取消
显示结果 
搜索替代 
您的意思是: 
cancel
3248
查看次数
0
有帮助
4
评论
碧云天
Spotlight
Spotlight
一.测试拓扑
101645wxk5z3xs5x31mc1w.png
二.配置步骤
1.基本配置
A.Inside:

interface Loopback0
ip address 1.1.1.1 255.255.255.0
interface Ethernet0/0
ip address 10.1.1.10 255.255.255.0
no shutdown
ip route 2.2.2.0 255.255.255.0 10.1.1.1
B.Site1:
interface GigabitEthernet0/0
nameif Inside
security-level 100
ip address 10.1.1.1 255.255.255.0
no shutdown
interface GigabitEthernet0/1
nameif Outside
security-level 0
ip address 202.100.1.1 255.255.255.0
no shutdown
route Outside 2.2.2.0 255.255.255.0 202.100.1.10
route Outside 61.128.1.1 255.255.255.255 202.100.1.10
route Inside 0.0.0.0 0.0.0.0 10.1.1.10 tunneled
C.Internet:
interface Ethernet0/0
ip address 202.100.1.10 255.255.255.0
no shutdown
interface Ethernet0/1
ip address 61.128.1.10 255.255.255.0
no shutdown
D.Site2:
interface Loopback0
ip address 2.2.2.2 255.255.255.0
interface Ethernet0/0
ip address 61.128.1.1 255.255.255.0
no shutdown
ip route 202.100.1.1 255.255.255.255 61.128.1.10
ip route 1.1.1.0 255.255.255.0 61.128.1.10
2.VPN配置
A.Site1:
第一阶段策略:

crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash md5
group 2
tunnel-group 61.128.1.1 type ipsec-l2l
tunnel-group 61.128.1.1 ipsec-attributes
ikev1 pre-shared-key 0 Cisc0123
第二阶段转换集:
crypto ipsec ikev1 transform-set transet esp-3des esp-md5-hmac
配置感兴趣流:
access-list VPN extended permit ip 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0
配置crypto map并在接口应用:
crypto map crymap 10 match address VPN
crypto map crymap 10 set peer 61.128.1.1
crypto map crymap 10 set ikev1 transform-set transet
crypto map crymap 10 set pfs group2
crypto map crymap interface Outside
备注:这个地方接口名称区分大小写,另外如果一端配置pfs,另一端不配置,
路由器debug crypto isakmp error会由如下报错:
*Dec 24 03:30:33.545: ISAKMP:(1008): IPSec policy invalidated proposal with error 1024
*Dec 24 03:30:33.545: ISAKMP:(1008): phase 2 SA policy not acceptable! (local 61.128.1.1 remote 202.100.1.1)
*Dec 24 03:30:33.545: ISAKMP:(1008):deleting node 287875568 error TRUE reason "QM rejected"
ASA防火墙debug crypto ikev1会由如下报错:
Dec 24 03:50:35 [IKEv1]Group = 61.128.1.1, IP = 61.128.1.1, QM FSM error (P2 struct &0x00007fd87dae2070, mess id 0x4460326d)!
Dec 24 03:50:35 [IKEv1]Group = 61.128.1.1, IP = 61.128.1.1, Removing peer from correlator table failed, no match!
Dec 24 03:50:35 [IKEv1]Group = 61.128.1.1, IP = 61.128.1.1, Session is being torn down. Reason: Phase 2 Mismatch
在Outside接口激活ikev1:
crypto ikev1 enable Outside
B.Site2:
第一阶段策略:

crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakm key 0 Cisc0123 address 202.100.1.1
第二阶段转换集:
crypto ipsec transform-set transet esp-3des esp-md5-hmac
mode tunnel
配置感兴趣流:
ip access-list extended VPN
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
配置crypto map并在接口应用:
crypto map crymap 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set transet
set pfs group2
match address VPN
interface Ethernet0/0
crypto map crymap
三.验证
1.通过PC1能ping通对端身后网络地址

Inside#ping 2.2.2.2 source 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 2/2/4 ms
Inside#
2.防火墙查看安全关联
Site1# show crypto ikev1 sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 61.128.1.1
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Site1#
3.Site2查看安全关联和加解密
Site2#show crypto engine connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
1 IPsec 3DES+MD5 0 4 4 61.128.1.1
2 IPsec 3DES+MD5 4 0 0 61.128.1.1
1001 IKE MD5+3DES 0 0 0 61.128.1.1
Site2#
评论
one-time
Level 13
Level 13
感谢楼主分享,谢谢~
l8310892118l
Level 1
Level 1

谢谢版主分享!
likuo
Spotlight
Spotlight
测试不错。
likuo
Spotlight
Spotlight
拓扑图做的不错。
入门指南

使用上面的搜索栏输入关键字、短语或问题,搜索问题的答案。

我们希望您在这里的旅程尽可能顺利,因此这里有一些链接可以帮助您快速熟悉思科社区:









快捷链接