大橙子网站建设,新征程启航

为企业提供网站建设、域名注册、服务器等服务

IPSECoverGREwithBGP-创新互联

【实验拓扑和软件】

成都创新互联是一家专注于成都网站制作、网站建设与策划设计,蠡县网站建设哪家好?成都创新互联做网站,专注于网站建设十年,网设计领域的专业建站公司;建站业务涵盖:蠡县等地区。蠡县做网站价格咨询:18980820575

IPSEC over GRE with BGP

本文实验采用的交换机是H3C模拟器,下载地址如下: http://forum.h4c.com/forum.php? mod=viewthread&tid=109740&highlight=H3C%E6%A8%A1%E6% 8B%9F%E5%99%A8 有兴趣的朋 友可以在论坛上去下载

【需求信息】

R2和R4建立EBGP邻居信息,邻居都是tunnel口的地址,而流经tunnel口的数据包都是需要ipsec加密 的!

【配置信息】

R2

vlan 1024

#

domain system

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#

ike peer r4

 pre-shared-key simple 1234567

 remote-address 192.168.24.4

#

ipsec proposal 1

#

ipsec policy jc 10 isakmp

 security acl 3000

 ike-peer r4

 proposal 1

#

acl number 3000

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.11.0 0.0.0.255

 rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 172.16.11.0 0.0.0.255

#

#

interface LoopBack0

 ip address 192.168.1.1 255.255.255.255

#

interface Vlan-interface1024

 ip address 192.168.28.2 255.255.255.0

#

interface Tunnel0

 ip address 192.168.24.2 255.255.255.0

 source 192.168.28.2

 destination 192.168.48.4

 ipsec policy jc

#

bgp 65001

 network 192.168.1.1 255.255.255.255

 undo synchronization

 peer 192.168.24.4 as-number 65002

#

 ip route-static 0.0.0.0 0.0.0.0 192.168.28.8

SW4

#

interface Vlan-interface1024

 ip address 192.168.28.8 255.255.255.0

#

interface Vlan-interface1044

 ip address 192.168.48.8 255.255.255.0

#

interface Ethernet0/4/0

 port link-mode bridge

#

interface Ethernet0/4/1

 port link-mode bridge

#

interface Ethernet0/4/2

 port link-mode bridge

 port access vlan 1024

#

interface Ethernet0/4/3

 port link-mode bridge

#

interface Ethernet0/4/4

 port link-mode bridge

 port access vlan 1044

R4

#

vlan 1044

#

domain system

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#

ike peer r2

 pre-shared-key simple 1234567

 remote-address 192.168.24.2

#

ipsec proposal 1

#

ipsec policy jc 10 isakmp

 security acl 3000

 ike-peer r2

 proposal 1

#

acl number 3000

 rule 0 permit ip source 192.168.11.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 permit ip source 172.16.11.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

#

interface Serial0/6/0

 link-protocol ppp

#

interface Serial0/6/1

 link-protocol ppp

#

interface Serial0/6/2

 link-protocol ppp

#

interface Serial0/6/3

 link-protocol ppp

#

interface NULL0

#

interface LoopBack0

 ip address 192.168.11.1 255.255.255.255

#

interface Vlan-interface1044

 ip address 192.168.48.4 255.255.255.0

#

interface Ethernet0/4/0

 port link-mode bridge

#

interface Ethernet0/4/1

 port link-mode bridge

 port access vlan 1044

interface Tunnel0

 ip address 192.168.24.4 255.255.255.0

 source 192.168.48.4

 destination 192.168.28.2

 ipsec policy jc

#

bgp 65002

 network 192.168.11.1 255.255.255.255

 undo synchronization

 peer 192.168.24.2 as-number 65001

#

 ip route-static 0.0.0.0 0.0.0.0 192.168.48.8

#

【验证】

查看ike 和ipsec sa

dis ike sa

  total phase-1 SAs:  0

  connection-id  peer       flag     phase  doi

 ----------------------------------------------------------

dis ipsec sa

         因为还没有数据包匹配,所以没有sa

ping -a 192.168.1.1 192.168.11.1

 PING 192.168.11.1: 56  data bytes, press CTRL_C to break

  Request time out

  Reply from 192.168.11.1: bytes=56 Sequence=2 ttl=255 time=50 ms

  Reply from 192.168.11.1: bytes=56 Sequence=3 ttl=255 time=44 ms

  Reply from 192.168.11.1: bytes=56 Sequence=4 ttl=255 time=45 ms

  Reply from 192.168.11.1: bytes=56 Sequence=5 ttl=255 time=50 ms

 --- 192.168.11.1 ping statistics ---

  5 packet(s) transmitted

  4 packet(s) received

  20.00% packet loss

  round-trip min/avg/max = 44/47/50 ms

dis ike sa

  total phase-1 SAs:  1

  connection-id  peer       flag     phase  doi

 ----------------------------------------------------------

    6      192.168.24.4   RD|ST     2   IPSEC

    5      192.168.24.4   RD|ST     1   IPSEC

 flag meaning

 RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT

dis ipsec sa

===============================

Interface: Tunnel0

  path MTU: 1476

===============================

 -----------------------------

 IPsec policy name: "jc"

 sequence number: 10

 mode: isakmp

 -----------------------------

  connection id: 4

  encapsulation mode: tunnel

  perfect forward secrecy: None

  tunnel:

    local  address: 192.168.24.2

    remote address: 192.168.24.4

  Flow :

    sour addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

    dest addr: 192.168.11.0/255.255.255.0  port: 0  protocol: IP

  [inbound ESP SAs]

   spi: 2478830021 (0x93bff1c5)

   proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

   sa remaining key duration (bytes/sec): 1887436464/3588

   max received sequence-number: 4

   udp encapsulation used for nat traversal: N

  [outbound ESP SAs]

   spi: 645607044 (0x267b2e84)

   proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

   sa remaining key duration (bytes/sec): 1887436464/3588

   max sent sequence-number: 5

   udp encapsulation used for nat traversal: N

dis ike sa

  total phase-1 SAs:  1

  connection-id  peer       flag     phase  doi

 ----------------------------------------------------------

    4      192.168.24.2   RD       2   IPSEC

    3      192.168.24.2   RD       1   IPSEC

 flag meaning

 RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT

dis ipsec sa

===============================

Interface: Tunnel0

  path MTU: 1476

===============================

 -----------------------------

 IPsec policy name: "jc"

 sequence number: 10

 mode: isakmp

 -----------------------------

  connection id: 4

  encapsulation mode: tunnel

  perfect forward secrecy: None

  tunnel:

    local  address: 192.168.24.4

    remote address: 192.168.24.2

  Flow :

    sour addr: 192.168.11.0/255.255.255.0  port: 0  protocol: IP

    dest addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

  [inbound ESP SAs]

   spi: 645607044 (0x267b2e84)

   proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

   sa remaining key duration (bytes/sec): 1887436464/3523

   max received sequence-number: 4

   udp encapsulation used for nat traversal: N

  [outbound ESP SAs]

   spi: 2478830021 (0x93bff1c5)

   proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

   sa remaining key duration (bytes/sec): 1887436464/3523

   max sent sequence-number: 5

   udp encapsulation used for nat traversal: N

另外有需要云服务器可以了解下创新互联scvps.cn,海内外云服务器15元起步,三天无理由+7*72小时售后在线,公司持有idc许可证,提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案,具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势,专为企业上云打造定制,能够满足用户丰富、多元化的应用场景需求。


新闻名称:IPSECoverGREwithBGP-创新互联
转载注明:http://dzwzjz.com/article/dhpiji.html
在线咨询
服务热线
服务热线:028-86922220
TOP