路由與交換技術 課件 12 IPSec VPN

第十二章IPSecVPN理解IPSecVPN的作用與應用場景理解IPSecVPN的基本工作原理熟悉IPSecVPN的配置流程掌握IPSecVPN的配置(手動模式)掌握IPSecVPN的配置(自動模式)重難點IPSecVPN的應用場景(重點)IPSecVPN的基本工作原理（重點，難點）IPSecVPN的配置流程（重點）IPSecVPN的配置(手動模式)（重點，難點）IPSecVPN的配置(自動模式)（重點，難點）IPsecVPN應用場景企業(yè)總部企業(yè)分支IPSec隧道企業(yè)分支可以通過IPSecVPN接入到企業(yè)總部網絡。IPSec架構IPSec不是一個單獨的協(xié)議，它通過AH和ESP這兩個安全協(xié)議來實現IP數據報的安全傳送。IKE協(xié)議提供密鑰協(xié)商，建立和維護安全聯(lián)盟SA等服務。TCP/UDPTCP/UDPSA協(xié)商IKERTARTBAH/ESPAH/ESP加密的IP報文IKE安全聯(lián)盟SAIPSec隧道RTARTBLocalAddressRemoteAddressSPIinboundSPIoutboundKeyTransform(Proposal)LocalAddressRemoteAddressSPIinboundSPIoutboundKeyTransform(Proposal)安全聯(lián)盟定義了IPSec對等體間將使用的數據封裝模式、認證和加密算法、密鑰等參數。安全聯(lián)盟是單向的，兩個對等體之間的雙向通信，至少需要兩個SA。IPSec傳輸模式AHIPTCPDataAH認證部分IPTCPDataESP加密部分認證部分ESPTrailerESPAuthIPTCPDataESP加密部分認證部分ESPTrailerESPAuthAHESPAH-ESP在傳輸模式下，

AH或ESP報頭位于IP報頭和傳輸層報頭之間。IPSec隧道模式IPTCPDataAHIP認證部分IPIPTCPDataESPESPTrailerESPAuth加密部分認證部分IPIPTCPDataESPESPTrailerESPAuth加密部分認證部分AHAHESPAH-ESP在隧道模式下，IPSec會另外生成一個新的IP報頭，并封裝在AH或ESP之前。IPSecVPN配置步驟配置網絡可達配置ACL識別興趣流創(chuàng)建安全提議創(chuàng)建安全策略應用安全策略IPSecVPN配置（手動協(xié)商）實現AR1的lb1與AR2的lb2之間實現VPN通信S1：實現網絡互連實現AR1的g0/0/0與AR2的g0/0/1之間的網絡互聯(lián)S2：配置感興趣流[AR1]acl3001[AR1-acl-adv-3001]rulepermitipsource192.168.11.00.0.0.255destination192.168.22.00.0.0.255[AR1]acl3002//兩個路由器的ACL編號無關聯(lián)[AR1-acl-adv-3002]rulepermitipsource192.168.22.00.0.0.255destination192.168.11.00.0.0.255S3：配置IPSec安全提議[AR1]ipsecproposalAR12[AR1-ipsec-proposal-AR12]espauthentication-algorithmsha1[AR1-ipsec-proposal-AR12]espencryption-algorithm3des[AR2]ipsecproposalAR21//安全提議名字并不要求相同[AR2-ipsec-proposal-AR21]espauthentication-algorithmsha1[AR2-ipsec-proposal-AR21]espencryption-algorithm3desS4：配置IPSec安全策略//AR1的[AR1]ipsecpolicyp1212manual[AR1-ipsec-policy-manual-p12-12][AR1-ipsec-policy-manual-p12-12]securityacl3001[AR1-ipsec-policy-manual-p12-12]proposalAR12[AR1-ipsec-policy-manual-p12-12]tunnellocal202.103.1.1[AR1-ipsec-policy-manual-p12-12]tunnelremote220.141.2.2[AR1-ipsec-policy-manual-p12-12]saspiinboundesp654321[AR1-ipsec-policy-manual-p12-12]sastring-keyinboundespcipheryhz123[AR1-ipsec-policy-manual-p12-12]saspioutboundesp123456[AR1-ipsec-policy-manual-p12-12]sastring-keyoutboundespcipher123yhzS4：配置IPSec安全策略//AR2的[AR2]ipsecpolicyp2121manual[AR2-ipsec-policy-manual-p21-21]securityacl3002[AR2-ipsec-policy-manual-p21-21]proposalAR21[AR2-ipsec-policy-manual-p21-21]tunnellocal220.141.2.2[AR2-ipsec-policy-manual-p21-21]tunnelremote202.103.1.1[AR2-ipsec-policy-manual-p21-21]saspiinboundesp123456[AR2-ipsec-policy-manual-p21-21]sastring-keyinboundespcipher123yhz[AR2-ipsec-policy-manual-p21-21]saspioutboundesp654321[AR2-ipsec-policy-manual-p21-21]sastring-keyoutboundespcipheryhz123S5：應用IPSec安全策略[AR1]intg0/0/0[AR1-GigabitEthernet0/0/0]ipsecpolicyp12[AR2]intg0/0/1[AR2-GigabitEthernet0/0/1]ipsecpolicyp21IPSecVPN配置（自動協(xié)商）實現AR1的lb1與AR2的lb2之間實現VPN通信S1：實現網絡互連實現AR1的g0/0/0與AR2的g0/0/1之間的網絡互聯(lián)S2：配置感興趣流[AR1]acl3001[AR1-acl-adv-3001]rulepermitipsource192.168.11.00.0.0.255destination192.168.22.00.0.0.255[AR1]acl3002//兩個路由器的ACL編號無關聯(lián)[AR1-acl-adv-3002]rulepermitipsource192.168.22.00.0.0.255destination192.168.11.00.0.0.255S3：配置IPSec安全提議[AR1]ipsecproposalAR12[AR1-ipsec-proposal-AR12]espauthentication-algorithmsha1[AR1-ipsec-proposal-AR12]espencryption-algorithm3des[AR2]ipsecproposalAR21//安全提議名字并不要求相同[AR2-ipsec-proposal-AR21]espauthentication-algorithmsha1[AR2-ipsec-proposal-AR21]espencryption-algorithm3desS4：配置IKE安全提議[AR1]ikeproposal55[AR1-ike-proposal-55]encryption-algorithmaes-cbc-256[AR1-ike-proposal-55]authentication-algorithmaes-xcbc-mac-96[AR2]ikeproposal55//IKE安全提議編號可以不同[AR2-ike-proposal-55]encryption-algorithmaes-cbc-256[AR2-ike-proposal-55]authentication-algorithmaes-xcbc-mac-96S5：配置IKEpeer[AR1]ikepeerpeer11v2//peer名可以不同[AR1-ike-peer-peer11]pre-shared-keycipher123456//密碼必須相同[AR1-ike-peer-peer11]ike-proposal55[AR1-ike-peer-peer11]remote-address220.141.2.2[AR2]ikepeerpeer11v2[AR2-ike-peer-peer11]pre-shared-keycipher123456[AR2-ike-peer-peer11]ike-proposal55[AR2-ike-peer-peer11]remote-address202.103.1.1S6：配置IPSec安全策略[AR1]ipsecpolicyp1212isakmp[AR1-ipsec-policy-isakmp-p12-12]securityacl3001[AR1-ipsec-policy-isakmp-p12-12]ike-peerpeer11[AR1-ipsec-policy-isakmp-p12-12]proposalAR12[AR2]ipsecpolicyp2121isakmp[AR2-ipsec-policy-isakmp-p21-21]s