华为IPsce以及GRE over IPSec配置练习
一、拓扑以及需求
某公司核心网络拓扑如下。其中PC1、PC2为财务部门;PC3、PC4为技术部门。为使数据更加安全,现需要对数据进行加密。
需求加密1:PC3与PC4的通信数据。
需求加密2:通过GRE隧道的通信数据。
主要地址说明:
接口地址:10.0.x,y
x:路由器编号从小到大;y:路由器编号小为1,大为2
PC1:10.1.1.2 网关:10.1.1.1
PC2:10.1.2.2 网关:10.1.2.1
PC3:10.0.3.2 网关:10.0.3.1
PC4:10.0.4.2 网关:10.0.4.1
二、配置思路
(1)打通核心层
核心层我起了ospf协议,配置这里不多做赘述,有需要可前往华为OSPF配置练习学习。以R2为例,邻居表如下:
(2)利用GRE将PC1、PC2逻辑上连接起来
在R1,R4设备上起GRE三层逻辑通道,简易配置如下:
R1配置:
[r1]interface Tunnel0/0/0
[r1-Tunnel0/0/0]ip address 10.0.14.1 255.255.255.0
[r1-Tunnel0/0/0]tunnel-protocol gre
[r1-Tunnel0/0/0]source 10.0.12.1
[r1-Tunnel0/0/0]destination 10.0.34.2
R4配置:
[r4]interface Tunnel0/0/0
[r4-Tunnel0/0/0]ip address 10.0.14.2 255.255.255.0
[r4-Tunnel0/0/0]tunnel-protocol gre
[r4-Tunnel0/0/0]source 10.0.34.2
[r4-Tunnel0/0/0]destination 10.0.12.1
#
打通以后,我起了rip。
到此,拓扑中PC1-PC2;PC3-PC4均可通信:
PC1-PC2
PC3-PC4
(3)需求加密1:加密PC3与PC4的通信数据。
此需求我们需要在R2、R3上配置,配置如下:
R2配置:
· 抓取加密流量
[R2]acl 3000
[R2-acl-adv-3000]rule 5 permit ip source 10.0.3.0 0.0.0.255 destination 10.0.4.0 0.0.0.255
· 创建ipsec的安全提议
[R2]ipsec proposal R2
[R2-ipsec-proposal-R2]quit
[R2]display ipsec proposal name R2 //查看proposal一下
· 创建安全策略
[R2]ipsec policy map 10 manual //创建手动安全策略zhpr 10
[R2-ipsec-policy-manual-map-10]security acl 3000 //调用acl
[R2-ipsec-policy-manual-map-10]proposal R2 //调用安全提议
[R2-ipsec-policy-manual-map-10]tunnel local 10.0.23.1 //指定隧道源地址
[R2-ipsec-policy-manual-map-10]tunnel remote 10.0.23.2 //指定隧道目标地址
[R2-ipsec-policy-manual-map-10]sa spi inbound esp 123456 //设置安全联盟的安全索引SPI
[R2-ipsec-policy-manual-map-10]sa string-key inbound esp simple 234567 //设置安全联盟的认证密钥
[R2-ipsec-policy-manual-map-10]sa spi outbound esp 123456
[R2-ipsec-policy-manual-map-10]sa string-key outbound esp simple 234567
· 接口下调用policy策略
[R2]interface GigabitEthernet0/0/2 //公网出口
[R2-GigabitEthernet0/0/2]ipsec policy map
[R2]dis ipsec policy brief //查看ipsec接口信息
注意:
sa spi inbound esp 123456要和对端的outbound保持一致。
sa string-key inbound esp simple 234567要和对端的outbound保持一致。
R3配置与此相似:
R3配置如下:
· 抓取加密流量
[R3]acl 3000
[R3-acl-adv-3000]rule 5 permit ip source 10.0.4.0 0.0.0.255 destination 10.0.3.0 0.0.0.255
· 创建ipsec的安全提议
[R3]ipsec proposal R3
[R3-ipsec-proposal-R3]quit
· 创建安全策略
[R3]ipsec policy map 10 manual
[R3-ipsec-policy-manual-map-10] security acl 3000
[R3-ipsec-policy-manual-map-10] proposal r3
[R3-ipsec-policy-manual-map-10] tunnel local 10.0.23.2
[R3-ipsec-policy-manual-map-10] tunnel remote 10.0.23.1
[R3-ipsec-policy-manual-map-10] sa spi inbound esp 123456
[R3-ipsec-policy-manual-map-10] sa string-key inbound esp simple 234567
[R3-ipsec-policy-manual-map-10] sa spi outbound esp 123456
[R3-ipsec-policy-manual-map-10] sa string-key outbound esp simple 234567
· 接口下调用policy策略
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2]ipsec policy map
(4)需求加密2:加密通过GRE隧道的通信数据。
此需求我们需要在R1、R4上配置,配置如下:
R1配置:
· 配置安全提议
[R1]ipsec proposal R1
[R1-ipsec-proposal-tran1]quit
· 配置IKE提议
[R1]ike proposal 5
[R1-ike-proposal-5]encryption-algorithm aes-cbc-128
[R1-ike-proposal-5]authentication-algorithm sha1
[R1-ike-proposal-5]quit
· 配置IKE对等体及其使用协议
[R1]ike peer R1 v2
[R1-ike-peer-R1]pre-shared-key cipher 123456
[R1-ike-peer-R1]ike-proposal 5
[R1-ike-peer-R1]quit
· 配置安全框架
[R1]ipsec profile map
[R1-ipsec-profile-map]ike-peer R1
[R1-ipsec-profile-map]proposal R1
[R1-ipsec-profile-map]quit
· 配置IPSec Tunnel接口
[R1]int tunnel0/0/1
[R1-Tunnel0/0/1]ip address 10.0.0.1 24
[R1-Tunnel0/0/1]tunnel-protocol ipsec
[R1-Tunnel0/0/1]source tunnel0/0/0 //指定Tunnel源接口为GRE Tunnel接口
[R1-Tunnel0/0/1]destination 10.0.14.2 //指定Tunnel的目的地址为GRE Tunnel地址
[R1-Tunnel0/0/1]ipsec profile map
R4配置:
· 配置安全提议
[R4]ipsec proposal R4
[R4-ipsec-proposal-tran1]quit
· 配置IKE提议
[R4]ike proposal 5
[R4-ike-proposal-5]encryption-algorithm aes-cbc-128
[R4-ike-proposal-5]authentication-algorithm sha1
[R4-ike-proposal-5]quit
· 配置IKE对等体及其使用协议
[R4]ike peer R4 v2
[R4-ike-peer-R1]pre-shared-key cipher 123456
[R4-ike-peer-R1]ike-proposal 5
[R4-ike-peer-R1]quit
· 配置安全框架
[R4]ipsec profile map
[R4-ipsec-profile-map]ike-peer R4
[R4-ipsec-profile-map]proposal R4
[R4-ipsec-profile-map]quit
· 配置IPSec Tunnel接口
[R4]int tunnel0/0/1
[R4-Tunnel0/0/1]ip address 10.0.0.1 24
[R4-Tunnel0/0/1]tunnel-protocol ipsec
[R4-Tunnel0/0/1]source tunnel0/0/0 //指定Tunnel源接口为GRE Tunnel接口
[R4-Tunnel0/0/1]destination 10.0.14.1 //指定Tunnel的目的地址为GRE Tunnel地址
[R4-Tunnel0/0/1]ipsec profile map
(5)验证连通性
PC1-PC2
PC3-PC4
三、完整配置
(1)R1
R1完整配置如下:
[r1]display current-configuration
[V200R003C00]
#
sysname r1
#
ipsec proposal r1
#
ike proposal 5
encryption-algorithm aes-cbc-128
#
ike peer r1 v2
pre-shared-key cipher %$%${"@cGFyLlVmL@4G,4=J.,.2n%$%$
ike-proposal 5
#
ipsec profile map
ike-peer r1
proposal r1
#
interface GigabitEthernet0/0/0
ip address 10.0.12.1 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 10.1.1.1 255.255.255.0
#
interface Tunnel0/0/0
ip address 10.0.14.1 255.255.255.0
tunnel-protocol gre
source 10.0.12.1
destination 10.0.34.2
#
interface Tunnel0/0/1
ip address 10.0.0.1 255.255.255.0
tunnel-protocol ipsec
source Tunnel0/0/0
destination 10.0.14.2
ipsec profile map
#
ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 10.0.12.1 0.0.0.0
#
rip 1
undo summary
version 2
network 10.0.0.0
(2)R2
R2配置如下:
[r2]display current-configuration
[V200R003C00]
#
sysname r2
#
acl number 3000
rule 5 permit ip source 10.0.3.0 0.0.0.255 destination 10.0.4.0 0.0.0.255
#
ipsec proposal r2
#
ipsec policy map 10 manual
security acl 3000
proposal r2
tunnel local 10.0.23.1
tunnel remote 10.0.23.2
sa spi inbound esp 123456
sa string-key inbound esp simple 234567
sa spi outbound esp 123456
sa string-key outbound esp simple 234567
#
interface GigabitEthernet0/0/0
ip address 10.0.12.2 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 10.0.3.1 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 10.0.23.1 255.255.255.0
ipsec policy map
#
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 10.0.0.0 0.0.255.255
return
(3)R3
R3配置如下:
[r3]display current-configuration
[V200R003C00]
#
sysname r3
#
acl number 3000
rule 5 permit ip source 10.0.4.0 0.0.0.255 destination 10.0.3.0 0.0.0.255
#
ipsec proposal r3
#
ipsec policy map 10 manual
security acl 3000
proposal r3
tunnel local 10.0.23.2
tunnel remote 10.0.23.1
sa spi inbound esp 123456
sa string-key inbound esp simple 234567
sa spi outbound esp 123456
sa string-key outbound esp simple 234567
#
interface GigabitEthernet0/0/0
ip address 10.0.34.1 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 10.0.4.1 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
ipsec policy map
#
ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 10.0.0.0 0.0.255.255
(4)R4
R4配置如下:
[r4]display current-configuration
[V200R003C00]
#
sysname r4
#
ipsec proposal r4
#
ike proposal 5
encryption-algorithm aes-cbc-128
#
ike peer r4 v2
pre-shared-key cipher %$%${"@cGFyLlVmL@4G,4=J.,.2n%$%$
ike-proposal 5
#
ipsec profile map
ike-peer r4
proposal r4
#
interface GigabitEthernet0/0/0
ip address 10.0.34.2 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 10.1.2.1 255.255.255.0
#
interface Tunnel0/0/0
ip address 10.0.14.2 255.255.255.0
tunnel-protocol gre
source 10.0.34.2
destination 10.0.12.1
#
interface Tunnel0/0/1
destination 10.0.14.1
ip address 10.0.0.2 255.255.255.0
tunnel-protocol ipsec
source Tunnel0/0/0
ipsec profile map
#
ospf 1 router-id 4.4.4.4
area 0.0.0.0
network 10.0.34.2 0.0.0.0
#
rip 1
undo summary
version 2
network 10.0.0.0
到此,IPsec与IPsec+GRE配置完成且验证通过。