Flex ikev2

底层

R1
int g0/0
ip add 172.16.13.1 255.255.255.0
int g0/1
ip add 202.100.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 202.100.1.100
ip route 192.168.3.0 255.255.255.0 172.16.13.3

R2
int g0/0 
ip add 61.128.1.2 255.255.255.0
int lo 0
ip add 192.168.2.2 255.255.255.0

ip route 0.0.0.0 0.0.0.0 61.128.1.100

R3
int g0/0
ip add 172.16.13.3 255.255.255.0
int lo 0
ip add 192.168.3.3 255.255.255.0

ip route 0.0.0.0 0.0.0.0 172.16.13.1

switch

vlan 100,200
exit

int g0/1
sw mo ac
sw ac vlan 100

int g0/0
sw mo ac
sw ac vlan 200

int vlan 100
ip add 202.100.1.100 255.255.255.0
no sh

int vlan 200
ip add 61.128.1.100 255.255.255.0
no sh

IKEv2 配置的四大组件

proposal 提议 用于协商sa的参数   类似与ikev1 policy

policy 指定用于协商的proposal       // proposal,policy 有默认配置，满足大多数场合

keyring  预共享密钥/证书 被ikev2 profile调用  和v1各自独立

profile  双端认证方式

建立proposal,policy

R1
crypto ikev2 proposal v2
int sha256
encr aes-cbc-128
group 5

crypto ikev2 policy V2
match add local 202.100.1.1
proposal v2

 红框内是手动配置的，非红框 default是默认配置

R2
crypto ikev2 proposal v2
int sha256
encr aes-cbc-128
group 5

crypto ikev2 policy V2
match add local 61.128.1.2
proposal v2

建立keyring，profile

R1

crypto ikev2 keyring kr
peer r2            本地有效,名字随便取
address 61.128.1.2
pre-shared-key cisco123

crypto ikev2 profile V2P
match identity remote address 61.128.1.2 255.255.255.255  对端ip
authentication local pre-share        本地认证=对端的remote
authentication remote pre-share       对端认证=对端的local
keyring local kr            绑keyring 

R2

crypto ikev2 keyring kr
peer r1            本地有效,名字随便取
address 202.100.1.1
pre-shared-key cisco123

crypto ikev2 profile V2P
match identity remote address 202.100.1.1 255.255.255.255  对端ip
authentication local pre-share        本地认证=对端的remote
authentication remote pre-share       对端认证=对端的local
keyring local kr            绑keyring 

建立感兴趣流，ipsec sa

R1
crypto ipsec transform-set TS esp-3des esp-md5-hmac

ip access-list extend ACL
per ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
per ip 172.16.13.0 0.0.0.255 192.168.2.0 0.0.0.255

R2
crypto ipsec transform-set TS esp-3des esp-md5-hmac

ip access-list extend ACL
per ip  192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
per ip  192.168.2.0 0.0.0.255 172.16.13.0 0.0.0.255

捆绑进map，端口应用

R1

crypto map CMAP 10 ipsec-isakmp
set peer 61.128.1.2
set transform-set TS
set ikev2-profile P2V   不敲就是ikev1,profile白搞
match address ACL

int g0/1
crypto map CMAP

R2

crypto map CMAP 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set TS
set ikev2-profile P2V   
match address ACL

int g0/0
crypto map CMAP

ping一下，让SA生效

 show r1