今天给大家介绍另一种常见的IPSEC 建立场景,利用GRE协议,建立。阅读本文,您需要有一定的IPSEC 基础知识以及常见配置基础,对此不熟悉的同学可以查阅本博客的其他文章。
推荐阅读:
IPSEC 简介
IPSEC 配置实例
一、实验拓扑及要求
首先给出实验拓扑:
要求在R1和R3上打一条GRE隧道,通过GRE隧道,实现IPSEC ,以实现PC1和PC2之间互通。
二、配置讲解说明
(一)IPSEC 相关配置
acl number 3000
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
ipsec proposal IPSEG
esp encryption-algorithm 3des
#
ike proposal 10
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike peer R3 v1
pre-shared-key simple admin
#
ipsec profile IPSEC_PRO
ike-peer R3
proposal IPSEG
上述配置主要是配置IPSEC的相关内容,与之前文章中介绍的普通情况下IPSEC配置相比,在GRE隧道中配置IPSEC,不是使用的ipsec policy,而是使用的ipsec profile。此外,在ike peer配置中,这里也不用指定对端IP地址。
(二)GRE相关配置
interface Tunnel0/0/0
ip address 100.1.1.1 255.255.255.0
tunnel-protocol gre
source 150.1.1.1
destination 150.1.2.3
ipsec profile IPSEC_PRO
以上是GRE Tunnel的相关配置,在配置时,要注意destination要成对方实际接口的IP地址,而不是Tunnel接口的IP地址。
三、附录——配置命令
R1:
acl number 3000
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
#
acl number 3001
rule 5 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 10 permit ip source 192.168.1.0 0.0.0.255
#
ipsec proposal IPSEG
esp encryption-algorithm 3des
#
ike proposal 10
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike peer R3 v1
pre-shared-key simple admin
#
ipsec profile IPSEC_PRO
ike-peer R3
proposal IPSEG
#
interface GigabitEthernet0/0/1
ip address 150.1.1.1 255.255.255.0
nat outbound 3001
#
interface GigabitEthernet0/0/2
ip address 192.168.1.1 255.255.255.0
#
interface Tunnel0/0/0
ip address 100.1.1.1 255.255.255.0
tunnel-protocol gre
source 150.1.1.1
destination 150.1.2.3
ipsec profile IPSEC_PRO
#
ip route-static 0.0.0.0 0.0.0.0 Tunnel0/0/0
R3:
acl number 3000
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
acl number 3001
rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 10 permit ip source 192.168.2.0 0.0.0.255
#
ipsec proposal IPSEC
esp encryption-algorithm 3des
#
ike proposal 10
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike peer R1 v1
pre-shared-key simple admin
ike-proposal 10
#
ipsec profile IPSEC_PRO
ike-peer R1
proposal IPSEC
#
interface GigabitEthernet0/0/0
ip address 150.1.2.3 255.255.255.0
nat outbound 3001
#
interface GigabitEthernet0/0/2
ip address 192.168.2.3 255.255.255.0
#
interface Tunnel0/0/0
ip address 100.1.1.3 255.255.255.0
tunnel-protocol gre
source 150.1.2.3
destination 150.1.1.1
ipsec profile IPSEC_PRO
#
ip route-static 0.0.0.0 0.0.0.0 Tunnel0/0/0
原创不易,转载请说明出处:https://blog.csdn.net/weixin_40228200/article/details/118558721