H3C v7版本 ipsec over gre配置指导.docx

Ipsec over gre配置RT1和RT3用环回口来模拟私网上的接口。它们的封装方式是先封装ipsec，然后在进行gre的封装，所以在ipsec的ACL中要匹配的事两端私网的地址。报文的封装格式：IP公|gre|ip头|esp头|ip私|date|esp尾RT1的主要配置：进入系统试图system-view配置接口IPH3Cinterface GigabitEthernet 0/0H3C-GigabitEthernet0/0ip address 10.1.1.1 24创建环回接口：H3C-GigabitEthernet0/0quitH3Cinterface LoopBack 0H3C-LoopBack0ip address 192.168.1.1 32创建Tunnel口：H3C-LoopBack0quitH3Cinterface Tunnel 0 mode greH3C-Tunnel0ip address 100.1.1.1 24指定Tunnel口源接口地址H3C-Tunnel0source 10.1.1.1指定Tunnel口目的端地址H3C-Tunnel0destination 20.1.1.2H3C-Tunnel0 quit创建访问控制列表H3Cacl advanced 3000H3C-acl-ipv4-adv-3000rule 0 permit ip source 192.168.1.1 0.0.0.0 destination 192.168.2.1 0.0.0.0H3C-acl-ipv4-adv-3000quit创建ipsec安全提议tran1H3Cipsec transform-set tran1指定安全协议的工作模式为隧道模式H3C-ipsec-transform-set-tran1encapsulation-mode tunnel 选择安全协议为espH3C-ipsec-transform-set-tran1protocol esp加密算法为desH3C-ipsec-transform-set-tran1esp encryption-algorithm des-cbc验证算法为md5H3C-ipsec-transform-set-tran1esp authentication-algorithm md5H3C-ipsec-transform-set-tran1quit配置ike kaychain，创建ike1H3Cike keychain ike1配置对端tunnel口的IP和使用的预共享秘钥H3C-ike-keychain-ike1pre-shared-key address 100.1.1.2 24 key simple 123H3C-ike-keychain-ike1quit创建ike profile，名称为profile1H3Cike profile profile1绑定ike keychainH3C-ike-profile-profile1keychain ike1配置本地封装的IP地址H3C-ike-profile-profile1local-identity address 100.1.1.1配置对端封装的IP地址H3C-ike-profile-profile1match remote identity address 100.1.1.2 24H3C-ike-profile-profile1quit创建一条ike协商方式的ipsec安全策略，序列号为1，名字为policy1H3Cipsec policy policy1 1 isakmp指定引用ACL3000H3C-ipsec-policy-isakmp-policy1-1security acl 3000指定引用的ike profile为profile1H3C-ipsec-policy-isakmp-policy1-1ike-profile profile1指定引用的安全协议为tran1H3C-ipsec-policy-isakmp-policy1-1transform-set tran1指定对端隧道地址H3C-ipsec-policy-isakmp-policy1-1remote-address 100.1.1.2H3C-ipsec-policy-isakmp-policy1-1quit进入Tunnel0H3Cinterface Tunnel0把ipsec策略在Tunnel口生效H3C-Tunnel0ipsec apply policy policy1在三个路由器之间使用rip路由协议H3CripH3C-rip-1version 2H3C-rip-1undo summaryH3C-rip-1network 10.1.1.1RT2的主要配置：system-viewH3Cinterface GigabitEthernet 0/0H3C-GigabitEthernet0/0ip address 10.1.1.2 24H3C-GigabitEthernet0/0quitH3Cinterface GigabitEthernet 0/1H3C-GigabitEthernet0/1 ip address 20.1.1.1 24H3C-GigabitEthernet0/1quit配置rip路由协议H3CripH3C-rip-1version 2H3C-rip-1undo summaryH3C-rip-1network 10.1.1.2H3C-rip-1network 20.1.1.1RT3的主要配置：进入系统试图system-view配置接口IPH3Cinterface GigabitEthernet 0/0H3C-GigabitEthernet0/0ip address 20.1.1.2 24创建环回接口：H3C-GigabitEthernet0/0quitH3Cinterface LoopBack 0H3C-LoopBack0ip address 192.168.2.1 32创建Tunnel口：H3C-LoopBack0quitH3Cinterface Tunnel 0 mode greH3C-Tunnel0ip address 100.1.1.1 24指定Tunnel口源接口地址H3C-Tunnel0source 20.1.1.2指定Tunnel口目的端地址H3C-Tunnel0destination 10.1.1.1H3C-Tunnel0 quit创建访问控制列表H3Cacl advanced 3000H3C-acl-ipv4-adv-3000rule 0 permit ip source 192.168.2.1 0.0.0.0 destination 192.168.1.1 0.0.0.0H3C-acl-ipv4-adv-3000quit创建ipsec安全提议tran1H3Cipsec transform-set tran1指定安全协议的工作模式为隧道模式H3C-ipsec-transform-set-tran1encapsulation-mode tunnel 选择安全协议为espH3C-ipsec-transform-set-tran1protocol esp加密算法为desH3C-ipsec-transform-set-tran1esp encryption-algorithm des-cbc验证算法为md5H3C-ipsec-transform-set-tran1esp authentication-algorithm md5H3C-ipsec-transform-set-tran1quit配置ike kaychain，创建ike1H3Cike keychain ike1配置对端tunnel口的IP和使用的预共享秘钥H3C-ike-keychain-ike1pre-shared-key address 100.1.1.1 24 key simple 123H3C-ike-keychain-ike1quit创建ike profile，名称为profile1H3Cike profile profile1绑定ike keychainH3C-ike-profile-profile1keychain ike1配置本地封装的IP地址H3C-ike-profile-profile1local-identity address 100.1.1.2配置对端封装的IP地址H3C-ike-profile-profile1match remote identity address 100.1.1.1 24H3C-ike-profile-profile1quit创建一条ike协商方式的ipsec安全策略，序列号为1，名字为policy1H3Cipsec policy policy1 1 isakmp指定引用ACL3000H3C-ipsec-policy-isakmp-policy1-1security acl 3000指定引用的ike profile为profile1H3C-ipsec-policy-isakmp-policy1-1ike-profile profile1指定引用的安全协议为tran1H3C-ipsec-policy-isakmp-policy1-1transform-set tran1指定对端隧道地址H3C-ipsec-policy-isakmp-policy1-1remote-address 100.1.1.1H3C-ipsec-policy-isakmp-policy1-1quit进入Tunnel0H3Cinterface Tunnel0把ipsec策略在Tunnel口生效H3C-Tunnel0ipsec apply policy policy1配置rip路由协议H3CripH3C-rip-1version 2H3C-rip-1undo summary H3C-rip-1network 20.1.1.2测试从RT1的环回口来ping RT3的环回口H3Cping -a 192.168.1.1 192.168.2.1Ping 192.168.2.1 (192.168.2.1) from 192.168.1.1: 56 data bytes, press CTRL_C to breakRequest time out56 bytes from 192.