底层
R1
int g0/0
ip add 172.16.13.1 255.255.255.0
int g0/1
ip add 202.100.1.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 202.100.1.100
ip route 192.168.3.0 255.255.255.0 172.16.13.3
R2
int g0/0
ip add 61.128.1.2 255.255.255.0
int lo 0
ip add 192.168.2.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 61.128.1.100
R3
int g0/0
ip add 172.16.13.3 255.255.255.0
int lo 0
ip add 192.168.3.3 255.255.255.0
ip route 0.0.0.0 0.0.0.0 172.16.13.1
switch
vlan 100,200
exit
int g0/1
sw mo ac
sw ac vlan 100
int g0/0
sw mo ac
sw ac vlan 200
int vlan 100
ip add 202.100.1.100 255.255.255.0
no sh
int vlan 200
ip add 61.128.1.100 255.255.255.0
no sh
IKEv2 配置的四大组件
proposal 提议 用于协商sa的参数 类似与ikev1 policy
policy 指定用于协商的proposal // proposal,policy 有默认配置,满足大多数场合
keyring 预共享密钥/证书 被ikev2 profile调用 和v1各自独立
profile 双端认证方式
建立proposal,policy
R1
crypto ikev2 proposal v2
int sha256
encr aes-cbc-128
group 5
crypto ikev2 policy V2
match add local 202.100.1.1
proposal v2
红框内是手动配置的,非红框 default是默认配置
R2
crypto ikev2 proposal v2
int sha256
encr aes-cbc-128
group 5
crypto ikev2 policy V2
match add local 61.128.1.2
proposal v2
建立keyring,profile
R1
crypto ikev2 keyring kr
peer r2 本地有效,名字随便取
address 61.128.1.2
pre-shared-key cisco123
crypto ikev2 profile V2P
match identity remote address 61.128.1.2 255.255.255.255 对端ip
authentication local pre-share 本地认证=对端的remote
authentication remote pre-share 对端认证=对端的local
keyring local kr 绑keyring
R2
crypto ikev2 keyring kr
peer r1 本地有效,名字随便取
address 202.100.1.1
pre-shared-key cisco123
crypto ikev2 profile V2P
match identity remote address 202.100.1.1 255.255.255.255 对端ip
authentication local pre-share 本地认证=对端的remote
authentication remote pre-share 对端认证=对端的local
keyring local kr 绑keyring
建立感兴趣流,ipsec sa
R1
crypto ipsec transform-set TS esp-3des esp-md5-hmac
ip access-list extend ACL
per ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
per ip 172.16.13.0 0.0.0.255 192.168.2.0 0.0.0.255
R2
crypto ipsec transform-set TS esp-3des esp-md5-hmac
ip access-list extend ACL
per ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
per ip 192.168.2.0 0.0.0.255 172.16.13.0 0.0.0.255
捆绑进map,端口应用
R1
crypto map CMAP 10 ipsec-isakmp
set peer 61.128.1.2
set transform-set TS
set ikev2-profile P2V 不敲就是ikev1,profile白搞
match address ACL
int g0/1
crypto map CMAP
R2
crypto map CMAP 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set TS
set ikev2-profile P2V
match address ACL
int g0/0
crypto map CMAP
ping一下,让SA生效
show r1