Cisco路由器配置GRE over IPsec
阿新 • • 發佈:2017-08-14
gre over ipsec
拓撲圖
實驗目的:
通過CRE over IPsec的方式實現R1網段:172.16.10.0/24和R2網段:172.17.10.0/24通信加密。
由於IPsec VPN不支持組播,而GRE支持多種協議,所以一般情況下會選擇GRE over IPsec。
配置思路:
通過ACL設置感興趣流
配置IKE第一階段
配置IKE第二階段
新建MAP,並應用於接口
設置路由,下一跳為tunnel 0
配置:
R1:
配置接口IP信息
interface Loopback0 ip address 172.16.10.1 255.255.255.0 no shu exit interface FastEthernet0/0 ip address 200.1.1.1 255.255.255.0 no shut exit interface Tunnel0 ip address 1.1.1.1 255.255.255.0 tunnel source 200.1.1.1 tunnel destination 200.1.1.2
配置ACL
ip access-list extended ipsec-acl-1 permit ip host 200.1.1.1 host 200.1.1.2 log exit
配置IKE第一階段
crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 5 lifetime 86400 exit
配置IKE第一階段密碼
crypto isakmp key 6 tommy address 200.1.1.2 //由於是模擬器上操作了,實際路由器可能不需要key後面的6 exit
配置IKE第二階段
crypto ipsec transform-set SET-1 esp-3des esp-md5-hmac mode transport //註意,當做NAT穿越時,只能使用transport模式 exit
配置MAP
crypto map MAP-1 10 ipsec-isakmp set peer 200.1.1.2 set transform-set SET-1 match address ipsec-acl-1 exit
將MAP應用於接口
interface FastEthernet0/0 crypto map MAP-1 exit
配置路由
ip route 172.17.10.0 255.255.255.0 1.1.1.2
R2:
配置接口IP信息
interface Loopback0 ip address 172.17.10.1 255.255.255.0 no shu exit interface FastEthernet0/0 ip address 200.1.1.2 255.255.255.0 no shut exit interface Tunnel0 ip address 1.1.1.2 255.255.255.0 tunnel source 200.1.1.2 tunnel destination 200.1.1.1
配置ACL
ip access-list extended ipsec-acl-1 permit ip host 200.1.1.2 host 200.1.1.1 log exit
配置IKE第一階段
crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 5 lifetime 86400 exit
配置IKE第一階段密碼
crypto isakmp key 6 tommy address 200.1.1.1 //由於是模擬器上操作了,實際路由器可能不需要key後面的6 exit
配置IKE第二階段
crypto ipsec transform-set SET-1 esp-3des esp-md5-hmac mode transport exit
配置MAP
crypto map MAP-1 10 ipsec-isakmp set peer 200.1.1.1 set transform-set SET-1 match address ipsec-acl-1 exit
將MAP應用於接口
interface FastEthernet0/0 crypto map MAP-1 exit
配置路由
ip route 172.16.10.0 255.255.255.0 1.1.1.1
此時配置完畢。
驗證:
ping包
R1#ping 172.17.10.1 source 172.16.10.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.17.10.1, timeout is 2 seconds: Packet sent with a source address of 172.16.10.1 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 62/65/72 ms R1#
抓包:
路由跟蹤:
R1#traceroute 172.17.10.1 source 172.16.10.1 Type escape sequence to abort. Tracing the route to 172.17.10.1 1 1.1.1.2 72 msec 68 msec 84 msec R1#
GRE over IPsec 配置成功。
本文出自 “TommyKing” 博客,請務必保留此出處http://tommyking.blog.51cto.com/10481841/1955909
Cisco路由器配置GRE over IPsec