IPSEC技术应用
 
isakmp模式
 
 

 

 

 

 
F1配置：
[f1]inter eth0/0
[f1-Ethernet0/0]ip address 192.168.1.254 24
[f1-Ethernet0/0]loopback
[f1-Ethernet0/0]inter eth0/1
[f1-Ethernet0/1]ip address 1.1.1.1 24
[f1-Ethernet0/1]quit
[f1]ip route 0.0.0.0 0 1.1.1.2做路由
加区域：
[f1]fire zone trust
[f1-zone-trust]add inter eth0/0
[f1-zone-trust]quit
[f1]fire zone untrust
[f1-zone-untrust]add inter eth0/1
制做控制列表：
[f1]acl num 3000
[f1-acl-adv-3000]rule 10 permit ip source 192.168.1.0 0.0.0.255 dest 192.168.2.0 0.0.0.255
[f1-acl-adv-3000]rule 20 deny ip source any dest any
[f1-acl-adv-3000]quit
做安全提议：
[f1]ipsec proposal tran1安全提议名字
[f1-ipsec-proposal-tran1]?
Ipsec-proposal view commands:
 display              Display current system information
 encapsulation-mode Specify the packet encapsulation mode
 esp                  Specify the ESP protocol(RFC2406) parameters
 nslookup             Query Internet name servers
 ping                 Ping function
 quit                 Exit from current command view
 return               Exit to User View
  save                 Save current configuration
 tracert              Trace route function
 transform            Specify the security protocol(s) used to transform the
                      packet
 undo                 Cancel current setting
 vrbd                 Show application version
 
[f1-ipsec-proposal-tran1]encap ?
 transport Only the payload of IP packet is protected(transport mode)
 tunnel      The entire IP packet is protected(tunnel mode)
 
[f1-ipsec-proposal-tran1]encap tunnel 制定安全协议报文封装模式（隧道）
[f1-ipsec-proposal-tran1]transform ?
 ah       AH protocol defined in RFC2402
 ah-esp ESP protocol first, then AH protocol
 esp      ESP protocol defined in RFC2406
 
[f1-ipsec-proposal-tran1]transform esp 制定对报文进行安全转换的安全协议（esp）
[f1-ipsec-proposal-tran1]esp encry des 加密算法类型
[f1-ipsec-proposal-tran1]esp auth md5 验证算法类型
[f1-ipsec-proposal-tran1]quit
建立邻居：
[f1]ike peer f2
共享密钥：
[f1-ike-peer-f2]pre-shared-key simple 123456
目的：
[f1-ike-peer-f2]remote-address 1.1.2.1
 
 
 
 
制作安全策略：
 
[f1]ipsec policy policy1 10 isakmp
[f1-ipsec-policy-isakmp-policy1-10]security acl 3000
[f1-ipsec-policy-isakmp-policy1-10]proposal tran1
建立邻居
[f1-ipsec-policy-isakmp-policy1-10]ike-peer f2
应用到接口：
[f1]inter eth0/1
[f1-Ethernet0/1]ipsec policy policy1
 
配置f2：
[f2]inter eth0/0
[f2-Ethernet0/0]ip address 192.168.2.254 24
[f2-Ethernet0/0]inter eth0/1
[f2-Ethernet0/1]ip address 1.1.2.1 24
[f2-Ethernet0/1]quit
[f2]ip route 0.0.0.0 0 1.1.2.2
[f2]fire pack defau permi
[f2]fire zone trust
[f2-zone-trust]add inter eth0/0
 The interface has been added to trust security zone.
[f2-zone-trust]quit
[f2]fire zone untrust
[f2-zone-untrust]add inter eth0/1
[f2-zone-untrust]quit
[f2]acl num 3000
[f2-acl-adv-3000]rule 10 permit ip source 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255
[f2-acl-adv-3000]rule 20 deny ip source any dest any
[f2-acl-adv-3000]quit
[f2]ipsec proposal tran1
[f2-ipsec-proposal-tran1]encap tunnel
[f2-ipsec-proposal-tran1]transform esp
[f2-ipsec-proposal-tran1]esp encry des
[f2-ipsec-proposal-tran1]esp auth md5
[f2-ipsec-proposal-tran1]quit
建立邻居：
[f2]ike peer f1
[f2-ike-peer-f1]pre-share?
   pre-shared-key
 
[f2-ike-peer-f1]pre-shared-key 123456
[f2-ike-peer-f1]remote-address 1.1.1.1
做策略：
[f2]ipsec policy policy1 10 isakmp
[f2-ipsec-policy-isakmp-policy1-10]security acl 3000
[f2-ipsec-policy-isakmp-policy1-10]proposal tran1
[f2-ipsec-policy-isakmp-policy1-10]ike-peer f1
[f2-ipsec-policy-isakmp-policy1-10]quit
[f2]inter eth0/1
[f2-Ethernet0/1]
[f2-Ethernet0/1]ipsec policy polict1
 No such policy exists.
[f2-Ethernet0/1]ipsec policy policy1
 
 
配置交换机：
[Quidway]vlan 10
[Quidway-vlan10]port eth0/10
[Quidway-vlan10]ip address 1.1.1.2 255.255.255.0
                ^
 % Unrecognized command found at '^' position.
[Quidway-vlan10]vlan 20
[Quidway-vlan20]port eth0/20
 
[Quidway]inter vlan 10
[Quidway-Vlan-interface10]
%Dec 14 10:30:20 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:
 Vlan-interface10: turns into UP state
       
[Quidway-Vlan-interface10]ip address 1.1.1.2 255.255.255.0
[Quidway-Vlan-interface10]
%Dec 14 10:30:38 2012 Quidway IFNET/5/UPDOWN:Line protocol on the interface Vlan-interface10 turns into UP state
 
[Quidway-Vlan-interface10]inter vlan 20
[Quidway-Vlan-interface20]
%Dec 14 10:30:45 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:
 Vlan-interface20: turns into UP state
 
[Quidway-Vlan-interface20]ip address 1.1.2.2 255.255.255.0
 
测试：
[f2]dis ip rout 查看路由表
 Routing Table: public net
Destination/Mask    Protocol Pre Cost        Nexthop         Interface
0.0.0.0/0           STATIC   60   0           1.1.2.2         Ethernet0/1
1.1.2.0/24         DIRECT   0    0           1.1.2.1         Ethernet0/1
1.1.2.1/32          DIRECT   0    0           127.0.0.1       InLoopBack0
127.0.0.0/8         DIRECT   0    0           127.0.0.1       InLoopBack0
127.0.0.1/32        DIRECT   0    0           127.0.0.1       InLoopBack0
192.168.2.0/24      DIRECT   0    0           192.168.2.254   Ethernet0/0
192.168.2.254/32    DIRECT   0    0           127.0.0.1       InLoopBack0
[f2]ping -a 192.168.2.254 192.168.1.254
 PING 192.168.1.254: 56 data bytes, press CTRL_C to break
    Request time out
    Reply from 192.168.1.254: bytes=56 Sequence=2 ttl=255 time=17 ms
    Reply from 192.168.1.254: bytes=56 Sequence=3 ttl=255 time=16 ms
    Reply from 192.168.1.254: bytes=56 Sequence=4 ttl=255 time=16 ms
    Reply from 192.168.1.254: bytes=56 Sequence=5 ttl=255 time=15 ms
 
 --- 192.168.1.254 ping statistics ---
    5 packet(s) transmitted
    4 packet(s) received
    20.00% packet loss
    round-trip min/avg/max = 15/16/17 ms
 
 野蛮模式
 
野蛮模式：
F1自动获得
 

 

 

 

配置f2：
[f2]inter eth0/0
[f2-Ethernet0/0]ip addres 192.168.2.254 24
[f2-Ethernet0/0]loopback
[f2-Ethernet0/0]inter eth0/1
[f2-Ethernet0/1]ip address 1.1.2.1 24
[f2]ip route 0.0.0.0 0 1.1.2.2
加区域：
[f2]firewall packet-filter default permit
[f2]firewall zone trust
[f2-zone-trust]add inter eth0/0
[f2]firewall zone untrust
[f2-zone-untrust]add inter eth0/1
做控制列表：
[f2]acl number 3000
[f2-acl-adv-3000]rule 10 permit ip source 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255
[f2-acl-adv-3000]rule 20 deny ip source any dest any
 
做安全提议：
[f2]ipsec proposal tran1
[f2-ipsec-proposal-tran1]encapsulation-mode tunnel
[f2-ipsec-proposal-tran1]transform esp
[f2-ipsec-proposal-tran1]esp encryption-algorithm des
[f2-ipsec-proposal-tran1]esp authentication-algorithm md5
做邻居;
[f2]ike peer f1
[f2-ike-peer-f1]?
Ike-peer 系统视图命令:
 certificate      设置证书的参数
 display          显示当前系统信息
 dpd              配置peer的DPD
 exchange-mode    指定IKE阶段一使用的协商模式
 id-type          设置地址或名字作为ID
 local            设置隧道本端子网类型
 local-address    指定本端IP地址
 nat              使用udp封装进行nat透传
 nslookup         查询域名服务
 peer             设置隧道对端子网类型
 ping             检查网络连接或主机是否可达
 pre-shared-key 指定预共享密钥
 quit             退出当前的命令视图
 remote-address 指定对端IP地址
 remote-name      指定对端网关名
 return           退到用户视图
 save             保存当前有效配置
 tracert          跟踪到达目的地的路由
 undo             取消当前设置
 vrbd             显示VRP版本
 
[f2-ike-peer-f1]exchange-mode ? 
 aggressive 野蛮模式
 main         主模式
 
[f2-ike-peer-f1]exchange-mode aggressive
[f2-ike-peer-f1]id-type name               设置名字作为id
[f2-ike-peer-f1]pre-shared-key simple 123456
[f2-ike-peer-f1]remote-name f1
[f2-ike-peer-f1]local-address 1.1.2.1
[f2]ike local-name f2
做策略：
[f2]ipsec policy policy1 10 isakmp
[f2-ipsec-policy-isakmp-policy1-10]security acl 3000
[f2-ipsec-policy-isakmp-policy1-10]proposal tran1
[f2-ipsec-policy-isakmp-policy1-10]ike-peer f1
应用：
[f2]inter eth0/1
[f2-Ethernet0/1]ipsec policy policy1
建立控制列表：
[f1]acl number 3000
[f1-acl-adv-3000]rule 10 permit ip source 192.168.1.0 0.0.0.255 dest 192.168.2.0 0.0.0.255
[f1-acl-adv-3000]rule 20 deny ip source any dest any
安全提议：
[f1]ipsec proposal tran1
[f1-ipsec-proposal-tran1]encap      
[f1-ipsec-proposal-tran1]encapsulation-mode tunnel
[f1-ipsec-proposal-tran1]transform esp
[f1-ipsec-proposal-tran1]esp encry       
[f1-ipsec-proposal-tran1]esp encryption-algorithm des
[f1-ipsec-proposal-tran1]esp auth 
[f1-ipsec-proposal-tran1]esp authentication-algorithm md5
建立邻居：
[f1]ike peer f2
[f1-ike-peer-f2]exchange-mode aggressive
[f1-ike-peer-f2]id-type name
[f1-ike-peer-f2]remote-address 1.1.2.1
[f1-ike-peer-f2]remote-name f2
密钥：
[f1-ike-peer-f2]pre-shared-key simple 123456
安全策略：
[f1-ike-peer-f2]quit
[f1]ipsec policy policy1 10 isakmp
[f1-ipsec-policy-isakmp-policy1-10]security acl 3000
[f1-ipsec-policy-isakmp-policy1-10]proposal tran1
[f1-ipsec-policy-isakmp-policy1-10]ike-peer f2
[f1-ipsec-policy-isakmp-policy1-10]quit
应用：
[f1]inter eth0/1
[f1-Ethernet0/1]ipsec policy policy1
设置接口为自动获得地址：
[f1]inter eth0/1
[f1-Ethernet0/1]ip ?
 address           设置接口的IP地址
 fast-forwarding 快转开关信息
 policy            使能策略路由
 relay             中继
 urpf              单播反向路径查找功能
 
[f1-Ethernet0/1]ip address ?
 X.X.X.X       IP地址
 bootp-alloc 使用BOOTP协商分配IP地址
 dhcp-alloc    使用DHCP协商分配IP地址
 
[f1-Ethernet0/1]ip address dhcp-alloc
[f1-Ethernet0/1]
%2012/12/13 00:51:52:687 f1 IFNET/4/UPDOWN:链路协议在接口Ethernet0/1上状态变为UP
[f1]inter eth0/0
[f1-Ethernet0/0]ip address 192.168.1.254 24
[f1-Ethernet0/0]loopback
[f1]ip route 0.0.0.0 0 1.1.1.2
交换机配置：
[Quidway]vlan 10
[Quidway-vlan10]port eth0/10
[Quidway-vlan10]vlan 20
[Quidway-vlan20]port eth0/20
[Quidway-vlan20]quit
[Quidway]inter vlan 10
[Quidway-Vlan-interface10]ip address 1.1.1.2 255.255.255.0
[Quidway]inter vlan 20
[Quidway-Vlan-interface20]
%Dec 14 12:10:27 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:
 Vlan-interface20: turns into UP state
 
[Quidway-Vlan-interface20]ip address 1.1.2.2 255.255.255.0
做dhcp服务器：
[Quidway]dhcp server ip-pool f1
[Quidway-dhcp-f1]network 1.1.1.0 mask 255.255.255.0
[Quidway-dhcp-f1]gateway-list 1.1.1.2
 
测试：
[f1]ping -a 192.168.1.254 192.168.2.254
 PING 192.168.1.254: 56 data bytes, press CTRL_C to break
    Request time out
    Reply from 192.168.2.254: bytes=56 Sequence=2 ttl=255 time=17 ms
    Reply from 192.168.2.254: bytes=56 Sequence=3 ttl=255 time=16 ms
    Reply from 192.168.2.254: bytes=56 Sequence=4 ttl=255 time=16 ms
    Reply from 192.168.2.254: bytes=56 Sequence=5 ttl=255 time=15 ms
 
 --- 192.168.1.254 ping statistics ---
    5 packet(s) transmitted
    4 packet(s) received
    20.00% packet loss
    round-trip min/avg/max = 15/16/17 ms