CISCO IPsec VPN配置大全.docx

1、CISCO IPsec VPN配置大全CISCO IPsec VPN配置大全红头发(aka CCIE#15101), ?3 x* x/ ?6 i7 r.91lab.% F/ G, i: 5 i2 F5 _.91lab.4 K: R/ cH: r+ B( G7 ! e.91lab.一.基于PSK的IPsec VPN配置Z2 U+ n8 ?, v* R y首先IOS带k的就可以了,支持加密特性,拓扑如下:6 h: r4 ?, O0 g% n/ m纽爱科网络实验室社区topo.jpg (57.02 KB)2008-10-11 20:147 / D b+ Sx g+ _, p1.R1基本配置:3 r#

2、 k, ! 2 u R1(config)#interface loopback0/ P$ Q; w8 V% b) 4 w! O.91lab.R1(config-if)#ip address 10.1.1.1 255.255.255.0R1(config-if)#no shutdownR1(config-if)#interface serial0/0# s, l a3 ! d1 P% _* n# i_.91lab.R1(config-if)#ip address192.168.1.1 255.255.255.252R1(config-if)#clock rate 56000, H2 w6 x/

3、q4 n) mR1(config-if)#no shutdownR1(config-if)#exit8 & + R) y2 Y. / q# g* W2.定义感兴趣流量与路由协议:, R7 r# . p t; f- CR1(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.2558 S- M X- A- # D/ lR1(config)#ip route 0.0.0.0 0.0.0.0 serial0/05 J3 w. i3 R1 ( q3.全局启用ISAKMP并定义对等体及其PSK(预共享密钥):R1(con

4、fig)#crypto isakmp enable R1(config)#crypto isakmp key 91lab address 192.168.1.2 t6 Y?; z! 0 A( V! J# l4.定义IKE策略:9 h4 n/ e/ N g( k7 g! 0 O.91lab.R1(config)#crypto isakmp policy 10R1(config-isakmp)#encryption aes 128 /-默认是DES加密-/R1(config-isakmp)#hash sha /-默认是SHA-1-/) s( - m/ r% X1 w7 H纽爱科网络实验室社区R1(

5、config-isakmp)#authentication pre-share R1(config-isakmp)#group 2 /-默认是768位的DH1-/) J a9 z0 U9 W9 h yR1(config-isakmp)#lifetime 3600 /-默认是86400秒-/R1(config-isakmp)#exit0 x: G4 P. b5 X- _! .91lab.5.定义IPSec转换集(transform set):R1(config)#crypto ipsec transform-set tt esp-aes 128 esp-sha-hmac $ y1 6 i! ;

6、+ b+ PR1(cfg-crypto-trans)#mode tunnel 6 x O( 6 F/ gR1(cfg-crypto-trans)#exit* O0 v! n1 |2 n$ F - % n纽爱科网络实验室社区6.定义crypto map并应用在接口上:3 CHQ# m+ P! a: % W2 q* CR1(config)#crypto map cisco 10 ipsec-isakmp 9 N$ ?2 p# R, Q6 J; DR1(config-crypto-map)#match address 100 X+ w8 p* Z( a3 7 u% uR1(config-crypto

7、-map)#set peer 192.168.1.2 /-定义要应用crypto map的对等体地址-/; Y+ o% D: X+ ?# O9 M1 ?# sR1(config-crypto-map)#set transform-set tt /-定义crypto map要应用的IPsec转换集-/2 F! _9 s7 z- o. HR1(config-crypto-map)#exit# t+ j: v1 e$ A. b0 M+ z.91lab.R1(config)#interface serial0/0R1(config-if)#crypto map cisco/ S O4 9 d& u W

8、& D( _3 F. m4 W& t4 T* ?E* M k* j*Mar1 00:08:31.131: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON, W. ?/ f, Nv2 A5 lR1(config-if)#endR1#R1配置完成.2 U. v& Y- x( N( E d3 Y3 k.91lab.0 j( S3 ?% B7 z. r同理,R2相关配置如下:! ; * W& D5 I( 纽爱科网络实验室社区!crypto isakmp policy 10encr aesauthentication pre-sharegroup 2z$ Y% X0 H- v

9、* pcrypto isakmp key 91lab address 192.168.1.1!crypto ipsec transform-set tt esp-aes esp-sha-hmac & : d9 ! N/ |0 Z* J7 r9 H!crypto map cisco 10 ipsec-isakmp set peer 192.168.1.1set transform-set tt % q N+ P! ? F; M* x- xmatch address 100!interface Loopback08 q$ Q$ t/ A q. i/ a1 Z纽爱科网络实验室社区ip address

10、 10.2.2.1 255.255.255.02 _8 ( g+ r, t+ m; n+ h# x# u.91lab.!interface Serial0/0* k6 J) d& q9 s- k3 ?6 4 Q Z) Uip address 192.168.1.2 255.255.255.252- R. V8 hT0 1 crypto map cisco!( 0 U6 p# G4 i3 Nip route 0.0.0.0 0.0.0.0 Serial0/09 S; 9 T* h- q, Q( F# r1 T!* U: $ c, I6 S! I纽爱科网络实验室社区access-list 100

11、permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255!二.采用积极模式并PSK的IPsec VPN配置3 |9 h6 W8 h7 Y7 9 uZ) k! P3 / X4 c4 $ ?纽爱科网络实验室社区1.R1基本配置:R1(config)#interface loopback0R1(config-if)#ip address 10.1.1.1 255.255.255.0R1(config-if)#no shutdownR1(config-if)#interface serial0/03 a0 ?4 d/ K5 D # L6 ; u& s, _R1(c

12、onfig-if)#ip address192.168.1.1 255.255.255.252R1(config-if)#clock rate 56000* K, R4 P; ?# ?8 F3 IR1(config-if)#no shutdown. V$ ! I( 7 f# B. O- R1(config-if)#exit9 p V! a* Q; d5 f( / _2 2 b3 X, + Q8 r2.定义感兴趣流量与路由协议:( 3 C ; a1 p$ Z$ E3 v+ c& vR1(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 10

13、.2.2.0 0.0.0.255/ 0 _$ z) g8 i S# BR1(config)#ip route 0.0.0.0 0.0.0.0 serial0/00 a. m/ h- df u7 F纽爱科网络实验室社区; u/ H, Z1 Y5 n7 I4 v9 Y纽爱科网络实验室社区3.全局启用ISAKMP并定义对等体及其PSK(预共享密钥),采用积极模式:& G. O( D2 i+ F) .91lab.R1(config)#crypto isakmp enable R1(config)#crypto isakmp peer address 192.168.1.27 # n1 v % G$ K

14、4 t3 FR1(config-isakmp-peer)#set aggressive-mode client-endpoint ipv4-address 192.168.1.1 ( F0 C* k7 b8 H! + t.91lab.R1(config-isakmp-peer)#set aggressive-mode password 91lab5 J2 p. t4 k% k8 k) Y1 c, w7 r* G4.定义IKE策略:; D& A- b4 f: N) f- ?0 J. _. j- q.91lab.R1(config)#crypto isakmp policy 10R1(config

15、-isakmp)#encryption aes 128 /-默认是DES加密-/6 K1 B& Q# e g) Y- r8 z A7 S9 RR1(config-isakmp)#hash sha /-默认是SHA-1-/+ K$ w: N. L9 b1 kR1(config-isakmp)#authentication pre-share R1(config-isakmp)#group 2 /-默认是768位的DH1-/: p. P: y U: r) A, E) CyR1(config-isakmp)#lifetime 3600 /-默认是86400秒-/7 Q0 y6 4 X/ R2 |1

16、RR1(config-isakmp)#exit5.定义IPSec转换集(transform set):7 T/ T! ?! B6 n+ r3 N% T纽爱科网络实验室社区R1(config)#crypto ipsec transform-set tt esp-aes 128 esp-sha-hmac R1(cfg-crypto-trans)#mode tunnel . x3 O& H# L1 e F- tR1(cfg-crypto-trans)#exit6 7 G) i+ 9 v+ u9 q! D6 ?6.定义crypto map并应用在接口上:/ J6 Z) i$ c$ h- i% N3 i

17、 H纽爱科网络实验室社区R1(config)#crypto map cisco 10 ipsec-isakmp J; H5 z: f1 D q q+ ER1(config-crypto-map)#match address 100 R1(config-crypto-map)#set peer 192.168.1.2 /-定义要应用crypto map的对等体地址-/! |* , p& G$ d) C( U! d- SR1(config-crypto-map)#set transform-set tt /-定义crypto map要应用的IPsec转换集-/R1(config-crypto-ma

18、p)#exit4 7 t0 N- $ z纽爱科网络实验室社区R1(config)#interface serial0/0R1(config-if)#crypto map cisco / W; W* R3 / S/ ?5 Z*Mar1 00:08:31.131: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ONR1(config-if)#endR1#- m2 f, M$ T2 q, n纽爱科网络实验室社区R1配置完成.d9 I) R/ d2 d.91lab.同理,R2配置如下:! !crypto isakmp policy 10. C# _ j7 p8 O0 T6 +

19、- eencr aesauthentication pre-sharegroup 2!; N E+ _ ?8 E( Bcrypto isakmp peer address 192.168.1.1set aggressive-mode password 91lab; k6 u3 S4 w: r+ eset aggressive-mode client-endpoint ipv4-address 192.168.1.1 !crypto ipsec transform-set tt esp-aes esp-sha-hmac !crypto map cisco 10 ipsec-isakmp set

20、peer 192.168.1.19 k: h8 Z. z8 |( _- F1 u. U% fset transform-set tt ) n2 ?* G9 V: k|8 m% Cmatch address 1009 U# G+ q$ Y+ x/ ?) C7 9 C5 |!interface Loopback0ip address 10.2.2.1 255.255.255.0 t* G6 j5 . R1 h/ v!7 x* d J & R; interface Serial0/0/ e% j5 f! R6 z! Arip address 192.168.1.2 255.255.255.252cr

21、ypto map cisco3 y) v1 c. ?! h7 d# X!ip route 0.0.0.0 0.0.0.0 Serial0/0% n% r5 O9 M8 k, s# m2 G( v!& N3 FJ3 P0 A: U3 C2 Q; - u纽爱科网络实验室社区access-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255!三.GRE隧道与IPsec的结合GRE隧道本身不带安全特性,可以通过结合基于PSK的IPsec来实现安全功能.拓扑如下:5 X % M8 n5 b; n& _( u. J+ D$ n1 % q, X(

22、r J1 w.91lab.1.R1基本配置:R1(config)#interface loopback0R1(config-if)#ip address 10.1.1.1 255.255.255.0R1(config-if)#no shutdown$ $ _8 - ? p% i9 j/ VR1(config-if)#interface serial0/00 s, e. S3 R6 V8 s6 s3 U.91lab.R1(config-if)#ip address192.168.1.1 255.255.255.252R1(config-if)#clock rate 56000R1(config-

23、if)#no shutdown% |/ h/ g* - FR1(config)#interface tunnel 0R1(config-if)#ip unnumbered serial0/0R1(config-if)#tunnel source serial0/0R1(config-if)#tunnel destination 192.168.1.1# b5 # D/ O% R1(config-if)#tunnel mode gre ip /-可以不打,默认即为GRE-/ I& A% S. n( T$ P G5 .91lab.R1(config-if)#no shutdown& N+ b& d

24、/ # K# Q.91lab.R1(config-if)#exit+ z a! i5 C* b8 E+ 0 u2.定义感兴趣流量与路由协议:R1(config)#access-list 100 permit gre host 192.168.1.1 host 192.168.1.2! s! u# Y/ d% t) I( WR1(config)#ip route 0.0.0.0 0.0.0.0 serial0/0( z/ o2 H3 c4 n. S: bR1(config)#ip route 10.2.2.0 255.255.255.0 serial0/0: |9 - H9 9 R A7 ?$

25、P$ C; F. WG4 % # .91lab.3.全局启用ISAKMP并定义对等体及其PSK(预共享密钥):R1(config)#crypto isakmp enable R1(config)#crypto isakmp key 91lab address 192.168.1.21 9 v& |2 p1 k3 & w4.定义IKE策略:% d) M/ H( P1 t3 B. P g纽爱科网络实验室社区R1(config)#crypto isakmp policy 10R1(config-isakmp)#encryption aes 128 /-默认是DES加密-/: q* w( F, |,

26、Y( X/ q; r纽爱科网络实验室社区R1(config-isakmp)#hash sha /-默认是SHA-1-/) |B4 ?$ t O f# eR1(config-isakmp)#authentication pre-share R1(config-isakmp)#group 2 /-默认是768位的DH1-/ j E4 4 d: $ |) L2 .91lab.R1(config-isakmp)#lifetime 3600 /-默认是86400秒-/R1(config-isakmp)#exit( n& t% q( m( O; x% g- e4 T8 N, k+ $ c! c I.91l

27、ab.5.定义IPSec转换集(transform set):R1(config)#crypto ipsec transform-set tt esp-aes 128 esp-sha-hmac / Z, I2 f; $ R1(cfg-crypto-trans)#mode tunnel R1(cfg-crypto-trans)#exit5 K9 S. ?+ g# h8 d* r6.定义crypto map并应用在接口上:R1(config)#crypto map cisco 10 ipsec-isakmp R1(config-crypto-map)#match address 100 R1(co

28、nfig-crypto-map)#set peer 192.168.1.2 /-定义要应用crypto map的对等体地址-/R1(config-crypto-map)#set transform-set tt /-定义crypto map要应用的IPsec转换集-/! U+ D8 ; o p& z1 MR1(config-crypto-map)#exitR1(config)#interface serial0/0: g0 C$ Q! I+ P$ P3 h0 mR1(config-if)#crypto map cisco. B- B+ $ r4 l- a z# v1 7 ?*Mar1 00:0

29、8:31.131: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON2 w( T- H4 H( K7 _9 x* |/ X7 I0 jR1(config-if)#end7 e4 Q8 r! 4 b; K) i- JR1#/ C/ Q$ z7 I; P, h# R1配置完成. 6 r# X y! m2 A3 U.91lab.同理,R2相关配置如下:; I0 e+ R/ O: U+ L6 / S9 P5 M纽爱科网络实验室社区! !. L5 R/ G/ F% L5 z7 d4 p L纽爱科网络实验室社区crypto isakmp policy 101 P& y# y5 t

30、 i2 d! z gencr aesauthentication pre-sharegroup 20 T: H$ U8 D7 H% P.91lab.crypto isakmp key 91lab address 192.168.1.16 N+ G4 _# r! * k2 c) ! E( R! F! x9 _8 Q! y* W!crypto ipsec transform-set tt esp-aes esp-sha-hmac !5 s; N9 ( n% q* k# 3 zcrypto map cisco 10 ipsec-isakmp $ e1 K; ?) n% P( l9 |A0 Aset peer 192.168.1.1! S& s0 C3 * ?: c7 eset transform-set tt match address 100!f. x% h4