IPSecl2lVPN配置实验详解.docx

IPSec l2l VPN配置实验实验拓扑实验需求：配置最传统的IPSec L2L VPN，并且分析过程！分析：实验拓扑如上，Site1和Site2已经实现公网IP可达，身后各自有一个私网1.1.1.0/24和2.2.2.0/24，因为Internet没有相应私网的路由，所以两个私网无法正常通信，现在的任务是通过IPSec VPN将它们搞通！准备：必须保证Site1和Site2是公网可达的，Site1和Site2的IP配置如下：Site1#show ip int brief Interface IP-Address OK? Method Status ProtocolSerial0/0 202.100.1.1 YES NVRAM up up /公网接口IP Serial0/1 unassigned YES NVRAM administratively down down Serial0/2 unassigned YES NVRAM administratively down down Serial0/3 unassigned YES NVRAM administratively down down Loopback0 1.1.1.1 YES NVRAM up up/身后私网 -Site2#show ip int brief Interface IP-Address OK? Method Status ProtocolSerial0/0 unassigned YES NVRAM up down Serial0/1 61.128.1.1 YES NVRAM up up /公网接口IP Serial0/2 unassigned YES NVRAM administratively down down Serial0/3 unassigned YES NVRAM administratively down down Loopback0 2.2.2.2 YES NVRAM up up /身后私网 -Internet#show ip int brief Interface IP-Address OK? Method Status ProtocolSerial0/0 202.100.1.10 YES NVRAM up up Serial0/1 61.128.1.10 YES NVRAM up up Serial0/2 unassigned YES NVRAM administratively down down Serial0/3 unassigned YES NVRAM administratively down down 注：Site1必须要有通往Site2加密点和通信点的路由，千万不要遗漏通信点路由，要不然VPN肯定不通，这是因为流量撞击静态map时候匹配上感兴趣流会被加密，但是此时路由器会进行二次路由查询，此时查询的正是通信点路由；Site2也是一样的道理，我这里配置的是默认路由，也可以配置明细！Site1(config)#ip route 0.0.0.0 0.0.0.0 202.100.1.10Site2(config)#ip route 0.0.0.0 0.0.0.0 61.128.1.10注：个人对IPSec VPN的理解是它就是路由的拓展，做IPSec VPN之前必须把路由问题给解决掉！测试：两个Site的加密点可以互通：Site1#ping 61.128.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 61.128.1.1, timeout is 2 seconds:!此时两个通信点肯定是不通的：（也许有人会说那直接在Internet加上私网路由不就行了吗，每次听到这个我都想笑）Site1#ping 2.2.2.2 sou loo 0Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:Packet sent with a source address of 1.1.1.1 .下面开始配置IPSec VPNSite1(config)#crypto isakmp policy 10Site1(config-isakmp)#authentication pre-share Site1(config-isakmp)#hash md5 Site1(config-isakmp)#encryption 3des Site1(config-isakmp)#group 2注：必须要配置的就是认证方式，因为认证方式默认是rsa-encr（证书认证），现在没有CA server，这一点实现不了，认证方式必须改成pre-share（域共享密钥），其它的都可以继承系统默认的，双方站点的所有policy下的配置必须一样，当然policy ID可以不一样，以上是第一阶段的策略！Site1(config)#crypto isakmp key 6 cisco address 61.128.1.1注：配置第一阶段isakmp SA的域共享秘密，这个秘密的名字叫做cisco，只有双方站点的域共享秘密的名字一样才可以继续第二阶段IPSec SA！Site1(config)#ip access-list extended VPN-ACLSite1(config-ext-nacl)#per ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255注：配置感兴趣流，只有被感兴趣流匹配上才会进行加密，在Site1自然就是1.1.1.0/24到2.2.2.0/24的流量啦！Site1(config)#crypto ipsec transform-set VPN-TR esp-des esp-md5-hmac Site1(cfg-crypto-trans)#moSite1(cfg-crypto-trans)#mode ? transport transport (payload encapsulation) mode tunnel tunnel (datagram encapsulation) mode注：配置第二阶段IPSec SA的策略，也叫转换级esp封装des加密，esp封装md5做hmac，第二阶段的策略双方站点必须一致，里面可以配置esp封装的模式，默认是tunnel！Site1(config)#crypto map VPN-MAP 10 ipsec-isakmp % NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured.Site1(config-crypto-map)#mat address VPN-ACLSite1(config-crypto-map)#set peer 61.128.1.1Site1(config-crypto-map)#set transform-set VPN-TR注：现在是配置静态map，这种配置方法是最传统的IPSec l2l VPN的配置，也是不够好的配置；所谓的高级IPSec VPN配置主要是差别在这里，可以采用动态map然后静态map调用动态map；或者更加高级的isakmp profile 结合ipsec profile，当然现在只是最简单的配置，高级的那些暂且不说！静态map里面必须配置peer，match感兴趣流，set转换级！Site1(config-if)#crypto map VPN-MAP*Jun 3 14:41:42.155: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON注：记住一句话，静态map肯定是调用在公网接口的，看到ISAKMP is ON就对啦！Site2基本是一样的配置，注意感兴趣流要反过来！Site1#ping 2.2.2.2 sou loo 0Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:Packet sent with a source address of 1.1.1.1 .!Success rate is 80 percent (4/5), round-trip min/avg/max = 24/26/28 ms注：期待已久的最终结果终于出来了，两个私网终于通起来了！此时可以show一些信息：Site1#show crypto engine conn active Crypto Engine Connections ID Type Algorithm Encrypt Decrypt IP-Address 1 IPsec DES+MD5 0 4 202.100.1.1 2 IPsec DES+MD5 4 0 202.100.1.1 1001 IKE MD5+3DES 0 0 202.100.1.1注：可以看到第一二阶段SA的摘要信息，IKE是SA第一阶段，IPSec是SA第二阶段，真正加密实际数据的是第二阶段的SA！刚才通了四个包，只有四个加解密，继续测试：Site1#ping 2.2.2.2 sou loo 0 re 10 Type escape sequence to abort.Sending 10, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:Packet sent with a source address of 1.1.1.1 ! /通10个，应该是4+10=14个加解密Success rate is 100 percent (10/10), round-trip min/avg/max = 20/26/44 msSite1#show crypto engine conn active Crypto Engine Connections ID Type Algorithm Encrypt Decrypt IP-Address 1 IPsec DES+MD5 0 14 202.100.1.1 2 IPsec DES+MD5 14 0 202.100.1.1 1001 IKE MD5+3DES 0 0 202.100.1.1当然此时可以看一下debug信息，熟悉debug信息有利于我们TS（排错）Site1#show debugging Cryptographic Subsystem: Crypto ISAKMP debugging is on Crypto IPSEC debugging is on注：Site1开了debug，这一次在Site2主动发起：Site1#*Jun 3 15:00:16.303: ISAKMP (0): received packet from 61.128.1.1 dport 500 sport 500 Global (N) NEW SA*Jun 3 15:00:16.303: ISAKMP: Created a peer struct for 61.128.1.1, peer port 500*Jun 3 15:00:16.303: ISAKMP: New peer created peer = 0x215F6A8 peer_handle = 0x80000002*Jun 3 15:00:16.303: ISAKMP: Locking peer struct 0x215F6A8, refcount 1 for crypto_isakmp_process_block*Jun 3 15:00:16.303: ISAKMP: local port 500, remote port 500 /isakmp的端口号，源目端口都是UDP 500*Jun 3 15:00:16.303: ISAKMP:(0):insert sa successfully sa = 215ECE8*Jun 3 15:00:16.303: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH*Jun 3 15:00:16.303: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1 *Jun 3 15:00:16.311: ISAKMP:(0): processing SA payload. message ID = 0*Jun 3 15:00:16.311: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch*Jun 3 15:00:16.311: ISAKMP (0): vendor ID is NAT-T RFC 3947*Jun 3 15:00:16.311: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch*Jun 3 15:00:16.311: ISAKMP (0): vendor ID is NAT-T v7*Jun 3 15:00:16.311: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID is NAT-T v3*Jun 3 15:00:16.311: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch*Jun 3 15:00:16.311: ISAKMP:(0): vendor ID is NAT-T v2*Jun 3 15:00:16.311: ISAKMP:(0):found peer pre-shared key matching 61.128.1.1*Jun 3 15:00:16.311: ISAKMP:(0): local preshared key found*Jun 3 15:00:16.311: ISAKMP : Scanning profiles for xauth .*Jun 3 15:00:16.311: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy*Jun 3 15:00:16.311: ISAKMP: encryption DES-CBC*Jun 3 15:00:16.311: ISAKMP: hash SHA*Jun 3 15:00:16.311: ISAKMP: default group 1*Jun 3 15:00:16.311: ISAKMP: auth pre-share*Jun 3 15:00:16.311: ISAKMP: life type in seconds*Jun 3 15:00:16.311: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Jun 3 15:00:16.311: ISAKMP:(0):atts are acceptable. Next payload is 0*Jun 3 15:00:16.311: ISAKMP:(0):Acceptable atts:actual life: 0*Jun 3 15:00:16.311: ISAKMP:(0):Acceptable atts:life: 0*Jun 3 15:00:16.311: ISAKMP:(0):Fill atts in sa vpi_length:4*Jun 3 15:00:16.311: ISAKMP:(0):Fill atts in sa life_in_seconds:86400*Jun 3 15:00:16.311: ISAKMP:(0):Returning Actual lifetime: 86400*Jun 3 15:00:16.311: ISAKMP:(0):Started lifetime timer: 86400.*Jun 3 15:00:16.315: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch*Jun 3 15:00:16.315: ISAKMP (0): vendor ID is NAT-T RFC 3947*Jun 3 15:00:16.315: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch*Jun 3 15:00:16.315: ISAKMP (0): vendor ID is NAT-T v7*Jun 3 15:00:16.315: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID is NAT-T v3*Jun 3 15:00:16.315: ISAKMP:(0): processing vendor id payload*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch*Jun 3 15:00:16.315: ISAKMP:(0): vendor ID is NAT-T v2*Jun 3 15:00:16.315: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE*Jun 3 15:00:16.315: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM1 *Jun 3 15:00:16.315: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID*Jun 3 15:00:16.315: ISAKMP:(0): sending packet to 61.128.1.1 my_port 500 peer_port 500 (R) MM_SA_SETUP*Jun 3 15:00:16.315: ISAKMP:(0):Sending an IKE IPv4 Packet.*Jun 3 15:00:16.315: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE*Jun 3 15:00:16.315: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM2 *Jun 3 15:00:16.347: ISAKMP (0): received packet from 61.128.1.1 dport 500 sport 500 Global (R) MM_SA_SETUP*Jun 3 15:00:16.347: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH*Jun 3 15:00:16.347: ISAKMP:(0):Old State = IKE_R_MM2 New State = IKE_R_MM3 *Jun 3 15:00:16.347: ISAKMP:(0): processing KE payload. message ID = 0*Jun 3 15:00:16.351: ISAKMP:(0): processing NONCE payload. message ID = 0*Jun 3 15:00:16.351: ISAKMP:(0):found peer pre-shared key matching 61.128.1.1*Jun 3 15:00:16.351: ISAKMP:(1001): processing vendor id payload*Jun 3 15:00:16.351: ISAKMP:(1001): vendor ID is DPD*Jun 3 15:00:16.351: ISAKMP:(1001): processing vendor id payload*Jun 3 15:00:16.351: ISAKMP:(1001): speaking to another IOS box!*Jun 3 15:00:16.351: ISAKMP:(1001): processing vendor id payload*Jun 3 15:00:16.351: ISAKMP:(1001): vendor ID seems Unity/DPD but major 152 mismatch*Jun 3 15:00:16.351: ISAKMP:(1001): vendor ID is XAUTH*Jun 3 15:00:16.351: ISAKMP:received payload type 20*Jun 3 15:00:16.351: ISAKMP (1001): His hash no match - this node outside NAT*Jun 3 15:00:16.351: ISAKMP:received payload type 20*Jun 3 15:00:16.351: ISAKMP (1001): No NAT Found for self or peer*Jun 3 15:00:16.351: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE*Jun 3 15:00:16.351: ISAKMP:(1001):Old State = IKE_R_MM3 New State = IKE_R_MM3 *Jun 3 15:00:16.355: ISAKMP:(1001): sending packet to 61.128.1.1 my_port 500 peer_port 500 (R) MM_KEY_EXCH*Jun 3 15:00:16.355: ISAKMP:(1001):Sending an IKE IPv4 Packet.*Jun 3 15:00:16.355: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE*Jun 3 15:00:16.355: ISAKMP:(1001):Old State = IKE_R_MM3 New State = IKE_R_MM4 *Jun 3 15:00:16.379: ISAKMP (1001): received packet from 61.128.1.1 dport 500 sport 500 Global (R) MM_KEY_EXCH*Jun 3 15:00:16.379: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH*Jun 3 15:00:16.379: ISAKMP:(1001):Old State = IKE_R_MM4 New State = IKE_R_MM5 *Jun 3 15:00:16.379: ISAKMP:(1001): processing ID payload. message ID = 0*Jun 3 15:00:16.379: ISAKMP (1001): ID payload next-payload : 8 type : 1 address : 61.128.1.1 protocol : 17 port : 500 length : 12*Jun 3 15:00:16.379: ISAKMP:(0): peer matches *none* of the profiles*Jun 3 15:00:16.379: ISAKMP:(1001): processing HASH payload. message ID = 0*Jun 3 15:00:16.379: ISAKMP:(1001): processing NOTIFY INITIAL_CONTACT protocol 1 spi 0, message ID = 0, sa = 215ECE8*Jun 3 15:00:16.379: ISAKMP:(1001):SA authentication status: authenticated*Jun 3 15:00:16.379: ISAKMP:(1001):SA has been authenticated with 61.128.1.1*Jun 3 15:00:16.379: ISAKMP:(1001):SA authentication status: authenticated*Jun 3 15:00:16.379: ISAKMP:(1001): Process initial contact,bring down existing phase 1 and 2 SAs with local 202.100.1.1 remote 61.128.1.1 remote port 500*Jun 3 15:00:16.379: ISAKMP: Trying to insert a peer 202.100.1.1/61.128.1.1/500/, and inserted successfully 215F6A8.*Jun 3 15:00:16.379: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE*Jun 3 15:00:16.379: ISAKMP:(1001):Old State = IKE_R_MM5 New State = IKE_R_MM5 *Jun 3 15:00:16.379: IPSEC(key_engine): got a queue event with 1 KMI message(s)*Jun 3 15:00:16.379: ISAKMP:(1001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR*Jun 3 15:00:16.379: ISAKMP (1001): ID payload next-payload : 8 type : 1 address : 202.100.1.1 protocol : 17 port : 500 length : 12*Jun 3 15:00:16.379: ISAKMP:(1001):Total payload length: 12*Jun 3 15:00:16.379: ISAKMP:(1001): sending packet to 61.128.1.1 my_port 500 peer_port 500 (R) MM_KEY_EXCH*Jun 3 15:00:16.379: ISAKMP:(1001):Sending an IKE IPv4 Packet.*Jun 3 15:00:16.379: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE*Jun 3 15:00:16.379: ISAKMP:(1001):Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE *Jun 3 15:00:16.379: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE*Jun 3 15:00:16.379: ISAKMP:(1001):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jun 3 15:00:16.407: ISAKMP (1001): received packet from 61.128.1.1 dport 500 sport 500 Global (R) QM_IDLE *Jun 3 15:00:16.407: ISAKMP: set new node 2140062334 to QM_IDLE *Jun 3 15:00:16.407: ISAKMP:(1001): processing HASH payload. message ID = 2140062334*Jun 3 15:00:16.407: ISAKMP:(1001): processing SA payload. message ID = 2140062334*Jun 3 15:00:16.407: ISAKMP:(1001):Checking IPSec proposal 1*Jun 3 15:00:16.407: ISAKMP: transform 1, ESP_DES*Jun 3 15:00:16.407: ISAKMP: attributes in transform:*Jun 3 15:00:16.407: ISAKMP: encaps is 1 (Tunnel)*Jun 3 15:00:16.407: ISAKMP: SA life type in seconds*Jun 3 15:00:16.407: ISAKMP: SA life duration (basic) of 3600*Jun 3 15:00:16.407: ISAKMP: SA life type in kilobytes*Jun 3 15:00:16.407: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Jun 3 15:00:16.407: ISAKMP: authenticator is HMAC-MD5*Jun 3 15:00:16.407: ISAKMP:(1001):atts are acceptable.*Jun 3 15:00:16.407: IPSEC(validate_proposal_request): proposal part #1*Jun 3 15:00:16.407: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 202.100.1.1, remote= 61.128.1.1, local_proxy= 1.1.1.0/255.255.255.0/0/0 (type=4), remote_proxy= 2.2.2.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= NONE (Tunnel), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0*Jun 3 15:00:16.407: Crypto mapdb : proxy_match src addr : 1.1.1.0 dst addr : 2.2.2.0 protocol : 0 src port : 0 dst port : 0*Jun 3 15:00:16.407: ISAKMP:(1001): processing NONCE payload. message ID = 2140062334*Jun 3 15:00:16.407: ISAKMP:(1001): processing ID payload. message ID = 2140062334*Jun 3 15:00:16.407: ISAKMP:(1001): processing ID payload. message ID = 2140062334*Jun 3 15:00:16.407: ISAKMP:(1001):QM Responder gets spi*Jun 3 15:00:16.407: ISAKMP:(1001):Node 2140062334, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH*Jun 3 15:00:16.407: ISAKMP:(1001):Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE*Jun 3 15:00:16.407: ISAKMP:(1001): Creating IPSec SAs*Jun 3 15:00:16.407: inbound SA from 61.128.1.1 to 202.100.1.1 (f/i) 0/ 0 (proxy 2.2.2.0 to 1.1.1.0)*Jun 3 15:00:16.407: has spi 0xE3898907 and conn_id 0*Jun 3 15:00:16.407: lifetime of 3600 seconds*Jun 3 15:00:16.407: lifetime of 4608000 kilobytes*Jun 3 15:00:16.407: outbound SA from 202.100.1.1 to 61.128.1.1 (f/i) 0/0 (proxy 1.1.1.0 to 2.2.2.0)*Jun 3 15:00:16.407: has spi 0x1470ED9E and conn_id 0*Jun 3 15:00:16.407: lifetime of 3600 seconds*Jun 3 15:00:16.407: lifetime of 4608000 kilobytes*Jun 3 15:00:16.407: ISAKMP:(1001): sending packet to 61.128.1.1 my_port 500 peer_port 500 (R) QM_IDLE *Jun 3 15:00:16.407: ISAKMP:(1001):Sending an IKE IPv4 Packet.*Jun 3 15:00:16.407: ISAKMP:(1001):Node 2140062334, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI*Jun 3 15:00:16.407: ISAKMP:(1001):Old S