两台出口路由器之间GRE OVER IPSEC+NAT+OSPF.doc

两台出口路由器之间GRE OVER IPSEC+NAT+OSPF实验拓扑：拓扑描述：如上图所示：在两台出口路由器上分别实现站点内部PAT上网，同时通过在R1、R3的出接口之间建立GRE隧道来传递两个站点的动态OSPF路由，同时通过在R1、R3之间建立一个传输模式的IPSEC隧道来对两个出接口的GRE感兴趣流量实施保护。具体配置：R1：1、 接口和PAT配置interface FastEthernet0/0 ip address 12.1.1.1 255.255.255.0 ip nat outsideinterface FastEthernet0/1 ip address 10.1.1.2 255.255.255.0 ip nat insideip route 0.0.0.0 0.0.0.0 12.1.1.2ip nat inside source list nat interface FastEthernet0/0 overloadip access-list extended nat 扩展访问列表-定义NAT流量 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255拒绝到site B的流量（走GRE隧道） permit ip any any2、 GRE隧道配置interface Tunnel0 ip address 192.168.1.1 255.255.255.0 tunnel source 12.1.1.1 tunnel destination 23.1.1.23、 OSPF配置router ospf 1 启用OSPF进程1 log-adjacency-changes network 10.1.1.2 0.0.0.0 area 0 将内网接口宣告进区域0 network 192.168.1.1 0.0.0.0 area 0 将隧道接口宣告进区域04、 IPSEC配置crypto isakmp policy 1 创建一阶段策略 encr 3des authentication pre-share group 2crypto isakmp key 6 cisco address 23.1.1.2 指定对端地址和pre-share keycrypto ipsec transform-set myset esp-3des esp-sha-hmac 二阶段数据加密和完整性校验算法 mode transport 传输模式（加密连个端点的数据）crypto map mymap 1 ipsec-isakmp 创建加密映射关联感兴趣流、转换集、对端地址 set peer 23.1.1.2 set transform-set myset match address vpninterface FastEthernet0/0crypto map mymap 在出接口下应用加密映射ip access-list extended vpn permit gre host 12.1.1.1 host 23.1.1.2 IPSEC VPN的感兴趣流就是两个出接口间的GRE流量R2:interface Loopback0 ip address 2.2.2.2 255.255.255.255interface FastEthernet0/0 ip address 12.1.1.2 255.255.255.0interface FastEthernet0/1 ip address 23.1.1.1 255.255.255.0R3:1、 接口和PAT配置interface FastEthernet0/0 ip address 10.2.2.2 255.255.255.0 ip nat insideinterface FastEthernet0/1 ip address 23.1.1.2 255.255.255.0 ip nat outsideip route 0.0.0.0 0.0.0.0 23.1.1.1ip nat inside source list nat interface FastEthernet0/1 overloadip access-list extended nat 扩展访问列表-定义NAT流量 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255拒绝到site A的流量（走GRE隧道） permit ip any any2、 GRE隧道配置interface Tunnel0 ip address 192.168.1.2 255.255.255.0 tunnel source 23.1.1.2 tunnel destination 12.1.1.13、 OSPF配置router ospf 1 log-adjacency-changes network 10.2.2.2 0.0.0.0 area 0 network 192.168.1.2 0.0.0.0 area 04、 IPSEC配置crypto isakmp policy 1 创建一阶段策略 encr 3des authentication pre-share group 2crypto isakmp key 6 cisco address 12.1.1.1 指定对端地址和pre-share keycrypto ipsec transform-set myset esp-3des esp-sha-hmac 二阶段数据加密和完整性校验算法 mode transport 传输模式（加密连个端点的数据）crypto map mymap 1 ipsec-isakmp 创建加密映射关联感兴趣流、转换集、对端地址 set peer 12.1.1.1 set transform-set myset match address vpninterface FastEthernet0/1crypto map mymap 在出接口下应用加密映射ip access-list extended vpn permit gre host 23.1.1.2 host 12.1.1.1 IPSEC VPN的感兴趣流就是两个出接口间的GRE流量R4:no ip routinginterface FastEthernet0/1 ip address 10.1.1.1 255.255.255.0ip default-gateway 10.1.1.2R5:no ip routinginterface FastEthernet0/0 ip address 10.2.2.1 255.255.255.0ip default-gateway 10.2.2.2实验测试：1、测试到对端的连通性R4-ping-R5NAT转换为空2、测试到公网的连通性 R4-ping-R2的环回口有NAT转换3、在R1上show crypto isakmp sa5、 在R1上show crypto ipsec sa6、 在R1上show crypto engine connections active7、查看R1的路由表通过OSPF学到site B的路由，下一跳指向site B的隧道接口IP地址7、 在R2的f0/1口抓包查看信息此时已看不到R4pingR5的ICMP包，在出接口IP头里面的ESP对GRE流量进行了加密在R1清除clear crypto isakmp可以看到IPSEC通道建立的ISAKMP包和后续发起的R4-45的ping包实验总结：测试做实验的时候，模拟内网如果用环回口带源地址pi