102实验指导Site To Site RSAVPNshen.docx

102实验指导Site To Site RSAVPNshen.docx

《102实验指导Site To Site RSAVPNshen.docx》由会员分享，可在线阅读，更多相关《102实验指导Site To Site RSAVPNshen.docx（17页珍藏版）》请在冰豆网上搜索。

102实验指导SiteToSiteRSAVPNshen

实验指导（SiteToSiteRSA-

VPN）

一、实验任务

任务：

两地已经度连上了internet，现要把两个的网络通过Internet进行互联。

数据在Internet传输时要保证安全性，使用SiteToSiteVPN。

二、实验步骤

1、R1、R2、R3上如图配置IP地址，打开接口，配置路由：

RouterA（R1）:

ints0/0

noshutdown

clockrate128000

ipadd12.12.12.1255.255.255.0

intloopback0

ipadd10.1.1.1255.255.255.0

iproute0.0.0.00.0.0.0s0/0

Internet（R2）:

ints0/0

noshutdown

clockrate128000

ipadd12.12.12.2255.255.255.0

ints0/1

noshutdown

clockrate128000

ipadd23.23.23.2255.255.255.0

RouterB（R3）:

ints0/1

noshutdown

clockrate128000

ipadd23.23.23.3255.255.255.0

intloopback0

ipadd10.3.3.3255.255.255.0

iproute0.0.0.00.0.0.0s0/1

2、R1产生publickey：

!

ipdomainname

crykeygeneratersageneral-keys

r1#showcrykeymypubkeyrsa

%Keypairwasgeneratedat:

01:

15:

46UTCMar12002

Keyname:

Usage:

GeneralPurposeKey

Keyisnotexportable.

KeyData:

305C300D06092A864886F70D0101010500034B003048024100D76D8CC3441343

C35E9680548CFD4C9BCB1D09A4FF938DD1E3CF01924577E40673590E338CAACA

1AFFDF2CFD41CB829B2B240458ED46F82038D014618B6BC5650203010001

3、R3产生publickey：

ipdomainname

crykeygeneratersageneral-keys

r3#showcrykeymypubkeyrsa

%Keypairwasgeneratedat:

01:

27:

02UTCMar12002

Keyname:

Usage:

GeneralPurposeKey

Keyisnotexportable.

KeyData:

305C300D06092A864886F70D0101010500034B003048024100EB4D74CD5CFF80

433BA01FF904932A692BD61858519D900B58C513DFED8A94F29812151AA43EEF

D995FF7B79E07B50513FE373D3622021C216DAFE950230905D0203010001

4、配置R1,使用peerR3的publickey

cryptokeypubkey-chainrsa

addressed-key23.23.23.3

address23.23.23.3

key-string

305C300D06092A864886F70D0101010500034B003048024100EB4D74CD5CFF80

433BA01FF904932A692BD61858519D900B58C513DFED8A94F29812151AA43EEF

D995FF7B79E07B50513FE373D3622021C216DAFE950230905D0203010001

5、配置R3，使用peerR1的publickey：

cryptokeypubkey-chainrsa

addressed-key12.12.12.1

address12.12.12.1

key-string

305C300D06092A864886F70D0101010500034B003048024100D76D8CC3441343

C35E9680548CFD4C9BCB1D09A4FF938DD1E3CF01924577E40673590E338CAACA

1AFFDF2CFD41CB829B2B240458ED46F82038D014618B6BC5650203010001

配置IPSECVPN

R1：

cryptoisakmpenable

cryptoisakmppolicy10!

阶段一

authenticationrsa-encr

cryptoipsectransform-setTRAN-SETesp-desesp-md5-hmac!

配置变换集

cryptomapSTATIC-MAP10ipsec-isakmp!

配置加密图

setpeer23.23.23.3

settransform-setTRAN-SET

matchaddress110!

定义访问控制列表

access-list110permitip10.1.1.00.0.0.25510.3.3.00.0.0.255

!

interfaceSerial0/0

cryptomapSTATIC-MAP!

把加密应用到接口

R3

cryptoisakmpenable!

阶段一

cryptoisakmppolicy10

authenticationrsa-encr

cryptoipsectransform-setTRAN-SETesp-desesp-md5-hmac!

配置变换集

cryptomapSTATIC-MAP10ipsec-isakmp!

配置加密图

setpeer12.12.12.1

settransform-setTRAN-SET

matchaddress110!

定义访问控制列表

!

access-list110permitip10.3.3.00.0.0.25510.1.1.00.0.0.255

!

interfaceSerial0/1

cryptomapSTATIC-MAP!

把加密应用到接口

6、测试：

从RouterA的loopback0接口pingRouterB的loopback0

RouterA：

ping10.3.3.3source10.1.1.1

RouterB：

ping10.1.1.1source10.3.3.3

◆showcryptoisakmppolicy

◆showcryipsectransform-set

◆showcryptomap

◆showcryptoisakmpsa

◆showcryptoipsecsa

◆showcryptoengineconnectionsactive：

看加密、解密数据包数量

◆clearcryptosa

◆clearcryptoisakmp

三、完整配置

===============================R1===============================

hostnamer1

!

boot-start-marker

boot-end-marker

!

!

noaaanew-model

memory-sizeiomem5

!

!

ipcef

noipdomainlookup

ipdomainname

!

!

!

!

!

!

!

cryptokeypubkey-chainrsa

addressed-key23.23.23.3

address23.23.23.3

key-string

305C300D06092A864886F70D0101010500034B003048024100EB4D74CD5CFF80

433BA01FF904932A692BD61858519D900B58C513DFED8A94F29812151AA43EEF

D995FF7B79E07B50513FE373D3622021C216DAFE950230905D0203010001

quit

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

cryptoisakmppolicy10

hashmd5

authenticationrsa-encr

!

!

cryptoipsectransform-setTRAN-SETesp-desesp-md5-hmac

!

cryptomapSTATIC-MAP10ipsec-isakmp

setpeer23.23.23.3

settransform-setTRAN-SET

matchaddress110

!

!

!

!

interfaceLoopback0

ipaddress10.1.1.1255.255.255.0

!

interfaceSerial0/0

ipaddress12.12.12.1255.255.255.0

serialrestart-delay0

clockrate128000

cryptomapSTATIC-MAP

!

interfaceSerial0/1

noipaddress

serialrestart-delay0

!

interfaceSerial0/2

noipaddress

serialrestart-delay0

!

interfaceSerial0/3

noipaddress

serialrestart-delay0

!

iphttpserver

noiphttpsecure-server

!

iproute0.0.0.00.0.0.0Serial0/0

!

!

access-list110permitip10.1.1.00.0.0.25510.3.3.00.0.0.255

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

!

linecon0

exec-timeout00

loggingsynchronous

lineaux0

linevty04

login

!

!

end

===============================R2===============================

!

hostnamer2

!

boot-start-marker

boot-end-marker

!

!

noaaanew-model

memory-sizeiomem5

!

!

ipcef

noipdomainlookup

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

interfaceSerial0/0

ipaddress12.12.12.2255.255.255.0

serialrestart-delay0

clockrate128000

!

interfaceSerial0/1

ipaddress23.23.23.2255.255.255.0

serialrestart-delay0

clockrate128000

!

interfaceSerial0/2

noipaddress

serialrestart-delay0

!

interfaceSerial0/3

noipaddress

serialrestart-delay0

!

iphttpserver

noiphttpsecure-server

!

!

!

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

!

linecon0

exec-timeout00

loggingsynchronous

lineaux0

linevty04

login

!

!

End

===============================R3===============================

!

!

hostnamer3

!

boot-start-marker

boot-end-marker

!

!

noaaanew-model

memory-sizeiomem5

!

!

ipcef

noipdomainlookup

ipdomainname

!

!

!

!

!

!

!

cryptokeypubkey-chainrsa

addressed-key12.12.12.1

address12.12.12.1

key-string

305C300D06092A864886F70D0101010500034B003048024100D76D8CC3441343

C35E9680548CFD4C9BCB1D09A4FF938DD1E3CF01924577E40673590E338CAACA

1AFFDF2CFD41CB829B2B240458ED46F82038D014618B6BC5650203010001

quit

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

cryptoisakmppolicy10

authenticationrsa-encr

!

!

cryptoipsectransform-setTRAN-SETesp-desesp-md5-hmac

!

cryptomapSTATIC-MAP10ipsec-isakmp

setpeer12.12.12.1

settransform-setTRAN-SET

matchaddress110

!

!

!

!

interfaceLoopback0

ipaddress10.3.3.3255.255.255.0

!

interfaceSerial0/0

noipaddress

serialrestart-delay0

!

interfaceSerial0/1

ipaddress23.23.23.3255.255.255.0

serialrestart-delay0

clockrate128000

cryptomapSTATIC-MAP

!

interfaceSerial0/2

noipaddress

serialrestart-delay0

!

interfaceSerial0/3

noipaddress

serialrestart-delay0

!

iphttpserver

noiphttpsecure-server

!

iproute0.0.0.00.0.0.0Serial0/1

!

!

access-list110permitip10.3.3.00.0.0.25510.1.1.00.0.0.255

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

!

linecon0

exec-timeout00

loggingsynchronous

lineaux0

linevty04

login

!

!

end