FD.IO-VPP研究及使用五 （隧道环境搭建）

搭建IPSEC vpn

vpp搭建IPSEC 有两种方式：
1，使用create ipsec tunnel方式
2，使用发起者响应者模式（ikev2）

1、使用ikev2配置ipsec

拓扑如下：

//#发起者配置：           
set int state GigabitEthernet4/0/2 up 
set int ip address GigabitEthernet4/0/2 90.10.10.1/24        
set int state GigabitEthernet4/0/3 up 
set int ip address GigabitEthernet4/0/3 10.10.10.1/24 
ikev2 profile add pr1  
ikev2 profile set pr1 auth shared-key-mic string Vpp123 
ikev2 profile set pr1 id local fqdn vpp1.home 
ikev2 profile set pr1 id remote fqdn vpp2.home
ikev2 profile set pr1 responder GigabitEthernet4/0/3 90.10.20.5
ikev2 profile set pr1 ike-crypto-alg aes-cbc 128 ike-integ-alg sha1-96 ike-dh modp-1024 
ikev2 profile set pr1 esp-crypto-alg aes-cbc 128 esp-integ-alg sha1-96 esp-dh modp-1024
ikev2 profile set pr1 traffic-selector local ip-range 90.10.10.0 - 90.10.10.200 port-range 0 - 65535 protocol 0 
ikev2 profile set pr1 traffic-selector remote ip-range 90.10.40.0 - 90.10.40.200 port-range 0 - 65535 protocol 0
set int state ipsec0 up 
ip route add 90.10.40.0/24 via ipsec0 
set int unnumbered ipsec0 use GigabitEthernet4/0/3
ikev2 initiate sa-init pr1   //发起协商，需要发起者和响应者网络可达且配好了IKE策略之后执行

//响应者配置
set int state GigabitEthernet4/0/2 up 
set int ip address GigabitEthernet4/0/2 90.10.40.1/24 
set int state GigabitEthernet4/0/3 up
set int ip address GigabitEthernet4/0/3 10.10.10.2/24
ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123 
ikev2 profile set pr1 id local fqdn vpp2.home 
ikev2 profile set pr1 id remote fqdn vpp1.home
ikev2 profile set pr1 traffic-selector local ip-range 90.10.40.0 - 90.10.40.200 port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range 90.10.10.0 - 90.10.10.200 port-range 0 - 65535 protocol 0
set int state ipsec0 up 
ip route add 90.10.10.0/24 via ipsec0
set int unnumbered ipsec0 use GigabitEthernet4/0/3

2、静态配置ipsec

拓扑如下：

#配置左边vpp
set int ip address GigabitEthernet4/0/2 90.10.30.1/24
set int promiscuous on GigabitEthernet4/0/2
set int ip address GigabitEthernet4/0/3 10.10.10.1/24
set int promiscuous on GigabitEthernet4/0/3
 
create ipsec tunnel local-ip 10.10.10.1 local-spi 1031 remote-ip 10.10.10.2 remote-spi 1030
set interface ipsec key ipsec0 local crypto aes-cbc-128 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 remote crypto aes-cbc-128 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 local integ sha1-96 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 remote integ sha1-96 4339314b55523947594d6d3547666b45
 
ip route add 90.10.40.0/24 via 10.10.10.2 ipsec0
set interface unnumbered ipsec0 use GigabitEthernet4/0/3
set ip arp GigabitEthernet4/0/3 10.10.10.2 00:0b:ab:f6:b3:66
 
set ip arp GigabitEthernet4/0/2 90.10.10.100 00:0b:ab:f5:a9:70
ip route add 90.10.10.0/24 via GigabitEthernet4/0/2
 
set int state GigabitEthernet4/0/2 up
set int state GigabitEthernet4/0/3 up
set int state ipsec0 up
 
#配置右边vpp
set int ip address GigabitEthernet4/0/2 90.10.30.2/24
set int promiscuous on GigabitEthernet4/0/2
set int ip address GigabitEthernet4/0/3 10.10.10.2/24
set int promiscuous on GigabitEthernet4/0/3
 
create ipsec tunnel local-ip 10.10.10.2 local-spi 1030 remote-ip 10.10.10.1 remote-spi 1031
set interface ipsec key ipsec0 local crypto aes-cbc-128 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 remote crypto aes-cbc-128 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 local integ sha1-96 4339314b55523947594d6d3547666b45
set interface ipsec key ipsec0 remote integ sha1-96 4339314b55523947594d6d3547666b45
 
ip route add 90.10.10.0/24 via 10.10.10.1 ipsec0
set interface unnumbered ipsec0 use GigabitEthernet4/0/3
set ip arp GigabitEthernet4/0/3 10.10.10.1 74:fe:48:09:3c:cb
 
set ip arp GigabitEthernet4/0/2 90.10.40.100 00:0b:ab:f5:a9:71
ip route add 90.10.40.0/24 via ipsec0 GigabitEthernet4/0/2
 
set int state GigabitEthernet4/0/2 up
set int state GigabitEthernet4/0/3 up
set int state ipsec0 up

搭建vxlan隧道

拓扑如下：

# 左边vpp配置
create vxlan tunnel src 90.10.20.3 dst 90.10.30.3 vni 13 decap-next l2
set interface l2 bridge vxlan_tunnel0 13 1
loopback create mac 11:12:13:14:15:16
set interface l2 bridge loop0 13 bvi
set interface state loop0 up
set interface ip address loop0 10.10.10.1/24
set interface state GigabitEthernetd/0/0 up
set interface ip address GigabitEthernetd/0/0 90.10.20.3/24
set interface state GigabitEthernete/0/0 up
set interface l2 bridge GigabitEthernete/0/0 13 0
ip route add 90.10.30.0/24 via 90.10.20.1


右边vpp配置
create vxlan tunnel src 90.10.30.3 dst 90.10.20.3 vni 13 decap-next l2
set interface l2 bridge vxlan_tunnel0 13 1
loopback create mac 1a:2b:3c:4d:5e:6f
set interface l2 bridge loop0 13 bvi
set interface state loop0 up
set interface ip address loop0 10.10.10.7/24
set interface state GigabitEthernetd/0/0 up
set int ip address GigabitEthernetd/0/0 90.10.30.3/24
set interface state GigabitEthernete/0/0 up
set interface l2 bridge GigabitEthernete/0/0 13 0
ip route add 90.10.20.0/24 via 90.10.30.1

搭建vxlan_over_ipsec隧道

拓扑如下：

vpp1:

set interface state GigabitEthernetd/0/0 up
set interface ip address GigabitEthernetd/0/0 90.10.20.3/24
ikev2 profile add pr1  
ikev2 profile set pr1 auth shared-key-mic string Vpp123 
ikev2 profile set pr1 id local fqdn vpp1.home 
ikev2 profile set pr1 id remote fqdn vpp2.home
ikev2 profile set pr1 responder GigabitEthernetd/0/0 90.10.20.5
ikev2 profile set pr1 ike-crypto-alg aes-cbc 128 ike-integ-alg sha1-96 ike-dh modp-1024 
ikev2 profile set pr1 esp-crypto-alg aes-cbc 128 esp-integ-alg sha1-96 esp-dh modp-1024
ikev2 profile set pr1 traffic-selector local ip-range 90.10.10.0 - 90.10.10.200 port-range 0 - 65535 protocol 0 
ikev2 profile set pr1 traffic-selector remote ip-range 90.10.40.0 - 90.10.40.200 port-range 0 - 65535 protocol 0
ikev2 initiate sa-init pr1

create vxlan tunnel src 90.10.10.1 dst 90.10.40.1 vni 13 decap-next l2
set interface l2 bridge vxlan_tunnel0 13
set interface state GigabitEthernete/0/0 up
set interface l2 bridge GigabitEthernete/0/0 13
loopback create mac 11:12:13:14:15:17
set interface state loop0 up
set interface ip address loop0 90.10.10.1/24

set int state ipsec0 up 
ip route add 90.10.40.0/24 via ipsec0
set int unnumbered ipsec0 use GigabitEthernetd/0/0






vpp2:
set interface state GigabitEthernetd/0/0 up
set interface ip address GigabitEthernetd/0/0 90.10.20.5/24
ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123 
ikev2 profile set pr1 id local fqdn vpp2.home 
ikev2 profile set pr1 id remote fqdn vpp1.home
ikev2 profile set pr1 traffic-selector local ip-range 90.10.40.0 - 90.10.40.200 port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range 90.10.10.0 - 90.10.10.200 port-range 0 - 65535 protocol 0

create vxlan tunnel src 90.10.40.1 dst 90.10.10.1 vni 13 decap-next l2
set interface l2 bridge vxlan_tunnel0 13
set interface state GigabitEthernete/0/0 up
set interface l2 bridge GigabitEthernete/0/0 13
loopback create mac 1a:2b:3c:4d:5e:6g
set interface state loop0 up
set interface ip address loop0 90.10.40.1/24

set int state ipsec0 up 
ip route add 90.10.10.0/24 via ipsec0
set int unnumbered ipsec0 use GigabitEthernetd/0/0