GRE OVER IPSEC V5-V7.docx

GRE Over IPsec(V5-V7)1、 需求与目的V7与V5设备通过GRE Over IPSec提供两个远程私网完整性和机密性的保数据传输。2、 组网拓扑3、使用设备以及版本RTA H3C Comware Platform SoftwareComware Software, Version 5.20, Release 2512P04, StandardCopyright (c) 2004-2014 Hangzhou H3C Tech. Co., Ltd. All rights reserved.H3C MSR30-20RTBH3C Comware Software, Version 7.1.059, Release 0304Copyright (c) 2004-2015 Hangzhou H3C Tech. Co., Ltd. All rights reserved.H3C MSR36-203、 配置步骤：包含关键命令、截图配置配置完地址，首先PC-A ping PC-B 公网是通的RTA上的配置#/只允许该网段传输数据；注意是gre协议acl number 3000 rule 0 permit gre source 200.1.1.0 0.0.0.255 destination 200.1.1.0 0.0.0.255 rule 1 deny ip#/tunnel隧道设置interface Tunnel1 ip address 10.1.1.1 255.255.255.0 source 200.1.1.1 destination 200.1.1.2 keepalive 10 3#ip route-static 192.168.1.0 24 Tunnel 0 /设置默认静态，下一跳为tunnel接口#/ike邻居ike peer 1 pre-shared-key cipher $c$3$cHvkLf05yRfYM4VhEv3o8M2UpK3Z6g= remote-address 200.1.1.2 local-address 200.1.1.1#/ipsec转换配置ipsec transform-set 1 encapsulation-mode tunnel transform esp esp authentication-algorithm sha1 esp encryption-algorithm des#/ipsec策略ipsec policy 1 10 isakmp security acl 3000 ike-peer 1 remote-address 200.1.1.2 local-address 200.1.1.1 transform-set 1#/将ipsec应用到相应接口interface GigabitEthernet0/1 port link-mode route ip address 200.1.1.1 255.255.255.0 ipsec policy 1#interface GigabitEthernet0/0 port link-mode route ip address 192.168.2.2 255.255.255.0#RTB上的配置#/允许固定网段访问acl advanced 3000rule 0 permit gre source 200.1.1.0 0.0.0.255 destination 200.1.1.0 0.0.0.255 rule 1 deny ip#/tunnel隧道interface Tunnel0 mode gre ip address 10.1.1.2 255.255.255.0 source 200.1.1.2 destination 200.1.1.1 keepalive 10 3#/默认静态，下一跳为tunn接口ip route-static 10.153.42.0 24 Tunnel 0#ike keychain 1 match local address 200.1.1.2 pre-shared-key address 200.1.1.1 255.255.255.255 key cipher $c$3$LTqy5isI2+3Qh+rJmd60clYLYmtoWg=#ike profile 1 keychain 1#/ipsec转换配置ipsec transform-set 1esp authentication-algorithm sha1 esp encryption-algorithm des#ipsec policy 1 10 isakmp transform-set 1 security acl 3000 local-address 200.1.1.2 remote-address 200.1.1.1 ike-profile 1#/ipsec策略应用到接口interface GigabitEthernet0/1 port link-mode route ip address 200.1.1.2 255.255.255.0 ipsec apply policy 1#interface GigabitEthernet0/2 port link-mode route ip address 192.168.1.2 255.255.255.0#5、验证过程、现象、结果PC-A ping PC-Bping通查看RTA的ike sa成功建立。查看RTA的ipsec sa查看RTB的ike sa查看RTB的ipsec sa6、总结收获通过V5与V7设备之间的实验，区分了GRE Over IPSec在不同平台上的配置区别，实验报告梳理了具体的区别，如下：1. 设置tunn接口，并配置以tunnel接口为下一跳到指定网段的默认静态2. 设置acl，指定网段访问（注意协议选gre）V5：Ike peer 邻居V7：ike profile 提议（keychain）、ike