EzVPN技术简介和在packet-tracer上模拟实验.docx

技术简介EzVPN是cisco独有的远程接入VPN技术，是在IPsec建立的两个阶段（IKE 阶段和IPSEC阶段）多了一个2.5阶段（用户认证阶段）。以IPsec为基础来实现VPN功能，EzVPN能够自动去分析和完成VPN的配置和连接。以保证IPsec VPN的正常连接。其中主要的设备：分为EzVPN server 、EzVPN remote、 EzVPN client 本文主要将EzVPN和EzVPN client之间的技术原理和实现方法。原理：EzVPN server 配置好各种策略，然后直接告诉EzVPN该使用什么样的IPsec策略。因为client使用的EzVPN软件已经预先集成了几乎所有的IPsec策略，当EzVPNclient收到server 推送的IPsec策略之后，就从自己预先定义好的策略库中选出完全匹配的策略来应用，最终在与EzVPN server双方IPsec保持一致之后建立IPsecVPN。成功连接到EzVPN server之后的EzVPN client都会从EzVPN server获得一个靠DHCP自动分发的IP地址。默认掩码是/32，并且EzVPN server为了区分分配出去的IP地址分别对应着哪个EzVPN client，它会自动产生一个/32位的静态路由指向对应的EzVPN client。还包括将该路由重分布进各动态路由协议，重分布需要手动开启reverse route injection（RRI）才能启用。还需要定义感兴趣的流量，区分是去访问总部内部网络还是Internet。隧道分离技术（split tunneling）让EzVPN client只将需要发到公司总部的流量才通过IPsec VPN加密发到EzVPN server，而其他流量发到Internet 的流量还是从正常接口出去。Split tunneling 是在EzVPN server上个配置的，配置之后会告知client区分发送的流量，通过ACL匹配相当的流量，并应用到crypto map。EzVPN client断开之后EzVPN server不是马上就能知道的，在EzVPN client再次发起连接时。EzVPN server会在接到新的连接请求时候删除与该EzVPN client旧连接而接受新的连接，这是lnitial contact功能，默认是开启的。名词解释：group-based policy control ： EzVPN client向EzVPN server发起认证的时，需要通过AAA认证。当通过认证之后，EzVPN server 根据一个ISAKMP组分配某些策略。如果EzVPN client提供的认证信息没有与定义好的ISAKMP组匹配，那么足与默认的IKAMP 组匹配。但默认的ISAKMP组也是需要定义的（一个ISAKMP组中所有的用户用到的策略都是相同的） User-based policy control ：为属于同一个ISAKMP组的不同用户分发不同的策略User-based policy control （为属于同一个ISAKMP组的不同用户分发不同的策略）是基于特定用户分发的策略优先于group-based policy control。配置示例：实验拓扑实验说明：远程PC需要直接使用私有地址来访问总部的4.4.4.4/32。PC需要先和R1的公网出口能够通信，然后才能与私网之间建立穿越公网的通信。NAT-enable路由器负责最PC所在的网段30.1.1.0/24进行NAT转换。其实PT还是很强大的，GNS3模拟虽然更加真实，但是模拟EzVPN的时候却有各种很麻烦的事情。配置基础网络环境EzVPN-server路由器RouterenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname EzVPN-serverEzVPN-server(config)#int fa 0/0EzVPN-server(config-if)#no shEzVPN-server(config-if)#ip add 1iproute2.1.1.1 255.255.255.0EzVPN-server(config-if)#int fa 0/1EzVPN-server(config-if)#no shEzVPN-server(config-if)#ip add 10.1.1.1 255.255.255.0EzVPN-server(config-if)#ip route 0.0.0.0 255.255.255.255 10.1.1.4EzVPN-server(config)#ip route 0.0.0.0 0.0.0.0 12.1.1.2Internet路由器RouterenRouter#conf tRouter(config)#hostname InternetInternet(config)#int fa 0/0Internet(config-if)#no shInternet(config-if)#ip add 12.1.1.1 255.255.255.0Internet(config-if)#int fa 0/1Internet(config-if)#no shInternet(config-if)#ip add 23.1.1.2 255.255.255.0Internet(config-if)#int lo 0Internet(config-if)#ip add 2.2.2.2 255.255.255.0Internet(config-if)#line vty 0 15Internet(config-line)#no loginInternet(config-line)#NAT-enable路由器RouterenRouter#conf tRouter(config)#hostname NAT-enableNAT-enable(config)#int fa 0/0NAT-enable(config-if)#no shNAT-enable(config-if)#ip add 30.1.1.3 255.255.255.0NAT-enable(config-if)#int fa 0/1NAT-enable(config-if)#no shNAT-enable(config-if)#ip add 23.1.1.3 255.255.255.0NAT-enable(config-if)#ip route 0.0.0.0 0.0.0.0 23.1.1.2NAT-enable(config)#serNAT-enable(config)#service ? /不支持service DHCP命令，PT模拟器上默认不需配置nagle Enable Nagles congestion control algorithmpassword-encryption Encrypt system passwordstimestamps Timestamp debug/log messagesNAT-enable(config)#ip dhcp pool net30NAT-enable(dhcp-config)#network 30.1.1.0 255.255.255.0NAT-enable(dhcp-config)#default-router 30.1.1.3NAT-enable(dhcp-config) #ip dhcp excluded-address 30.1.1.3NAT-enable (config)#int fa 0/0NAT-enable(config-if)#ip nat inside NAT-enable(config-if)#int fa 0/1NAT-enable(config-if)#ip nat outside NAT-enable(config-if)#exitNAT-enable(config)#access-list 3 permit anyNAT-enable(config)#ip nat inside source list 3 interface fastEthernet 0/1 overload 总部路由器RouterenRouter#conf tRouter(config)#hostname zongbuzongbu(config)#int fa 0/1zongbu(config-if)#no shzongbu(config-if)#ip add 10.1.1.4 255.255.255.0zongbu(config-if)#int lo 0zongbu(config-if)#ip add 4.4.4.4 255.255.255.0zongbu(config-if)#ip route 0.0.0.0 0.0.0.0 10.1.1.1zongbu(config)#line vty 0 15zongbu(config-line)#no login测试基础网络环境查看PC机的地址情况 测试NAT-enable 路由器到总部EzVPN路由器的连通性NAT-enable(config)#do ping 12.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds:.!Success rate is 80 percent (4/5), round-trip min/avg/max = 1/4/6 msNAT-enable(config)#说明：因为NAT-enable与EzVPN都有默认路由指向nternet路由器，所以两者通信正常。测试NAT-enable到Internet的loopback连通性：NAT-enable(config)#do ping 2.2.2.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 msNAT-enable(config)#说明：因为有默认路由指向Internet，所以NAT-enable与Internet的loopback通信正常测试NAT-enable到总部路由器的10.1.1.0/24和4.4.4.4/32的连通性NAT-enable(config)#do ping 10.1.1.4Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)NAT-enable(config)#NAT-enable(config)#do ping 4.4.4.4Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)NAT-enable(config)#说明：Internet只有公网路由，只能保证NAT-enable与EzVPN-server之间的通信。所以NAT-enable无法访问总部的私有网段10.1.1.0/24和4.4.4.4/32。查看Internet的路由表Internet#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not set2.0.0.0/24 is subnetted, 1 subnetsC 2.2.2.0 is directly connected, Loopback012.0.0.0/24 is subnetted, 1 subnetsC 12.1.1.0 is directly connected, FastEthernet0/023.0.0.0/24 is subnetted, 1 subnetsC 23.1.1.0 is directly connected, FastEthernet0/1Internet#说明：模拟Internet，所以没写任何路由，只负责保证EzVPN-server和NAT-enable能够通信即可测试PC到EzVPN-server的连通性PCping 12.1.1.1Pinging 12.1.1.1 with 32 bytes of data:Reply from 12.1.1.1: bytes=32 time=8ms TTL=254Reply from 12.1.1.1: bytes=32 time=9ms TTL=254Reply from 12.1.1.1: bytes=32 time=8ms TTL=254Reply from 12.1.1.1: bytes=32 time=10ms TTL=254Ping statistics for 12.1.1.1:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 8ms, Maximum = 10ms, Average = 8msPC说明：因为PC的默认网关指向NAT-enable 并且NAT-enable已经配置NAT将PC所在的网段全部转换成外网接口地址23.1.1.3出去，所以PC与EzVPN之间通信正常测试PC到Internet路由器的loopback连通性PCping 2.2.2.2Pinging 2.2.2.2 with 32 bytes of data:Reply from 2.2.2.2: bytes=32 time=22ms TTL=254Reply from 2.2.2.2: bytes=32 time=4ms TTL=254Reply from 2.2.2.2: bytes=32 time=3ms TTL=254Reply from 2.2.2.2: bytes=32 time=5ms TTL=254Ping statistics for 2.2.2.2:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 3ms, Maximum = 22ms, Average = 8msPC说明：原因与PC可以连通12.1.1.1相同。查看PC与Internet通信时的源地址PCtelnet 2.2.2.2Trying 2.2.2.2 .OpenInternetshow usInternetshow users Line User Host(s) Idle Location* 67 vty 0 idle 00:00:00 23.1.1.3Interface User Mode Idle Peer AddressInternet说明：因为NAT-enable已经配置NAT将PC所在的网段全部转换成外网接口地址23.1.1.3出去，所以PC是使用源地址23.1.1.3与Internet路由器通信的，同样也应该使用源地址23.1.1.3与EzVPN-server通信的。测试PC到公司总部10.1.1.0/24和4.4.4.4/32的连通性PCping 10.1.1.4Pinging 10.1.1.4 with 32 bytes of data:Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Ping statistics for 10.1.1.4:Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),PCping 4.4.4.4Pinging 4.4.4.4 with 32 bytes of data:Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Reply from 23.1.1.2: Destination host unreachable.Ping statistics for 4.4.4.4:Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),PC说明：因为连NAT-enable都不能与10.1.1.0/24和4.4.4.4/32通信，所以PC也不能。查看NAT-enable路由器的NAT转换表NAT-enable#show ip nat translations Pro Inside global Inside local Outside local Outside globaltcp 23.1.1.3:1025 30.1.1.1:1025 2.2.2.2:23 2.2.2.2:23tcp 23.1.1.3:1026 30.1.1.1:1026 2.2.2.2:23 2.2.2.2:23NAT-enable#NAT-enable路由器已经将PC发往外部的数据源地址转换成自己的外网接口地址23.1.1.3在EzVPN-server上配置EzVPNEzVPN-server(config)#aaa new-modle /开启AAA认证EzVPN-server(config)#aaa authentication login cisco1 local /命名cisco1，对cisco1 认证EzVPN-server(config)#aaa authorization network cisco2 local /命名cisco2，对cisco2 的时间授权EzVPN-server(config)#username chinaccie password chinaccie /创建用户名密码说明：路由器上AAA为EzVPN的必配部分，定义本地用户数据库认证，并创建了本地用户名chinaccie以及密码chinaccie配置IKE（ISAKMP）策略EzVPN-server(config)#crypto isakmp policy 1 /IPsec阶段一的安全参数配置EzVPN-server(config-isakmp)#encryption 3desEzVPN-server(config-isakmp)#hash sha EzVPN-server(config-isakmp)#authentication pre-share EzVPN-server(config-isakmp)#group 2说明：定义了ISAKMP policy 1，加密方式为3des，hash算法为sha，认证方式为pre-shared keys（diffie-hellman）为group 2。定义EzVPN client连接上来后自动分配的地址池EzVPN-server(config)#ip local pool net10 10.1.1.100 10.1.1.200 /EzVPN接入后所分配的地址说明：分配给EzVPN client连接上来后地址池为10.1.1.100-10.1.1.200配置用户组策略每个连接上来的EzVPN client都与一个用户组相关联，如果没有配置特定组，但配置了默认组，用户将和默认组相关联EzVPN-server(config)#crypto isakmp client configuration group chinaccie /EzVPN组和密码配置EzVPN-server(config-isakmp-group)#key cisco123EzVPN-server(config-isakmp-group)#pool net10说明：用户组名为chinaccie，该组的密码为cisco123，所有连接上来的client分配的地址池名为net10，即前面定义的地址池，以及其它一些参数。配置IPsec transformEzVPN-server(config-isakmp-group)#exitEzVPN-server(config)#crypto ipsec transform-set ccie esp-3des esp-sha-hmac IPsec阶段二的配置说明：配置transform-set为ccie，其中数据封装使用esp加3des加密，并且使用esp结合sha做hash计算，默认的IPsec mode为tunnel。定义crypto mapEzVPN-server(config)#crypto dynamic-map mymap ? Sequence to insert into dynamic-map entryEzVPN-server(config)#crypto dynamic-map mymap 1 /动态加密图EzVPN-server(config-crypto-map)#reverse-route /反向路由注入EzVPN-server(config-crypto-map)#set transform-set ccie说明：动态crypto map 和静态crypto map 都可以，调用的IPsec transform为ccie，在路由器中必须配置reverse-route功能关联认证信息EzVPN-server(config-crypto-map)#exitEzVPN-server(config)#crypto map ezvpn client configuration address respond /如果client是1.x，则不是respond而是initiateEzVPN-server(config)#crypto map ezvpn client authentication list cisco1 定义认证EzVPN-server(config)#crypto map ezvpn isakmp authorization list cisco2 定义认证查询IKE queryingEzVPN-server(config)#crypto map ezvpn 1 ipsec-isakmp dynamic mymap说明：以上是对EzVPN的认证，授权配置，list是调用上面的AAA配置名，并且最后，动态加密图必须有静态绑定。应用crypto mapEzVPN-server(config)#int fa 0/0EzVPN-server(config-if)#crypto map ezvpn /绑定到接口*Jan 3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ONEzVPN-server(config-if)#说明：将crypto map 关联到外网接口F0/0。测试EzVPN在PC上创建EzVPN连接密码是chinaccie再次测试PC到总部的10.1.1.0/24和4.4.4.4/32的连通性PCping 10.1.1.4Pinging 10.1.1.4 with 32 bytes of data:Request timed out.Request timed out.Reply from 10.1.1.4: bytes=32 time=13ms TTL=254Reply from 10.1.1.4: bytes=32 time=15ms TTL=254Ping statistics for 10.1.1.4:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 13ms, Maximum = 15ms, Average = 14msPCPCPCping 4.4.4.4Pinging 4.4.4.4 with 32 bytes of data:Reply from 4.4.4.4: bytes=32 time=18ms TTL=254Reply from 4.4.4.4: bytes=32 time=18ms TTL=254Reply from 4.4.4.4: bytes=32 time=12ms TTL=254Reply from 4.4.4.4: bytes=32 time=19ms TTL=254Ping statistics for 4.4.4.4:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 12ms, Maximum = 19ms, Average = 16msPC说明：因为已经与EzVPN-server路由器建立EzVPN连接，所以现在与总部的10.1.1.0/24和4.4.4.4/32通信正常查看PC到总部的10.1.1.0/24和4.4.4.4/32的路径走向PCtracert 10.1.1.4Tracing route to 10.1.1.4 over a maximum of 30 hops: 1 13 ms 5 ms 13 ms 12.1.1.12 18 ms 8 ms 11 ms 10.1.1.4Trace complete.PCtracert 4.4.4.4Tracing route to 4.4.4.4 over a maximum of 30 hops: 1 6 ms 13 ms 16 ms 12.1.1.12 13 ms 18 ms 9 ms 4.4.4.4Trace complete.PC说明;从PC发向总部的数据包直接就到达了总部路由器，说明中间的多跳已经被VPN隧道取代为一跳了查看PC到总部的数据包源地址PCtelnet 10.1.1.4Trying 10.1.1.4 .Openzongbushzongbushow uzongbushow users Line User Host(s) Idle Location0 con 0 idle 00:09:52 * 67 vty 0 idle 00:00:00 10.1.1.100Interface User Mode Idle Peer Addresszongbusm :EzVPN client是从server那里动态分配的地址为源地址和总部内网进行通信的，这里也能说明，EzVPN client从server那里动态分配的地址可以是任意地址段，和server当前连接的网络（10.1.1.0/24）属同一网段也没有关系再次测试PC到Internet路由器loopback地址的连通性PCping 2.2.2.2Pinging 2.2.2.2 with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for 2.2.2.2:Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),PC说明：在PC连通EzVPN之后，到Internet的loopback通信失败，说明正常情况下，PC连通EzVPN之后，所有的数据包都发往EzVPN server，但EzVPN server却不会将来自client的流量从开启了EzVPN的接口发出去，但其它就扣，比如内网。查看EzVPN-server的路由表情况EzVPN-server#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 12.1.1.2 to network 0.0.0.04.0.0.0/32 is subnetted, 1 subnetsS 4.4.4.4 1/0 via 10.1.1.410.0.0.0/8 is variably subnetted, 2 subnets, 2 masksC 10.1.1.0/24 is directly connected, FastEthernet0/1S 10.1.1.100/32 1/0 via 23.1.1.312.0.0.0/24 is subnetted, 1 subnetsC 12.1.1.0 is directly connected, FastEthernet0/0S* 0.0.0.0/0 1/0 via 12.1.1.2EzVPN-server#说明：由于开启了reverse-route，所以EzVPN server自动产生了一条指向动态分配给client的主机地址的路由查看EzVPN-server上的IKE SA（ISAKMP SA）EzVPN-server#show crypto isakmp sa IPv4 Crypto ISAKMP SAdst src state conn-id slot status23.1.1.3 12.1.1.1 QM_IDLE 1041 0 ACTIVEIPv6 Crypto ISAKMP SAEzVPN-server说明：IKE SA已经成功建立，EzVPN-server本地源地址为12.1.1.1目标地址为23.1.1.3。查看EzVPN-server上的IPsec SAEzVPN-server#show crypto ipsec sa interface: FastEthernet0/0Crypto map tag: ezvpn, local addr 12.1.1.1protected vrf: (none)local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.1.1.100/255.255.255.255/0/0)current_peer 23.1.1.3 port 500PERMIT, flags=origin_is_acl,#pkts encaps: 69, #pkts encrypt: 69, #pkts digest: 0#pkts decaps: 72, #pkts decrypt: 72, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 12.1.1.1, remote crypto endpt.:23.1.1.3path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0current outbound spi: 0x3B58724A(995652170)inbound esp sas:spi: 0x77C50B30(2009402160)transform: esp-3des esp-sha-hmac ,in use settings =Tunnel, conn id: 2000, flow_id: FPGA:1, crypto map: ezvpnsa timing: remaining key lifetime (k/sec): (4525504/1037)IV size: 16 bytesreplay detection support: NStatus: ACTIVEinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x3B58724A(995652170)transform: esp-3des esp-sha-hmac ,in use settings =Tunnel, conn id: 2001, flow_id: FPGA:1, crypto map: ezvpnsa timing: remaining key lifetime (k/sec): (4525504/1037)IV size: 16 bytesreplay detection support: NStatus: ACTIVEoutbound ah sas:outbound pcp sas:EzVPN-server#说明：IPsec SA显示了任何去往client的流量都会被加密配置隧道分离（split tunneling）在R1上配置隧道分离EzVPN-server#conf tEnter configuration commands, one per line. End with CNTL/Z.EzVPN-server(config)#no ip local pool net10 10.1.1.100 10.1.1.200EzVPN-server(config)#ip local pool net10 100.1.1.100 100.1.1.200EzVPN-server(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 any EzVPN-server(config)#access-list 100 permit ip host 4.4.4.4 any EzVPN-server(config)#crypto isakmp client configuration group chinaccieEzVPN-server(config-isakmp-group)#acl ?% Unrecognized commandEzVPN-server(config-isakmp-group)#a?% Unrecogn