payload

*Dec 11 22:25:59.691: ISAKMP:(0:1:SW:1): vendor ID is DPD

*Dec 11 22:25:59.691: ISAKMP:(0:1:SW:1): processing vendor id payload

*Dec 11 22:25:59.691: ISAKMP:(0:1:SW:1): speaking to another IOS box!

*Dec 11 22:25:59.695: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Dec 11 22:25:59.695: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM4

*Dec 11 22:25:59.699: ISAKMP:(0:1:SW:1):Send initial contact

*Dec 11 22:25:59.703: ISAKMP:(0:1:SW:1): sending packet to 99.1.1.2 my_port 500 peer_port 500 (I) MM_KEY_EXCH

*Dec 11 22:25:59.707: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Dec 11 22:25:59.707: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM5

*Dec 11 22:25:59.875: ISAKMP (0:134217729): received packet from 99.1.1.2 dport 500 sport 500 Global (I) MM_KEY_EXCH

*Dec 11 22:25:59.879: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = 0

*Dec 11 22:25:59.879: ISAKMP:(0:1:SW:1):SA authentication status:

authenticated

*Dec 11 22:25:59.883: ISAKMP:(0:1:SW:1):SA has been authenticated with 99.1.1.2

*Dec 11 22:25:59.883: ISAKMP: Trying to insert a peer 99.1.1.1/99.1.1.2/500/, and inserted successfully 657A94B0.

*Dec 11 22:25:59.883: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Dec 11 22:25:59.887: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM5 New State = IKE_I_MM6

*Dec 11 22:25:59.891: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Dec 11 22:25:59.891: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_I_MM6

*Dec 11 22:25:59.939: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Dec 11 22:25:59.939: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE

*Dec 11 22:25:59.943: ISAKMP:(0:1:SW:1):beginning Quick Mode exchange, M-ID of -2007771356

*Dec 11 22:25:59.955: ISAKMP:(0:1:SW:1): sending packet to 99.1.1.2 my_port 500 peer_port 500 (I) QM_IDLE

*Dec 11 22:25:59.955: ISAKMP:(0:1:SW:1):Node -2007771356, Input = IKE_MESG_INTERNAL, IKE_INIT_QM

*Dec 11 22:25:59.959: ISAKMP:(0:1:SW:1):Old State = IKE_QM_READY New State = IKE_QM_I_QM1

*Dec 11 22:25:59.959: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

*Dec 11 22:25:59.959: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

*Dec 11 22:26:00.211: ISAKMP (0:134217729): received packet from 99.1.1.2 dport 500 sport 500 Global (I) QM_IDLE

*Dec 11 22:26:00.215: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -2007771356

*Dec 11 22:26:00.215: ISAKMP:(0:1:SW:1): processing SA payload. message ID = -2007771356

*Dec 11 22:26:00.219: ISAKMP:(0:1:SW:1):Checking IPSec proposal 1

*Dec 11 22:26:00.219: ISAKMP: transform 1, ESP_DES

*Dec 11 22:26:00.219: ISAKMP: attributes in transform:

*Dec 11 22:26:00.219: ISAKMP: encaps is 1 (Tunnel)

*Dec 11 22:26:00.219: ISAKMP: SA life type in seconds

*Dec 11 22:26:00.223: ISAKMP: SA life duration (basic) of 3600

*Dec 11 22:26:00.223: ISAKMP: SA life type in kilobytes

*Dec 11 22:26:00.223: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0

*Dec 11 22:26:00.223: ISAKMP: authenticator is HMAC-MD5

*Dec 11 22:26:00.227: ISAKMP:(0:1:SW:1):atts are acceptable.

*Dec 11 22:26:00.231: IPSEC(validate_proposal_request): proposal part #1,

(key eng. msg.) INBOUND local= 99.1.1.1, remote= 99.1.1.2,

local_proxy= 172.16.1.0/255.255.255.0/0/0 (type=4),

remote_proxy= 172.16.2.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),

lifedur= 0s and 0kb,

spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2

*Dec 11 22:26:00.235: Crypto mapdb : proxy_match

src addr : 172.16.1.0

dst addr : 172.16.2.0

protocol : 0

src port : 0

dst port : 0

*Dec 11 22:26:00.239: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = -2007771356

*Dec 11 22:26:00.243: ISAKMP:(0:1:SW:1): processing ID payload. message ID = -2007771356

*Dec 11 22:26:00.251: ISAKMP: Locking peer struct 0x657A94B0, IPSEC refcount 1 for for stuff_ke

*Dec 11 22:26:00.255: ISAKMP:(0:1:SW:1): Creating IPSec SAs

*Dec 11 22:26:00.255: inbound SA from 99.1.1.2 to 99.1.1.1 (f/i) 0/ 0

(proxy 172.16.2.0 to 172.16.1.0)

*Dec 11 22:26:00.259: has spi 0xCF6D5959 and conn_id 0 and flags 2

*Dec 11 22:26:00.259: lifetime of 3600 seconds

*Dec 11 22:26:00.263: lifetime of 4608000 kilobytes

*Dec 11 22:26:00.263: has client flags 0x0

*Dec 11 22:26:00.263: outbound SA from 99.1.1.1 to 99.1.1.2 (f/i) 0/0

(proxy 172.16.1.0 to 172.16.2.0)

*Dec 11 22:26:00.263: has spi 941550661 and conn_id 0 and flags A

*Dec 11 22:26:00.267: lifetime of 3600 seconds

*Dec 11 22:26:00.267: lifetime of 4608000 kilobytes

*Dec 11 22:26:00.267: has client flags 0x0

*Dec 11 22:26:00.271: ISAKMP:(0:1:SW:1): sending packet to 99.1.1.2 my_port 500 peer_port 500 (I) QM_IDLE

*Dec 11 22:26:00.275: ISAKMP:(0:1:SW:1):deleting node -2007771356 error FALSE reason "No Error"

*Dec 11 22:26:00.279: ISAKMP:(0:1:SW:1):Node -2007771356, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Dec 11 22:26:00.279: ISAKMP:(0:1:SW:1):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE

*Dec 11 22:26:00.283: IPSEC(key_engine): got a queue event with 2 kei messages

*Dec 11 22:26:00.287: IPSEC(initialize_sas): ,

(key eng. msg.) INBOUND local= 99.1.1.1, remote= 99.1.1.2,

local_proxy= 172.16.1.0/255.255.255.0/0/0 (type=4),

remote_proxy= 172.16.2.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),

lifedur= 3600s and 4608000kb,

spi= 0xCF6D5959(3480050009), conn_id= 0, keysize= 0, flags= 0x2

*Dec 11 22:26:00.291: IPSEC(initialize_sas): ,

(key eng. msg.) OUTBOUND local= 99.1.1.1, remote= 99.1.1.2,

local_proxy= 172.16.1.0/255.255.255.0/0/0 (type=4),

remote_proxy= 172.16.2.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),

lifedur= 3600s and 4608000kb,

spi= 0x381EEC45(941550661), conn_id= 0, keysize= 0, flags= 0xA

*Dec 11 22:26:00.295: Crypto mapdb : proxy_match

src addr : 172.16.1.0

dst addr : 172.16.2.0

protocol : 0

src port : 0

dst port : 0

*Dec 11 22:26:00.295: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and 99.1.1.2

*Dec 11 22:26:00.299: IPSec: Flow_switching Allocated flow for sibling 80000002

*Dec 11 22:26:00.299: IPSEC(policy_db_add_ident): src 172.16.1.0, dest 172.16.2.0, dest_port 0

*Dec 11 22:26:00.299: ISAKMP: Locking peer struct 0x657A94B0, IPSEC refcount 2 for from create_transforms

*Dec 11 22:26:00.303: IPSEC(create_sa): sa created,

(sa) sa_dest= 99.1.1.1, sa_proto= 50,

sa_spi= 0xCF6D5959(3480050009),

sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2001

*Dec 11 22:26:00.303: IPSEC(create_sa): sa created,

(sa) sa_dest= 99.1.1.2, sa_proto= 50,

sa_spi= 0x381EEC45(941550661),

sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2002

*Dec 11 22:26:00.307: ISAKMP: Unlocking IPSEC struct 0x657A94B0 from create_transforms, count 1

R1#show crypto isakmp sa

dst src state conn-id slot status

99.1.1.2 99.1.1.1 QM_IDLE 1 0 ACTIVE

R1#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag: rsa***, local addr 99.1.1.1

protected vrf: (none)

local ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (172.16.2.0/255.255.255.0/0/0)

current_peer 99.1.1.2 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4

#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 1, #recv errors 0

local crypto endpt.: 99.1.1.1, remote crypto endpt.: 99.1.1.2

path mtu 1500, ip mtu 1500

current outbound spi: 0x381EEC45(941550661)

inbound esp sas:

spi: 0xCF6D5959(3480050009)

transform: esp-des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 2001, flow_id: SW:1, crypto map: rsa***

sa timing: remaining key lifetime (k/sec): (4516625/3551)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0x381EEC45(941550661)

transform: esp-des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 2002, flow_id: SW:2, crypto map: rsa***

sa timing: remaining key lifetime (k/sec): (4516625/3550)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

outbound ah sas:

outbound pcp sas:

注意：密钥的产生

1、手动生成RSA密钥

R2(config)#crypto key generate rsa

The name for the keys will be: R2.xuanbo.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take

a few minutes.

How many bits in the modulus [512]:

% Generating 512 bit RSA keys, keys will be non-exportable...[OK]

2、查看手动生成RSA密钥

R2#sh crypto key mypubkey rsa

% Key pair was generated at: 22:16:13 UTC Dec 11 2008

Key name: R2.xuanbo.com

Usage: General Purpose Key

Key is not exportable.

Key Data:

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D0190A 044B49FA

88A7E324 E048B769 DC1412DF FBD0BA62 3A47A91C 1B7AE863 D506D9C4 3766AD07

6D1A1C15 4C7A2E03 B61B8737 42EFE7CE 3E675599 68698BC6 F1020301 0001

% Key pair was generated at: 22:16:14 UTC Dec 11 2008

Key name: R2.xuanbo.com.server

Usage: Encryption Key

Key is not exportable.

Key Data:

307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00BC4A7B 0CF5F420

94C61B3A 1E85B80D 6050859B FC855CBA EFB8F95D E898EFE2 AE6A0FC9 1CA0BC77

AF2FA6A3 8B3B3E7B 83A6F619 1B0594CF BA945806 FB9AAE25 EA37465F C9EE6CA8

500E4C5C 420D63EE A322FD20 39815618 17C75EF7 86A5C834 DD020301 0001

3、配置R1的公钥

R2(config)#crypto key pubkey-chain rsa

R2(config-pubkey-chain)#addressed-key 99.1.1.1

R2(config-pubkey-key)#key-string

Enter a public key as a hexidecimal number ....

R2(config-pubkey)#$6F70D 01010105 00034B00 30480241 00E44D7B B694AE99

R2(config-pubkey)#$5DD1B 2CFD95FA 82787618 372BBD92 7D185C00 BA020E56

R2(config-pubkey)#$75B122 F084C84C 0D28D0DF 55CD0BAD C4948B61 CF020301 0001

4、查看公钥

R2#sh crypto key pubkey-chain rsa

Codes: M - Manually configured, C - Extracted from certificate

Code Usage IP-Address/VRF Keyring Name

M General 99.1.1.1 default

R2#sh crypto key pubkey-chain rsa address 99.1.1.1

Key address: 99.1.1.1

Usage: General Purpose Key

Source: Manually entered

Data:

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E44D7B B694AE99

AF1863B5 E4144B75 05A5DD1B 2CFD95FA 82787618 372BBD92 7D185C00 BA020E56

DD33BEE9 7875B122 F084C84C 0D28D0DF 55CD0BAD C4948B61 CF020301 0001

Site-to-Site ××× 配置实例（RSA-ENCR）

“相关推荐”对你有帮助么？