锐捷网络—VPN功能—IPSEC 扩展配置—IPSec 多感兴趣流配置

目录

功能介绍

一、组网需求

二、组网拓扑

三、配置要点

四、配置步骤

五、配置验证

六、附录

---

 

功能介绍

在某些情况下，通过需要通过IPSEC VPN加密的数据，其源或目的地址为多个不同的网段，此时就在配置IPSEC感兴趣流时就需要将所有的网段都定义进来，这就是IPSEC多感兴趣流。

一、组网需求

分支1存在192.168.1.0/24、172.18.0.0/24、172.18.1.0/24这3个网段，这3个网段都需要访问总部的192.168.0.0/24，并且互访的数据需要通过IPSEC VPN进行加密。

二、组网拓扑

三、配置要点

1、配置基本的IPSEC功能

2、在分支1上配置IPSEC多感兴趣流

注意：

RSR10/20 10.3(5b6)之前的版本、RSR30 10.4(3b11)之前的版本、RSR50/RSR50E的多感兴趣流配置方法与本文提供的配置方法不同，具体请参考附录。

四、配置步骤

1、配置基本的IPSEC功能

根据现场环境及客户需求，选择合适的IPSEC部署方案，详细配置参考IPSEC“基础配置”章节（典型配置--->安全--->IPSEC--->基础配置）

2、在分支1上配置IPSEC多感兴趣流

多感兴趣流的配置与单感兴趣流的配置唯一不同之处，就是在配置感兴趣流的ACL时，将所有网段的流量定义进去：

ip access-list extended 101

    10 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

    20 permit ip 172.18.0.0 0.0.0.255 192.168.0.0 0.0.0.255

    30 permit ip 172.18.1.0 0.0.0.255 192.168.0.0 0.0.0.255

五、配置验证

完成配置后，在分支1上发起感兴趣流触发IPSEC协商成功后，可以看到分支1与总部间协商成功了多个ipsec sa，每个ipsec sa对应着1对感兴趣流：

site1#ping 192.168.0.1 so 192.168.1.1

Sending 5, 100-byte ICMP Echoes to 192.168.0.1, timeout is 2 seconds:

  < press Ctrl+C to break>

.!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/8/10 ms

site1#ping 192.168.0.1 so 172.18.0.1

Sending 5, 100-byte ICMP Echoes to 192.168.0.1, timeout is 2 seconds:

  < press Ctrl+C to break>

.!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/8/10 ms

site1#ping 192.168.0.1 so 172.18.1.1

Sending 5, 100-byte ICMP Echoes to 192.168.0.1, timeout is 2 seconds:

  < press Ctrl+C to break>

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 10/15/20 ms

site1#show crypto isakmp sa

 destination       source            state                    conn-id           lifetime(second)

 10.0.0.1          10.0.0.2          IKE_IDLE                 0                 86192                //生成1个isakmp sa

site1#show crypto ipsec sa

Interface: FastEthernet 0/0

         Crypto map tag:mymap

  local ipv4 addr 10.0.0.2

         media mtu 1500

         ==================================

         sub_map type:static, seqno:10, id=3

         local  ident (addr/mask/prot/port): (192.168.1.0/0.0.0.255/0/0))

         remote  ident (addr/mask/prot/port): (192.168.0.0/0.0.0.255/0/0))      //针对第1条感兴趣流生成的ipsec sa

         PERMIT

         #pkts encaps: 9, #pkts encrypt: 9, #pkts digest 0

         #pkts decaps: 9, #pkts decrypt: 9, #pkts verify 0

         #send errors 1, #recv errors 0

         Inbound esp sas:

              spi:0x4b8e642c (1267622956)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606997/3388)

               IV size: 8 bytes

               Replay detection support:N

         Outbound esp sas:

              spi:0x36ee6e8e (921595534)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606997/3388)

               IV size: 8 bytes

               Replay detection support:N

         ==================================

         sub_map type:static, seqno:10, id=4

         local  ident (addr/mask/prot/port): (172.18.0.0/0.0.0.255/0/0))

         remote  ident (addr/mask/prot/port): (192.168.0.0/0.0.0.255/0/0))   //针对第2条感兴趣流生成的ipsec sa

         PERMIT

         #pkts encaps: 14, #pkts encrypt: 14, #pkts digest 0

         #pkts decaps: 14, #pkts decrypt: 14, #pkts verify 0

         #send errors 1, #recv errors 0

         Inbound esp sas:

              spi:0x1cdd2b74 (484256628)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606996/3437)

               IV size: 8 bytes

               Replay detection support:N

         Outbound esp sas:

              spi:0x62a1a190 (1654759824)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606996/3437)

               IV size: 8 bytes

               Replay detection support:N

         ==================================

         sub_map type:static, seqno:10, id=5

         local  ident (addr/mask/prot/port): (172.18.1.0/0.0.0.255/0/0))

         remote  ident (addr/mask/prot/port): (192.168.0.0/0.0.0.255/0/0))  //针对第3条感兴趣流生成的ipsec sa

         PERMIT

         #pkts encaps: 4, #pkts encrypt: 4, #pkts digest 0

         #pkts decaps: 4, #pkts decrypt: 4, #pkts verify 0

         #send errors 1, #recv errors 0

         Inbound esp sas:

              spi:0x1b614775 (459360117)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606998/3556)

               IV size: 8 bytes

               Replay detection support:N

         Outbound esp sas:

              spi:0x390bcf20 (957075232)

               transform: esp-3des

               in use settings={Tunnel Encaps,}

               crypto map mymap 10

               sa timing: remaining key lifetime (k/sec): (4606998/3556)

               IV size: 8 bytes

               Replay detection support:N

六、附录

1、老版本多感兴趣流的配置方法

注：老版本包括RSR10/20 10.3(5b6)之前的版本、RSR30 10.4(3b11)之前的版本、RSR50/RSR50E