Configuring-GRE-Tunnels-课件

1、IPsec VPNsConfiguring GRE Tunnels over IPsecGeneric Routing EncapsulationGeneric Routing EncapsulationOSI Layer 3 tunneling protocol:OSI第三层隧道协议:Uses IP for transport使用IP传输Uses an additional header to support any other OSI Layer 3 protocol as payload (e.g., IP, IPX, AppleTalk)使用附加的报头支持其它的第三层的协议,其它的第三

2、层的协议被作为负载(如IP,IPX,AppleTalk)Default GRE CharacteristicsTunneling of arbitrary OSI Layer 3 payload is the primary goal of GREStateless (no flow control mechanisms)No security (no confidentiality, data authentication, or integrity assurance)24-byte overhead by default (20-byte IP header and 4-byte GRE

3、 header)Optional GRE ExtensionsGRE can optionally contain any one or more of these fields:Tunnel checksumTunnel keyTunnel packet sequence numberGRE keepalives can be used to track tunnel path status.GRE Configuration ExampleGRE tunnel is up and protocol up if:Tunnel source and destination are config

4、uredTunnel destination is in routing tableGRE keepalives are received (if used)GRE is the default tunnel mode.Introducing Secure GRE TunnelsIntroducing Secure GRE TunnelsGRE is good at tunneling:GRE隧道优点:Multiprotocol support多协议的支持Provides virtual point-to-point connectivity, allowing routing protoco

5、ls to be used提供了虚拟的点到点的连接,允许使用路由协议GRE is poor at securityonly very basic plaintext authentication can be implemented using the tunnel key (not very secure)GRE的安全性不高通过隧道密钥仅仅可以支持基本的明文认证(非常不安全)Introducing Secure GRE Tunnels (Cont.)GRE cannot accommodate typical security requirements:GRE不能提供典型安全的特性:Conf

6、identiality机密性Data source authentication数据源的认证Data integrity数据完整性IPsec CharacteristicsIPsec provides what GRE lacks:IPsec能够提供GRE无法实现的如下安全特性:Confidentiality through encryption using symmetric algorithms (e.g., 3DES or AES)通过使用对称式的加密算法实现数据的机密性(如3DES或AES)Data source authentication using HMACs (e.g., MD

7、5 or SHA-1)使用HMACs实现数据的源认证(如MD5或SHA-1)Data integrity verification using HMACs同时HMACs还提供的数据完整性的确认IPsec Characteristics (Cont.)IPsec is not perfect at tunneling:当以隧道方式工作时,IPsec并不是最好的:Older Cisco IOS software versions do not support IP multicast over IPsec老版的Cisco IOS软件版本可能不支持基于IPsec的组播IPsec was design

8、ed to tunnel IP only (no multiprotocol support)IPsec仅仅设计用于IP的网络环境(不支持多协议的环境)Using crypto maps to implement IPsec does not allow the usage of routing protocols across the tunnel使用加密图实现的IPsec不允许一些路由协议产生的数据包通过隧道,其本身也不支持广播IPsec does not tunnel IP protocols; GRE doesGRE over IPsecGRE over IPsec is typica

9、lly used to do the following:GRE over IPsec通过用于如下的情况:Create a logical hub-and-spoke topology of virtual point-to-point connections使用点到点的虚链路创建逻辑的hub-and-spoke拓扑Secure communication over an untrusted transport network (e.g., Internet)在不安全的传输网络中保护通信(如Internet)GRE over IPsec CharacteristicsGRE encapsula

10、tes arbitrary payload.IPsec encapsulates unicast IP packet (GRE):Tunnel mode (default): IPsec creates a new tunnel IP packetTransport mode: IPsec reuses the IP header of the GRE (20 bytes less overhead)Configuring GRE over IPsec Site-to-Site Tunnel Using SDMConfiguring GRE over IPsecSite-to-Site Tun

11、nel Using SDM.3.4.Configuring GRE over IPsecSite-to-Site Tunnel Using SDM (Cont.)Configuring GRE over IPsecSite-to-Site Tunnel Using SDM (Cont.).Backup GRE Tunnel InformationBackup GRE Tunnel Information.VPN Authentication InformationVPN Authentication Information2.1A1BIKE Propo

12、salsIKE ProposalsCreating a Custom IKE PolicyDefine all IKE policy parameters:PriorityEncryption algorithm: DES, 3DES, AESHMAC: SHA-1 or MD5Authentication method: preshared secrets or digital certificatesDiffie-Hellman group: 1, 2, or 5IKE lifetimeTransform SetTransform Set1.2.3.Routing InformationR

13、outing InformationOption 1: Static RoutingOption 2: Dynamic Routing Using EIGRP1.2.Option 3: Dynamic Routing Using OSPF1.3.2.Completing the ConfigurationReview the Generated ConfigurationReview the Generated Configuration (Cont.)Test Tunnel Configuration and Operation.3.5.Test Tunnel Configur

14、ationand Operation (Cont.)7.Monitor Tunnel Operation1.2.3.Advanced MonitoringAdvanced monitoring can be performed using the default Cisco IOS HTTP server interface.Requires knowledge of Cisco IOS CLI commands.show crypto isakmp saLists active IKE sessionsrouter#show crypto ipsec saLists active IPsec

15、 security associationsrouter#show interfacesLists interface and the statistics including the statistics of tunnel interfacesrouter#Troubleshootingdebug crypto isakmprouter#Debugs IKE communicationAdvanced troubleshooting can be performed using the Cisco IOS CLIRequires knowledge of Cisco IOS CLI commandsSummaryGRE is a multiprotocol tunneling technology.SDM can be used to implement GRE over IPsec site-to-site VPNs.Backup tunnels can be configured in addition to one primary tunnel.Rou