華為ipsecvpn配置

1、AR路由器配置IKE方式的IPSec VPNIPSec（Internet Protocol Security）是IETF（Internet Engineering Task Force）制定的一組開放的網(wǎng)絡(luò)安全協(xié)議，在IP層通過數(shù)據(jù)來源認(rèn)證、數(shù)據(jù)加密、數(shù)據(jù)完整性和抗重放功能來保證通信雙方Internet上傳輸數(shù)據(jù)的安全性。在Internet的傳輸中，絕大部分?jǐn)?shù)據(jù)的內(nèi)容都是明文傳輸?shù)模@樣就會存在很多潛在的危險，比如：密碼、銀行帳戶的信息被竊取、篡改，用戶的身份被冒充，遭受網(wǎng)絡(luò)惡意攻擊等。網(wǎng)絡(luò)中部署IPSec后，可對傳輸?shù)臄?shù)據(jù)進行保護處理，降低信息泄漏的風(fēng)險。采用默認(rèn)配置通過IKE協(xié)商方式建立I

2、PSec隧道示例組網(wǎng)需求如圖1所示，RouterA為企業(yè)分支網(wǎng)關(guān)，RouterB為企業(yè)總部網(wǎng)關(guān)，分支與總部通過公網(wǎng)建立通信。分支子網(wǎng)為10.1.1.0/24，總部子網(wǎng)為10.1.2.0/24。企業(yè)希望對分支子網(wǎng)與總部子網(wǎng)之間相互訪問的流量進行安全保護。分支與總部通過公網(wǎng)建立通信，可以在分支網(wǎng)關(guān)與總部網(wǎng)關(guān)之間建立一個IPSec隧道來實施安全保護。圖1采用默認(rèn)配置通過IKE協(xié)商方式建立IPSec隧道組網(wǎng)圖配置思路采用如下思路配置采用IKE協(xié)商方式建立IPSec隧道：1.配置接口的IP地址和到對端的靜態(tài)路由，保證兩端路由可達。2.配置ACL，以定義需要IPSec保護的數(shù)據(jù)流。3.配置IPSec安全提

3、議，定義IPSec的保護方法。4.配置IKE對等體，定義對等體間IKE協(xié)商時的屬性。5.配置安全策略，并引用ACL、IPSec安全提議和IKE對等體，確定對何種數(shù)據(jù)流采取何種保護方法。6.在接口上應(yīng)用安全策略組，使接口具有IPSec的保護功能。操作步驟1.分別在RouterA和RouterB上配置接口的IP地址和到對端的靜態(tài)路由#在RouterA上配置接口的IP地址。system-viewHuaweisysname RouterARouterAinterface gigabitethernet 1/0/0RouterA-GigabitEthernet1/0/0ip address 202.13

4、8.163.1 255.255.255.0RouterA-GigabitEthernet1/0/0quitRouterAinterface gigabitethernet 2/0/0RouterA-GigabitEthernet2/0/0ip address 10.1.1.1 255.255.255.0RouterA-GigabitEthernet2/0/0quit#在RouterA上配置到對端的靜態(tài)路由，此處假設(shè)到對端的下一跳地址為202.138.163.2。RouterAip route-static 202.138.162.0 255.255.255.0 202.138.163.2Rou

5、terAip route-static 10.1.2.0 255.255.255.0 202.138.163.2#在RouterB上配置接口的IP地址。system-viewHuaweisysname RouterBRouterBinterface gigabitethernet 1/0/0RouterB-GigabitEthernet1/0/0ip address 202.138.162.1 255.255.255.0RouterB-GigabitEthernet1/0/0quitRouterBinterface gigabitethernet 2/0/0RouterB-GigabitEth

6、ernet2/0/0ip address 10.1.2.1 255.255.255.0RouterB-GigabitEthernet2/0/0quit#在RouterB上配置到對端的靜態(tài)路由，此處假設(shè)到對端下一跳地址為202.138.162.2。RouterBip route-static 202.138.163.0 255.255.255.0 202.138.162.2RouterBip route-static 10.1.1.0 255.255.255.0 202.138.162.22.分別在RouterA和RouterB上配置ACL，定義各自要保護的數(shù)據(jù)流#在RouterA上配置ACL，

7、定義由子網(wǎng)10.1.1.0/24去子網(wǎng)10.1.2.0/24的數(shù)據(jù)流。RouterAacl number 3101RouterA-acl-adv-3101rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255RouterA-acl-adv-3101quit#在RouterB上配置ACL，定義由子網(wǎng)10.1.2.0/24去子網(wǎng)10.1.1.0/24的數(shù)據(jù)流。RouterBacl number 3101RouterB-acl-adv-3101rule permit ip source 10.1.2.0 0.0.

8、0.255 destination 10.1.1.0 0.0.0.255RouterB-acl-adv-3101quit3.分別在RouterA和RouterB上創(chuàng)建IPSec安全提議#在RouterA上配置IPSec安全提議。RouterAipsec proposal tran1RouterA-ipsec-proposal-tran1quit#在RouterB上配置IPSec安全提議。RouterBipsec proposal tran1RouterB-ipsec-proposal-tran1quit此時分別在RouterA和RouterB上執(zhí)行display ipsec proposal會

9、顯示所配置的信息。4.分別在RouterA和RouterB上配置IKE對等體說明：該示例中沒有配置IKE安全提議，采用的是系統(tǒng)提供的一條缺省的IKE安全提議。#在RouterA上配置IKE對等體，并根據(jù)默認(rèn)配置，配置預(yù)共享密鑰和對端ID。RouterAike peer spub v1RouterA-ike-peer-spubpre-shared-key simple huaweiRouterA-ike-peer-spubremote-address 202.138.162.1RouterA-ike-peer-spubquit#在RouterB上配置IKE對等體，并根據(jù)默認(rèn)配置，配置預(yù)共享密鑰和

10、對端ID。RouterBike peer spua v1RouterB-ike-peer-spuapre-shared-key simple huaweiRouterB-ike-peer-spuaremote-address 202.138.163.1RouterB-ike-peer-spuaquit此時分別在RouterA和RouterB上執(zhí)行display ike peer會顯示所配置的信息，以RouterA為例。RouterAdisplay ike peer name spub verbose-Peer name: spubExchange mode: main on phase 1Pr

11、e-shared-key: huaweiLocal ID type: IPDPD: DisableDPD mode: PeriodicDPD idle time: 30DPD retransmit interval: 15DPD retry limit: 3Host name:Peer Ip address: 202.138.162.1VPN name:Local IP address:Remote name:Nat-traversal: DisableConfigured IKE version: Version onePKI realm: NULLInband OCSP: DisableL

12、ifetime notification: Enable-5.分別在RouterA和RouterB上創(chuàng)建安全策略#在RouterA上配置IKE動態(tài)協(xié)商方式安全策略。RouterAipsec policy map1 10 isakmpRouterA-ipsec-policy-isakmp-map1-10ike-peer spubRouterA-ipsec-policy-isakmp-map1-10proposal tran1RouterA-ipsec-policy-isakmp-map1-10security acl 3101RouterA-ipsec-policy-isakmp-map1-10

13、quit#在RouterB上配置IKE動態(tài)協(xié)商方式安全策略。RouterBipsec policy use1 10 isakmpRouterB-ipsec-policy-isakmp-use1-10ike-peer spuaRouterB-ipsec-policy-isakmp-use1-10proposal tran1RouterB-ipsec-policy-isakmp-use1-10security acl 3101RouterB-ipsec-policy-isakmp-use1-10quit此時分別在RouterA和RouterB上執(zhí)行display ipsec policy會顯示所配

14、置的信息。6.分別在RouterA和RouterB的接口上應(yīng)用各自的安全策略組，使接口具有IPSec的保護功能#在RouterA的接口上引用安全策略組。RouterAinterface gigabitethernet 1/0/0RouterA-GigabitEthernet1/0/0ipsec policy map1RouterA-GigabitEthernet1/0/0quit#在RouterB的接口上引用安全策略組。RouterBinterface gigabitethernet 1/0/0RouterB-GigabitEthernet1/0/0ipsec policy use1Route

15、rB-GigabitEthernet1/0/0quit7.檢查配置結(jié)果#配置成功后，在主機PC A執(zhí)行ping操作仍然可以ping通主機PC B，它們之間的數(shù)據(jù)傳輸將被加密，執(zhí)行命令display ipsec statistics esp可以查看數(shù)據(jù)包的統(tǒng)計信息。#在RouterA上執(zhí)行display ike sa操作，結(jié)果如下。RouterAdisplay ike saConn-IDPeerVPNFlag(s)Phase-16202.138.162.10RD|ST214202.138.162.10RD|ST1Flag Description:RD-READYST-STAYALIVERL-RE

16、PLACEDFD-FADINGTO-TIMEOUTHRT-HEARTBEATLKG-LAST KNOWN GOOD SEQ NO.BCK-BACKED UP#分別在RouterA和RouterB上執(zhí)行display ipsec sa會顯示所配置的信息，以RouterA為例。RouterAdisplay ipsec sa=Interface: GigabitEthernet 1/0/0Path MTU: 1500=-IPSec policy name: map1Sequence number: 10Acl Group: 3101Acl rule: 5Mode: ISAKMP-Connection

17、 ID: 16Encapsulation mode: TunnelTunnel local: 202.138.163.1Tunnel remote: 202.138.162.1Flow source: 10.1.1.0/0.0.0.255 0/0Flow destination: 10.1.2.0/0.0.0.255 0/0Qos pre-classify: DisableQos group: -Outbound ESP SAsSPI: 1026037179 (0x3d2815bb)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5SA remaining ke

18、y duration (bytes/sec): 1887436800/3596Max sent sequence-number: 5UDP encapsulation used for NAT traversal: NInbound ESP SAsSPI: 1593054859 (0x5ef4168b)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5SA remaining key duration (bytes/sec): 1887436800/3596Max received sequence-number: 4Anti-replay window siz

19、e: 32UDP encapsulation used for NAT traversal: N配置文件RouterA的配置文件#sysname RouterA#acl number 3101rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255#ipsec proposal tran1#ike peer spub v1pre-shared-key simple huaweiremote-address 202.138.162.1#ipsec policy map1 10 isakmpsecurity acl 3101ike-peer spubproposal tran1#interface GigabitEthernet1/0/0ip address 202.138.163.1 255.255.255.0ipsec policy map1#interface GigabitEthernet2/0/0ip address 10.1.1.1 255.255.255.0#ip route-static 202.138.162.0 255.255.255.0 202.138.163.2ip route-static 10.1