l2tpoveripseclns地址在内网.docx
- 文档编号:28008154
- 上传时间:2023-07-07
- 格式:DOCX
- 页数:20
- 大小:34.40KB
l2tpoveripseclns地址在内网.docx
《l2tpoveripseclns地址在内网.docx》由会员分享,可在线阅读,更多相关《l2tpoveripseclns地址在内网.docx(20页珍藏版)》请在冰豆网上搜索。
l2tpoveripseclns地址在内网
L2TPOVERIPSEC
(LNS地址在内网,通过公网映射)
组网
LAC公网地址为,LNS在用户内网地址为,通过映射为公网地址。
用户需求:
PC用户通过PPPOE拨号到LAC出发L2TP隧道建立,同时要求做IPSEC加密。
配置:
LAC:
#
version,Release2512P04
#
sysnamelac
#
l2tpenable
#
domaindefaultenablesystem
#
ipv6
#.
telnetserverenable
#
port-securityenable
#
password-recoveryenable
#
aclnumber3500
rule5permitipsource0destination0
rule10permitipsource0destination0
#
vlan1
#
Ddomain
authenticationppplocal
access-limitdisable
stateactive
idle-cutdisable
self-service-urldisable
domainsystem
access-limitdisable
stateactive
idle-cutdisable
self-service-urldisable
#
ikepeerlac
exchange-modeaggressive
6RGe2wayz2b/ilLMlHyJ86Kag==pre-shared-keycipher$c$3$1x8s/
id-typename
remote-namelns
remote-addresslocal-addresslocal-namelac
nattraversal
#
ipsectransform-setlac
encapsulation-modetunnel
transformesp
espauthentication-algorithmsha1
espencryption-algorithm3des
#
ipsecpolicylac1isakmp
securityacl3500
ike-peerlac
transform-setlac
#
user-groupsystem
group-attributeallow-guest
#
local-useradmin
passwordcipher$c$3$EiAlBrd/gVGFvSMRAmLoJwgze3wHlYa1BQ==
authorization-attributelevel3
service-typetelnet
service-typeweb
local-usertest
passwordcipher$c$3$SQ3SM2FRQoXeMijjRitI72ToSwbJ9f09xw==
service-typeppp
#
l2tp-group1
tunnelpasswordcipher$c$3$TVsHV3HQRBs5eubLlDPrKCp8o8kwnA==
tunnelnamelac
startl2tpipdomain
#
interfaceAux0
asyncmodeflow
link-protocolppp
#
interfaceCellular0/0
asyncmodeprotocol
link-protocolppp
#
interfaceVirtual-Template1
pppauthentication-modepapchapdomain
#
interfaceNULL0
#
interfaceVlan-interface1
pppoe-serverbindVirtual-Template1
ipaddressGigabitEthernet0/0
portlink-moderoute
ipaddressipsecpolicylac
#
interfaceGigabitEthernet0/1
portlink-modebridge
#
interfaceGigabitEthernet0/2
portlink-modebridge
#
interfaceGigabitEthernet0/3
portlink-modebridge
#
interfaceGigabitEthernet0/4
portlink-modebridge
#
iproute-staticiproute-staticdialer-rule1ippermit#loadxml-configuration
#loadtr069-configuration#user-interfacetty12user-interfaceaux0user-interfacevty04authentication-modescheme
#return
:
LNS#.
versionRelease0202
#
sysnamelns
#
telnetserverenable
#
ippool1
#
password-recoveryenable
#
vlan1
#
interfaceVirtual-Template1
pppauthentication-modepapchap
remoteaddresspool1
ipaddressNULL0
#
interfaceLoopBack0
ipaddress
interfaceGigabitEthernet1/0
#
interfaceGigabitEthernet1/
descriptionto-12/32
ipaddressvlan-typedot1qvid1498
#
interfaceGigabitEthernet2/0
#.
interfaceGigabitEthernet2/
descriptionto-11/32
ipaddressvlan-typedot1qvid1499
ipsecapplypolicylns
#
schedulerlogfilesize16
#
lineclassaux
user-rolenetwork-operator
#
lineclassconsole
user-rolenetwork-admin
#
lineclassvty
user-rolenetwork-operator
#
lineaux0
user-rolenetwork-operator
#
linecon0
user-rolenetwork-admin
#
linevty063
authentication-modescheme
user-rolenetwork-operator
#
28iproute-static28iproute-static0iproute-static
authenticationppplocal
authorizationppplocal
accountingppplocal
#
domainsystem
#
aaasession-limitftp32
aaasession-limittelnet32
aaasession-limithttp32
aaasession-limitssh32
aaasession-limithttps32
domaindefaultenablesystem
#
rolenamelevel-0
descriptionPredefinedlevel-0role
#
rolenamelevel-1
descriptionPredefinedlevel-1role
#
rolenamelevel-2
descriptionPredefinedlevel-2role
#
rolenamelevel-3
descriptionPredefinedlevel-3role
#
rolenamelevel-4
descriptionPredefinedlevel-4role
#
rolenamelevel-5
descriptionPredefinedlevel-5role
#
rolenamelevel-6
descriptionPredefinedlevel-6role
#
rolenamelevel-7
descriptionPredefinedlevel-7role
#
rolenamelevel-8
descriptionPredefinedlevel-8role
#
rolenamelevel-9
descriptionPredefinedlevel-9role
#
rolenamelevel-10
descriptionPredefinedlevel-10role
#
rolenamelevel-11
descriptionPredefinedlevel-11role
#
rolenamelevel-12
descriptionPredefinedlevel-12role
#
rolenamelevel-13
descriptionPredefinedlevel-13role
#
rolenamelevel-14
descriptionPredefinedlevel-14role
#
user-groupsystem
#
local-useradminclassmanage
password
hash
$h$6$rhjYlaMxTE8Yrgy/$pL4ngHJErR5IS6mIM2TVTpxVJoXAz3Z7twS5WUoHnTBAVcnQ6zRTt3l/IV25NzoxYG4+xduBzNhiM+NovY5gUQ==
service-typetelnet
authorization-attributeuser-rolenetwork-admin
authorization-attributeuser-rolenetwork-operator
#
local-usertestclassmanage
password
hash
$h$6$aeSFBsuE4NLmKV/p$Bmfz5WpYqTIdkrJhRl8v9xOkz2sxaxZ4Y0ZtkKglmyw3gvtamdEAxf0CItYelhqBRz/xZmmQF5DcZ3Y15oa5YA==
service-typeftp
service-typetelnet
authorization-attributeuser-rolenetwork-operator
#
local-usertestclassnetwork
passwordcipher$c$3$dxUAzslPK2voJ3xxO+kdUpqKQK52oAsuNQ==
service-typeppp
authorization-attributeuser-rolenetwork-operator
#.
ipsectransform-setlns
espencryption-algorithm3des-cbc
espauthentication-algorithmsha1
#
ipsecpolicy-templatelns1
transform-setlns
ike-profilelns
#
ipsecpolicylns1isakmptemplatelns
#
l2tp-group1modelns
allowl2tpvirtual-template1remotelac
tunnelnamelns
tunnelpasswordcipher$c$3$TbJ0N3WspYQUVRSjjmPBxkFjo3Xhyg==
#
l2tpenable
#
ikeidentityfqdnlns
#
ikeprofilelns
keychainlac
exchange-modeaggressive
local-identityfqdnlns
matchremoteidentityfqdnlac
matchlocaladdressGigabitEthernet2/
#
ikekeychainlac
pre-shared-keyhostnamelackeycipher$c$3$QGKCezjZ+NqQIHxyMuZsfR/weMCQAw==
#
return
一:
概述
首先,先将这两个概念理顺一下。
IPSECOVERGRE即IPSEC在里,GRE在外。
首先先把需要加密的数据包封装成IPSEC包,然后在扔到GRE隧道里发到对端设备。
做法是把IPSEC的加密策略作用在Tunnel口上,即在Tunnel口上监听匹配符合访问控制列表的数据流,来确认数据是否需要加密,需要则先加密封装为IPSEC包,然后封装成GRE包进入隧道;反之未在访问控制列表中的数据流将以未加密的状态直接走GRE隧道,这样就会存在有些数据处于不安全的传递状态。
而GREOVERIPSEC则是GRE在里,IPSEC在外,即先将数据封装成GRE包,然后在封装成IPSEC包后发到对端设备。
做法是把IPSEC的加密测试作用在物理端口上,然后根据访问控制列表监控匹配是否有需要加密的GRE数据流,有则将GRE数据流加密封装成IPSEC包再进行传递,这样可以保证所有数据包都会被机密,包括隧道建立和路由的创建和传递。
二:
IPSECOVERGRE与GREOVERIPSEC的配置思路介绍
首先先介绍一下配置思路,有两种配置的区别在于ipsecovergre是将ipsec加密封装应用在tunnel口上,使用acl匹配需要加密数据流来实现。
而greoveripsec是将ipsec加密封装应用在物理接口上,用acl来匹配需要加密的tunnel隧道。
从这个来讲,后者会安全一点,ipsec会将所有数据包括隧道报文都进行加密。
因此我将配置过程分成三步,这样比较不会乱。
第一步先配置公网ip及路由,让两端设备的公网ip先能互相ping通;第二步在配置GRE隧道,然后测试GRE隧道是否建立正常;第三步再创建ipsec加密并引用。
拓扑图如下:
GREoverIPSECA:
:
作为互联网,保证路由可达即可R202/Ints0/
24Ipad
/1Ints0/2
24
22/Int0/
24Ipad
R3:
第一步配置公网接口|第一步先配置公网接口R1:
0ints0/2/|ints0/2/0
24ipad|24Ipad
配置||iprou第二步配置GREIprou
GREinttunnel0|Inttunnel0
24Ipad24|ipad
source|Source
Destination|destination
Iprou0tunnel0|iprou0tunnel0
第三步配置IPSEC第三步配置IPSEC
IKE配置
Ikepeerr1-r3ikepeerr3-r1
Pre-shared-key12345pre-shared-key12345
类型Ipsecremote-addressRemote-address
ipsecproposalr3-r1Ipsecproposalr1-r3
Encapsulationtunnel/transportEncapsulationtunnel/transport
TransformespTransformesp
Espauthentication-algorithmsha1Espauthentication-algorithmsha1
Espencryption-algorithm3desEspencryption-algorithm3des
ACL匹配策略
Aclnumber3013aclnumber3013
Rule5permitipsource0rule5permitipsource0
0Destination0destination
策略Ipsec
ipsecpolicyr311isakmpIpsecpolicyr131isakmp
Securityacl3013securityacl3031
ike-peerr3-r1Ike-peerr1-r3
Proposalr1-r3proposalr3-r1
应用到接口
/ints0/02Ints0//20
Ipsecpolicyr13ipsecpolicyr31
IPSECoverGRE:
B
R2:
作为互联网,保证路由可达即可
Ints0/2/0
Ipad24
Ints0/2/1
24
Int0/2/2
Ipad24
|R3:
第一步配置公网接口R1:
第一步先配置公网接口
0|ints0/2/ints0/2/0
|ipad24Ipad24
配置|GRE|iprou第二步配置Iprou
GRE|inttunnel0Inttunnel0
Ipad24|ipad24
source|Source
|destinationDestination
iprou0tunnel0Iprou0tunnel0|
IPSEC第三步配置IPSEC第三步配置
配置IKE
ikepeerr3-r1Ikepeerr1-r3
Pre-shared-key12345pre-shared-key12345Ipsec类型remote-addressRemote-address
ipsecproposalr3-r1Ipsecproposalr1-r3
EncapsulationtunnelEncapsulationtunnel
TransformespTransformesp
Espauthentication-algorithmsha1Espauthentication-algorithmsha1
Espencryption-algorithm3desEspencryption-algorithm3des
ACL匹配策略
Aclnumber3013aclnumber3013
Rule5permitipsource0rule5permitipsource0
Destination0destination0
Ipsec策略
Ipsecpolicyr131isakmpipsecpolicyr311isakmp
Securityacl3013securityacl3031
Ike-peerr1-r3ike-peerr3-r1
Proposalr1-r3proposalr3-r1
应用到TUNNEL口
Inttunnel0inttunnle0
Ipsecpolicyr13ipsecpolicyr31
三:
ipsecovergre与greoveripsec报文路由转发和封装过程
首先是greoveripsec的路由转发过程:
R1路由表:
RoutingTables:
Public
Destinations:
13Routes:
13
Destination/MaskProtoPreCostNextHopInterface
Static600S0/2/0
0/2S0/0Direct0
Direct00InLoop0
Direct00S0/2/0
Direct00InLoop0
Direct00InLoop0
Direct00InLoop0
Static600Tun0
Static600Tun1
Direct00Tun0
Direct00InLoop0
Direct00
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- l2tpoveripseclns 地址 在内
![提示](https://static.bdocx.com/images/bang_tan.gif)