adsl与ipsec ike相结合的组网应用(广泛应用)

《adsl与ipsec ike相结合的组网应用(广泛应用)》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、ADSL与IPsec/IKE相结合的组网应用1.组网需求本例将IPsec和ADSL相结合，是目前实际中广泛应用的典型案例。l             RouterB通过ADSL卡直接连接公网的DSLAM接入端，作为PPPoE的client端。RouterB从ISP动态获得的IP地址为私网地址，故RouterA、RouterB都需要配置NAT穿越。l             总公司局域网通过RouterA接入到ATM网络。l             为了保证信息安全采用IPsec/IKE方式创建安全隧道。2

2、.组网图图2-5ADSL与IPsec/IKE相结合的组网应用 3.配置步骤(1)       配置RouterA#配置本端安全网关设备名称。system-view[RouterA]ikelocal-nameroutera#配置ACL。[RouterA]aclnumber3101[RouterA-acl-adv-3101]rule0permitipsource172.16.0.00.0.0.255destination192.168.0.00.0.0.255[RouterA-acl-adv

3、-3101]quit#配置IKE安全提议。[RouterA]ikeproposal1[RouterA-ike-proposal-1]authentication-algorithmsha[RouterA-ike-proposal-1]authentication-methodpre-share[RouterA-ike-proposal-1]encryption-algorithm3des-cbc[RouterA-ike-proposal-1]dhgroup2#配置IKE对等体peer。[RouterA]i

4、kepeerpeer[RouterA-ike-peer-peer]exchange-modeaggressive[RouterA-ike-peer-peer]pre-shared-keyabc[RouterA-ike-peer-peer]id-typename[RouterA-ike-peer-peer]remote-namerouterb[RouterA-ike-peer-peer]nattraversal[RouterA-ike-peer-peer]quit#创建IPsec安全提议prop。[Rout

5、erA]ipsecproposalprop[RouterA-ipsec-proposal-prop]encapsulation-modetunnel[RouterA-ipsec-proposal-prop]transformesp[RouterA-ipsec-proposal-prop]espencryption-algorithm3des[RouterA-ipsec-proposal-prop]espauthentication-algorithmsha1[RouterA-ipsec-proposal-

6、prop]quit#创建安全策略policy并指定通过IKE协商建立SA。[RouterA]ipsecpolicypolicy10isakmp#配置安全策略policy引用IKE对等体peer。[RouterA-ipsec-policy-isakmp-policy-10]ike-peerpeer#配置安全策略policy引用访问控制列表3101。[RouterA-ipsec-policy-isakmp-policy-10]securityacl3101#配置安全策略policy引用IPsec安全提议pro

7、p。[RouterA-ipsec-policy-isakmp-policy-10]proposalprop[RouterA-ipsec-policy-isakmp-policy-10]quit#配置IP地址。[RouterA]interfaceserial2/0/1[RouterA-Serial2/0/1]ipaddress100.1.1.1255.255.255.0[RouterA-Serial2/0/1]ipsecpolicypolicy[RouterA-Serial2/0/1]quit#配置以太网口

8、。[RouterA]interfacegigabitethernet1/0/1[RouterA-GigabitEthernet1/0/1]ipaddress172.16.0.1255.255.255.0[RouterA-GigabitEthernet1/0/1]quit#配置到分公司局域网的静态路由。[RouterA]iproute-static192.168.0.0255.255.255.0serial2/0/1(2)