ipsecvpn远端动态接入主模式与积极模式.docx
- 文档编号:30432103
- 上传时间:2023-08-15
- 格式:DOCX
- 页数:19
- 大小:59.33KB
ipsecvpn远端动态接入主模式与积极模式.docx
《ipsecvpn远端动态接入主模式与积极模式.docx》由会员分享,可在线阅读,更多相关《ipsecvpn远端动态接入主模式与积极模式.docx(19页珍藏版)》请在冰豆网上搜索。
ipsecvpn远端动态接入主模式与积极模式
分部分配动态ip总部用固定ip分部作为发起方
R1(主模式)
Cryptoisakmppolocy10(五元组)
Encr3des
Authenticationpre-share
Group2
Lifetime86400
Hashsha
Cryptoisakemidentityaddress(用id标识)
Cryptoisakmpkey0sunanaddress0.0.0.0(对端接入不知道对端ip用0.0.0.0)
Cryptoipsectransform-sett10esp-3desesp-sha-hmac(设置变换集)
Modetr
Exit
Access-list111permitip192.168.2.00.0.0.255any(同样不知道对端感兴趣流量用any)
Cryptodynamic-mapp110(设置加密图动态)
Settransform-sett10
Matchaddress111
Cryptomapp290ipsec-isakmpdynamicp1(因为接口上要绑静态加密图所以把动态图绑到静态上)
Intf0/0(绑静态图)
Cryptomapp2
R2
cryptoisakmpenable
cryptoisakmppolicy10
encryption3des
hashsha
authenticationpre-share
group2
lifetime86400
exit
cryptoisakempidentityaddress
cryptoisakmpkey0sunanaddress202.103.96.112(总部ip是知道的并且这是分部做为发起方的条件)
cryptoipsectransform-sett10esp-3desesp-sha-hmac
modetr
exit
access-list111permitip192.168.3.00.0.0.255192.168.2.00.0.0.255(感兴趣流量分部也知道的)
crytomapp110ipsec-isakmp
setpeer202.103.96.112
settransorm-sett10
matchaddress111
exit
intf0/0
cryptomapp1
R1showrun
Buildingconfiguration...
Currentconfiguration:
1329bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR1
!
boot-start-marker
boot-end-marker
!
!
noaaanew-model
memory-sizeiomem5
ipcef
!
!
!
!
noipdomainlookup
!
multilinkbundle-nameauthenticated
!
!
!
!
!
!
archive
logconfig
hidekeys
!
!
cryptoisakmppolicy10
encr3des
authenticationpre-share
group2
cryptoisakmpkeysunanaddress0.0.0.00.0.0.0
!
!
cryptoipsectransform-sett10esp-3desesp-sha-hmac
modetransport
!
cryptodynamic-mapp110
settransform-sett10
matchaddress111
cryptodynamic-mapp120
settransform-sett10
!
!
cryptomapp290ipsec-isakmpdynamicp1
!
!
!
!
!
!
!
interfaceFastEthernet0/0
ipaddress202.103.96.112255.255.255.0
duplexauto
speedauto
cryptomapp2
!
interfaceFastEthernet0/1
ipaddress192.168.2.1255.255.255.0
duplexauto
speedauto
!
ipforward-protocolnd
iproute0.0.0.00.0.0.0202.103.96.113(没路由一切都是浮云)
!
!
noiphttpserver
noiphttpsecure-server
!
access-list111permitip192.168.2.00.0.0.255any
nocdprun
!
!
control-plane
!
linecon0
exec-timeout00
loggingsynchronous
lineaux0
exec-timeout00
loggingsynchronous
linevty04
login
!
!
end
R1#unall
Allpossibledebugginghasbeenturnedoff
R2showrun
R2#shrun
Buildingconfiguration...
Currentconfiguration:
1238bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR2
!
boot-start-marker
boot-end-marker
!
!
noaaanew-model
memory-sizeiomem5
ipcef
!
noipdomainlookup
!
multilinkbundle-nameauthenticated
!
!
archive
logconfig
hidekeys
!
!
cryptoisakmppolicy10
encr3des
authenticationpre-share
group2
cryptoisakmpkeysunanaddress202.103.96.112
!
!
cryptoipsectransform-sett10esp-3desesp-sha-hmac
modetransport
!
cryptomapp110ipsec-isakmp
setpeer202.103.96.112
settransform-sett10
matchaddress111
!
!
interfaceFastEthernet0/0
ipaddress202.103.96.113255.255.255.0
duplexauto
speedauto
cryptomapp1
!
interfaceFastEthernet0/1
ipaddress192.168.3.1255.255.255.0
duplexauto
speedauto
!
ipforward-protocolnd
iproute0.0.0.00.0.0.0202.103.96.112
!
!
noiphttpserver
noiphttpsecure-server
!
access-list111permitip192.168.3.00.0.0.255192.168.2.00.0.0.255
nocdprun
!
!
!
linecon0
exec-timeout00
loggingsynchronous
lineaux0
exec-timeout00
loggingsynchronous
linevty04
login
!
!
End
R2
Ping192.168.2.1sou192.168.3.1
主模式协商
R1(积极/野蛮模式)
拓扑还是上面的拓扑
R1
cryptoisakmpenable
cryptoisakmppolicy10(还是五元组)
encryption3des
hashsha
authenticationpre-share
group2
lifetime86400
exit
cryptoisakmpidentityaddress(用ip地址标识)
cryptokeyringk0(配密钥串k0)
pre-shared-keyaddress0.0.0.00.0.0.0key0sunan(对方地址不知道用0.0.0.00.0.0.0)
exit
cryptoisakmpprofilert0(配阶一的策略文件RT0)
matchidentityaddress0.0.0.00.0.0.0(与0.0.0.0协商)
keyrintk0
initiatemodeaggressive(启动积极模式)
exit
cryptoipsectransform-sett10esp-3desesp-sha-hmac(变换集)
modetunnel
exit
access-list111permitip192.168.2.00.0.0.255any(acl不知道对端用any)
cryptodynamic-mapp110(动态图)
setisakmp-profilert0(因为积极模式第一个包要丢很多东西过去)
settransform-sett10
matchadd111
exit
cryptomapp290ipsec-isakmpdynamicp1(还是绑图)
intf0/0
cryptomapp1
R2
cryptoisakmpenable
cryptoisakmppolicy10
encryption3des
hashsha
authenticationpre-share
group2
lifetime86400
exit
cryptoisakmpidentityaddress
cryptokeyringk0(为总部配密钥)
pre-sharedaddress202.103.96.112key0sunan
exit
cryptoisakmpprofilert0(同上)
matchidentityaddress202.103.96.112
keyringk0
initiatemodeaggressive
exit
cryptoipsectransform-sett10esp-3desesp-sha-hmac
modetunnel
exit
access-list111permitip192.168.3.00.0.0.255192.168.2.00.0.0.255(分部知道私网)
cryptomapp110ipsec-isakmp
setpeer172.1.1.2
setisakmp-profilert1(比主模式多的策略文件就是密钥与peer对应关系)
settransform-sett10
matchaddress101
exit
interfaceEthernet0/0(绑图)
cryptomapp1
R1showrun
R1#shrun
Buildingconfiguration...
*Mar100:
31:
36.735:
%SYS-5-CONFIG_I:
Configuredfromconsolebyconsole
Currentconfiguration:
1369bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR1
!
boot-start-marker
boot-end-marker
!
!
noaaanew-model
memory-sizeiomem5
ipcef
!
!
!
!
noipdomainlookup
!
multilinkbundle-nameauthentica!
!
archive
logconfig
hidekeys
!
cryptokeyringk0
pre-shared-keyaddress0.0.0.00.0.0.0keysunan
!
cryptoisakmppolicy10
encr3des
authenticationpre-share
group2
cryptoisakmpprofilert0
keyringk0
matchidentityaddress0.0.0.0
initiatemodeaggressive
!
!
cryptoipsectransform-sett10esp-3desesp-sha-hmac
!
cryptodynamic-mapp110
settransform-sett10
setisakmp-profilert0
matchaddress111
!
!
cryptomapp290ipsec-isakmpdynamicp1!
interfaceFastEthernet0/0
ipaddress202.103.96.112255.255.255.0
duplexauto
speedauto
cryptomapp2
!
interfaceFastEthernet0/1
ipaddress192.168.2.1255.255.255.0
duplexauto
speedauto
!
ipforward-protocolnd
iproute0.0.0.00.0.0.0202.103.96.113
!
!
noiphttpserver
noiphttpsecure-server
!
access-list111permitip192.168.2.00.0.0.255any
nocdprun
!
!
control-plane
!
!
linecon0
exec-timeout00
loggingsynchronous
lineaux0
exec-timeout00
loggingsynchronous
linevty04
login
!
!
En
R2SHOWRUN
R2#shrun
Buildingconfiguration...
Currentconfiguration:
1394bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR2
!
boot-start-marker
boot-end-marker
!
!
noaaanew-model
memory-sizeiomem5
ipcef
!
!
!
noipdomainlookup
!
multilinkbundle-nameauthenticated
!
!
!
!
archive
logconfig
hidekeys
!
cryptokeyringk0
pre-shared-keyaddress202.103.96.112keysunan
!
cryptoisakmppolicy10
encr3des
authenticationpre-share
group2
cryptoisakmpprofilert0
keyringk0
matchidentityaddress202.103.96.112255.255.255.255
initiatemodeaggressive
!
!
cryptoipsectransform-sett10esp-3desesp-sha-hmac
!
cryptomapp110ipsec-isakmp
setpeer202.103.96.112
settransform-sett10
setisakmp-profilert0
matchaddress111
!
!
!
interfaceFastEthernet0/0
ipaddress202.103.96.113255.255.255.0
duplexauto
speedauto
cryptomapp1
!
interfaceFastEthernet0/1
ipaddress192.168.3.1255.255.255.0
duplexauto
speedauto
!
ipforward-protocolnd
iproute0.0.0.00.0.0.0202.103.96.112
!
!
noiphttpserver
noiphttpsecure-server
!
access-list111permitip192.168.3.00.0.0.255192.168.2.00.0.0.255
nocdpru
control-plane
!
!
linecon0
exec-timeout00
loggingsynchronous
lineaux0
exec-timeout00
loggingsynchronous
linevty04
login
!
!
End
R2
Ping192.168.2.1sou192.168.3.1
积极/野蛮模式协商!
国产设备大多是这个模式为了省资源
以上如有问题请消息我
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- ipsecvpn 远端 动态 接入 模式 积极
![提示](https://static.bdocx.com/images/bang_tan.gif)