实验场景:搭建ipsec vpn实验环境
实验要求:pc1、pc2通过ipsec隧道完成访问
实验拓扑如下:
1.fw1、fw2的ip、区域配置
Fw1:
int g1/0/0
ip address 10.1.1.1 24
service-manage ping permit //测试ping命令用
int g1/0/1
ip address 20.1.1.1 24
service-manage ping permit
firewall zone trust
add interface GigabitEthernet1/0/0
firewall zone untrust
add interface GigabitEthernet1/0/1
FW2:
int g1/0/0
ip address 10.1.2.1 24
service-manage ping permit
int g1/0/1
ip address 30.1.1.1 24
service-manage ping permit
firewall zone trust
add interface GigabitEthernet1/0/0
firewall zone untrust
add interface GigabitEthernet1/0/1
AR1:
int g0/0/0
ip add 20.1.1.2 24
int g0/0/1
ip add 30.1.1.2 24
确认ip配置正确:
安全策略:
//配置来回区域和ip的业务
FW1:
security-policy
rule name ye
source-zone trust untrust
destination-zone trust untrust
source-address 10.1.1.0 24
source-address 10.1.2.0 24
destination-address 10.1.1.0 24
destination-address 10.1.2.0 24
action permit
//配置来回区间的ike协议协商
rule name xie
source-zone local untrust
destination-zone local untrust
source-address 20.1.1.0 24
source-address 30.1.1.0 24
destination-address 20.1.1.0 24
destination-address 30.1.1.0 24
action permit
FW2://和FW1一样,配置是对称的
security-policy
rule name ye
source-zone trust untrust
destination-zone trust untrust
source-address 10.1.1.0 24
source-address 10.1.2.0 24
destination-address 10.1.1.0 24
destination-address 10.1.2.0 24
action permit
rule name xie
source-zone local untrust
destination-zone local untrust
source-address 20.1.1.0 24
source-address 30.1.1.0 24
destination-address 20.1.1.0 24
destination-address 30.1.1.0 24
action permit
2.感兴趣流:(一般用高级acl,写源、目的端口)
FW1:
acl 3000
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
3.ike协商,命名为10,采用默认协商
ike proposal 10
//默认协商如下图:
4.ike对等体:(peer)
ike peer fw2
pre-shared-key 1234
ike-proposal 10
remote-address 30.1.1.1
5.ipsec proposal 10
默认配置如下:
只有认证界面和加密算法(esp隧道模式)
6.ipsec策略
ipsec policy pp 10 isakmp
(pp是策略名,10是优先级序列号,isakmp是策略的方式(manual是手动配置)
调用ike peer、感兴趣流(acl)和proposal,ike的proposal已经封装在peer里了,无需重复封装。
在应用到出接口的流量后,匹配acl的流量就会交给ipsec隧道的封装。
ipsec policy pp 10 isakmp
security acl 3000
ike-peer fw2
proposal 10
7.应用
Int g0/0/1
Ipsec policy pp
FW2的配置大同小异:
rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
ike proposal 10
q
ike peer fw1
pre-shared-key 1234
ike-proposal 10
remote-address 20.1.1.1
ipsec proposal 10
q
ipsec policy pp 10 isakmp
security acl 3000
ike-peer fw1
proposal 10
q
Int g0/0/1
Ipsec policy pp
写路由
[fw1]ip route-static 0.0.0.0 0 20.1.1.2
[FW2]ip route-static 0.0.0.0 0 30.1.1.2
此时是没有数据流信息的,需要触发后才能有
Pc2上pingPc1成功
Display firewall se table
Disp ipsec sa
Disp ike sa结果分别如上截图,实验成功。