基于IPsec仅支持单播和IP协议的局性性。对于组播、广播和非IP流量的特性不能支持。那么我们可以另一种方式:使用GRE来封装这些流量,再用IPsec加密这些感兴趣流。使之通过GRE的隧道解决IPsec仅支持IP协议和单播的特性。但需要注意的是IPsec的隧道模式会破坏GRE的报头,所以我们必须要把它配置成传输模式。
一、下面通过一个实验来看一下配置过程:
一、下面通过一个实验来看一下配置过程:
1、拓扑图:
![](https://i-blog.csdnimg.cn/blog_migrate/6f62b15e0e8dd9e1df1e3e7eff1f7ea2.jpeg)
2、配置各路由器的
IP。并且在
R1和
R3上配置默认路由,以保证网络的连通性:
R1(config)#ip route 0.0.0.0 0.0.0.0 202.102.48.66
<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
R3(config)#ip route 0.0.0.0 0.0.0.0 211.64.135.33
R3#ping 202.102.48.65
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.102.48.65, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/29/80 ms
|
3、在
R1和
R3上配置隧道:
R1(config)#int tunnel 1 (创建隧道1)
R1(config-if)#ip unnumbered s1/1(为节省IP借用s1/1物理接口地址)
R1(config-if)#tunnel source s1/1 (指定隧道的源)
R1(config-if)#tunnel destination 211.64.135.34 (指定目标隧道)
R1(config-if)#
*Mar 1 02:59:02.471: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up (配置之后也能看到R1的up状态)
R3(config-if)#ip unnumbered s1/0
R3(config-if)#tunnel source s1/0
R3(config-if)#tunnel destination 202.102.48.65
R3(config-if)#
*Mar 1 03:04:20.319: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
|
4、
R1和
R3隧道建立之后,写一条静态路由,确保两端
loopback接口可以通信:
R1(config)#ip route 192.168.0.0 255.255.0.0 tunnel 1
R3(config)#ip route 172.16.0.0 255.255.0.0 tunnel 1
R3(config)#do ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/28/60 ms
R3(config)#
|
5、在
GRE隧道中,通过
IPsec加密这些感兴趣流。为使
GRE的报头完整,下面在
R1和
R3上配置
IPsec的传输模式:
R1(config)#crypto isakmp key 0 CISCO address 211.64.135.34 (定义预共享密钥)
R1(config)#crypto isakmp policy 1 (进入IKE策略编辑模式,1代表优先级)
R1(config-isakmp)#authentication pre-share(使用预共享认证模式)
R1(config-isakmp)#encryption 3des (封装3DES)
R1(config-isakmp)#hash md5 (设置哈希算法为MD5)
R1(config-isakmp)#group 1 (使用Diffie-Hellman 组1进行密钥交换)
R1(config-isakmp)#lifetime 86400 (当然也可以不写这一条,因为86400秒是默认的生命周期)
R1(config-isakmp)#exit
R1(config)#crypto ipsec transform-set TEST esp-3des(配置IPsec的变换集,对数据交换进行加密)
R1(cfg-crypto-trans)#mode transport(为确保GRE报头的完整性,建议配置成传输模式)
R1(cfg-crypto-trans)#exit
R1(config)#access-list 100 per gre host 202.102.48.65 host 211.64.135.34(建立一个对GRE的ACL)
R1(config)#crypto map R1_GRE_R3 10 ipsec-isakmp (配置加密映射表)
R1(config-crypto-map)#set peer 211.64.135.34 (设置对等体IP)
R1(config-crypto-map)#set transform-set TEST (引用之前设置的IPsec的变换集)
R1(config-crypto-map)#match address 100 (匹配ACL 100)
R1(config-crypto-map)#int s1/1(进入需要挂接的接口)
R1(config-if)#crypto map R1_GRE_R3 (挂接映射表)
R3(config)#crypto isakmp key 0 CISCO address 202.102.48.65
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#encryption 3des
R3(config-isakmp)#group 1
R3(config-isakmp)#hash md5
R3(config-isakmp)#exit
R3(config)#crypto ipsec transform-set TEST esp-3des
R3(cfg-crypto-trans)#mode transport
R3(cfg-crypto-trans)#exit
R3(config)#access-list 100 permit gre host 211.64.135.34 host 202.102.48.65
R3(config)#crypto map R3_GRE_R1 10 ipsec-isakmp
R3(config-crypto-map)#set peer 202.102.48.65
R3(config-crypto-map)#set transform-set TEST
R3(config-crypto-map)#match address 100
R3(config-crypto-map)#int s1/0
R3(config-if)#crypto map R3_GRE_R1
R3(config-if)#
*Mar 1 05:11:19.770: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON (配置完之后状态为on)
|
二、验证一下实验的效果:
1、我们用扩展
ping验证一下
R1和
R3的回环地址的通信情况:
R1#ping ip
Target IP address: 192.168.1.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 172.16.1.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.1
.!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/41/84 ms
R1#
|
2、我们可以用
sh crypto isakmp sa 查看
IKE第一阶段的协商信息,也可以用
sh crypto ipsec sa来查看第二阶段的安全关联信息。上次实验已经很详细地分析了这些信息,这里我们只看一下
R1的
IKE会话信息:
R1#sh crypto session
Crypto session current status
Interface: Serial1/1 (本地的IPsec会话接口)
Session status: UP-ACTIVE (状态已经up)
Peer: 211.64.135.34 port 500 (对等体的IP和端口号)
IKE SA: local 202.102.48.65/500 remote 211.64.135.34/500 Active
IPSEC FLOW: permit 47 host 202.102.48.65 host 211.64.135.34
Active SAs: 2, origin: crypto map
|
转载于:https://blog.51cto.com/supercisco/309019