安全CCIE之路——使用GRE隧道的IPSEC之上的OSPF

使用使用 GRE 隧道的隧道的 IPSEC 之上的之上的 OSPF 实验设备实验设备 三台 CISCO 路由器 用一台模拟一个公网 另外两台作 为两个局域网通过 GRE 互连 实验需求 实验需求 两下局域网之间使用 OSPF 能过 GRE 互连互通 用 IPSEC 来保证 GRE 隧道中的数据安全 实验拓朴图 实验拓朴图 E0 2E0 2 E0 0E0 0 E0 0E0 0 E0 3E0 3 E0 1E0 1 E1 0E1 0 E1 0E1 0 E1 0E1 0 VPNVPN VPNVPN RT1RT1 RT2RT2 RT3RT3 E1 1E1 1 PPPoEPPPoE VMPC7 InetRInetR E0 0E0 0 VPNVPN 拨入拨入 VPC1VPC1 VPC3VPC3 VPC5VPC5 E0 0E0 0 ServerServer VMPC6 E1 0E1 0 VMXP0 PPPoEPPPoE 本实验只用到 本实验只用到 R1 R2 和和 InetR 三台路由器 三台路由器 实验主要配置 实验主要配置 R1crypto isakmp policy 10 encr 3des hash md5 authentication pre share group 2 crypto isakmp key zhoujian address 10 1 2 1 crypto ipsec transform set zhoujian esp 3des esp md5 hmac mode transport crypto map zhoujian 10 ipsec isakmp set peer 10 1 2 1 set transform set zhoujian match address 101 interface Tunnel1 ip address 1 1 1 1 255 255 255 0 tunnel source 10 1 1 1 tunnel destination 10 1 2 1 R2R2 crypto isakmp policy 10 encr 3des hash md5 authentication pre share group 2 crypto isakmp key zhoujian address 10 1 1 1 crypto ipsec transform set zhoujian esp 3des esp md5 hmac mode transport crypto map zhoujian 10 ipsec isakmp set peer 10 1 1 1 set transform set zhoujian match address 101 interface Tunnel1 ip address 1 1 1 2 255 255 255 0 tunnel source 10 1 2 1 tunnel destination 10 1 1 1 interface Ethernet0 0 ip address 10 1 2 1 255 255 255 0 half duplex crypto map zhoujian 实验结果实验结果 通过抓包得到如下结果 R1 show crypto isakmp sa dst src state conn id slot status 10 1 2 1 10 1 1 1 QM IDLE 1 0 ACTIVE show crypto ipsec sa interface Ethernet0 0 Crypto map tag zhoujian local addr 10 1 1 1 protected vrf none local ident addr mask prot port 10 1 1 1 255 255 255 255 0 0 remote ident addr mask prot port 10 1 2 1 255 255 255 255 0 0 current peer 10 1 2 1 port 500 PERMIT flags origin is acl pkts encaps 176 pkts encrypt 176 pkts digest 176 pkts decaps 176 pkts decrypt 176 pkts verify 176 pkts compressed 0 pkts decompressed 0 pkts not compressed 0 pkts compr failed 0 pkts not decompressed 0 pkts decompress failed 0 send errors 6 recv errors 0 local crypto endpt 10 1 1 1 remote crypto endpt 10 1 2 1 path mtu 1500 ip mtu 1500 current outbound spi 0 xFBF39AC 264190380 inbound esp sas spi 0 xEB28A2BE 3945308862 transform esp 3des esp md5 hmac in use settings Transport conn id 2002 flow id SW 2 crypto map zhoujian sa timing remaining key lifetime k sec 4420224 1996 IV size 8 bytes replay detection support Y Status ACTIVE spi 0 xAEC25086 2931970182 transform esp 3des esp md5 hmac in use settings Transport conn id 2003 flow id SW 3 crypto map zhoujian sa timing remaining key lifetime k sec 4444506 1990 IV size 8 bytes replay detection suppo