安全CCIE之路——使用GRE隧道的IPSEC之上的OSPF

《安全CCIE之路——使用GRE隧道的IPSEC之上的OSPF》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、使用GRE隧道的IPSEC之上的OSPF实验设备：三台CISCO路由器，用一台模拟一个公网，另外两台作为两个局域网通过GRE互连。实验需求：两下局域网之间使用OSPF能过GRE互连互通，用IPSEC来保证GRE隧道中的数据安全。实验拓朴图：E0/2E0/0E0/0E0/3E0/1E1/0E1/0E1/0VPNVPNRT1RT2RT3E1/1PPPoEVMPC7InetRE0/0VPN拨入VPC1VPC3VPC5E0/0ServerVMPC6E1/0VMXP0PPPoE（本实验只用到R1，R2和InetR三台路由器）实验主要配置：R1cryptoisakmppolicy1

2、0encr3deshashmd5authenticationpre-sharegroup2cryptoisakmpkeyzhoujianaddress10.1.2.1cryptoipsectransform-setzhoujianesp-3desesp-md5-hmacmodetransportcryptomapzhoujian10ipsec-isakmpsetpeer10.1.2.1settransform-setzhoujianmatchaddress101interfaceTunnel1ipaddress1.1.1.1255.255.255.0tunnelsour

3、ce10.1.1.1tunneldestination10.1.2.1R2cryptoisakmppolicy10encr3deshashmd5authenticationpre-sharegroup2cryptoisakmpkeyzhoujianaddress10.1.1.1cryptoipsectransform-setzhoujianesp-3desesp-md5-hmacmodetransportcryptomapzhoujian10ipsec-isakmpsetpeer10.1.1.1settransform-setzhoujianmatchaddress10

4、1interfaceTunnel1ipaddress1.1.1.2255.255.255.0tunnelsource10.1.2.1tunneldestination10.1.1.1!interfaceEthernet0/0ipaddress10.1.2.1255.255.255.0half-duplexcryptomapzhoujian实验结果：通过抓包得到如下结果R1#showcryptoisakmpsadstsrcstateconn-idslotstatus10.1.2.110.1.1.1QM_IDLE10ACTIVEshowcryptoipsecsainterf

5、ace:Ethernet0/0Cryptomaptag:zhoujian,localaddr10.1.1.1protectedvrf:(none)localident(addr/mask/prot/port):(10.1.1.1/255.255.255.255/0/0)remoteident(addr/mask/prot/port):(10.1.2.1/255.255.255.255/0/0)current_peer10.1.2.1port500PERMIT,flags={origin_is_acl,}#pktsencaps:176,#pktsencrypt:176,#

6、pktsdigest:176#pktsdecaps:176,#pktsdecrypt:176,#pktsverify:176#pktscompressed:0,#pktsdecompressed:0#pktsnotcompressed:0,#pktscompr.failed:0#pktsnotdecompressed:0,#pktsdecompressfailed:0#senderrors6,#recverrors0localcryptoendpt.:10.1.1.1,remotecryptoendpt.:10.1.2.1pathmtu1500,ipmtu1500cur

7、rentoutboundspi:0xFBF39AC(264190380)inboundespsas:spi:0xEB28A2BE(3945308862)transform:esp-3desesp-md5-hmac,inusesettings={Transport,}connid:2002,flow_id:SW:2,cryptomap:zhoujiansatiming:remainingkeylifetime(k/sec):(4420224/1996)IVsize:8bytesreplaydetectionsupport:YStatus:A