本地Cisco与云端H3C建立GRE over IPsec

作者: 小岳_ | 来源:发表于2021-01-20 22:00 被阅读0次

一、目标

内网Cisco路由器与云端H3C路由器建立GRE over IPsec，最终实现Tunnel接口互通；
为内网与云端运行动态路由协议(RIP、OSPF、ISIS、BGP)建立基础。

二、拓扑

image.png

拓扑中Cisco VPN路由器为旁挂到核心交换机部署，接口IP为私网IP；
如拓扑所示，Cisco VPN路由器访问互联网需经过两道NAT转换；
云端H3C VSR1000接口配置为私网IP:172.25.25.88，公网IP为：39.98.xxx.xxx；
由于Cisco VPN路由器为私网IP，所以IPsecVPN需配置为野蛮模式。

三、GRE over IPsec配置

3.1 配置思路

创建Loopback接口，配置IPsec感兴趣流为本端Loopback接口IP至云端Loopback接口IP，云端反之同理；
配置IPsec野蛮模式VPN；
创建Tunnel接口，为Tunnel接口配置IP地址；
指定Tunnel接口源IP为Loopback接口的IP，目标IP为对端Loopback接口的IP；
Tunnel接口互ping测试。

3.2 本地Cisco VPN路由器配置

创建Loopback接口：
interface Loopback10 
 ip address 10.195.195.2 255.255.255.255
 exit

配置感兴趣流ACL：
ip access-list extended ipsecacl
 permit ip host 10.195.195.2 host 10.195.195.1
 exit

配置IKE阶段加密和验证方式：
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
 exit

指定IPsec VPN为野蛮模式(采用FQDN认证，FQDN配置为"1841")，指向IPsec对等体：
crypto isakmp peer address 39.98.xxx.xxx
 set aggressive-mode password xxxxxxx
 set aggressive-mode client-endpoint fqdn 1841
 exit

配置IPsec阶段加密和验证方式(配置转换集)：
crypto ipsec transform-set vsrset esp-3des esp-md5-hmac 
 exit

关联对等体、转换集和感兴趣流：
crypto map vsrvpn 30 ipsec-isakmp 
 set peer 39.98.xxx.xxx
 set transform-set vsrset 
 match address ipsecacl
 exit

接口调用IPsec策略：
interface FastEthernet0/0
 crypto map vsrvpn
 exit

创建Tunel接口：
interface Tunnel10
 ip address 10.100.100.2 255.255.255.252
 tunnel source Loopback10
 tunnel destination 10.195.195.1
 exit

出口防火墙(Cisco ASA)必须配置NAT Bypass，用于使IPsec VPN互访的流量不做NAT，即在NAT中Bypass掉VPN感兴趣流的互访流量：

object network 10.195.195.2
 host 10.195.195.2
 exit
object network 10.195.195.1
 host 10.195.195.1
 exit

通过配置Twice NAT旁路掉VPN感兴趣流的互访流量：
nat (inside,outside) source static 10.195.195.2 10.195.195.2 destination static 10.195.195.1 10.195.195.1

3.3 云端H3C vSR1000路由器配置

创建Loopback接口：
interface LoopBack10
 ip address 10.195.195.1 255.255.255.255
 quit

配置感兴趣流ACL：
云端为IPsec接收方，IPsec隧道的建立应由本地Cisco路由器主动发起，所以云端路由器不需配置感兴趣流ACL。

配置IKE阶段加密和验证方式：
ike proposal 1
 encryption-algorithm 3des-cbc
 dh group2
 authentication-algorithm md5
 quit

指定野蛮模式的本机身份：
ike identity fqdn vsr

创建IKE Keychain：
ike keychain kcvsr
 pre-shared-key hostname 1841 key simple xxxxxxx
 quit

创建IKE Profile，关联Keychain、配置为野蛮模式、指定对端FQDN、关联IKE Proposal：
ike profile 1841
 keychain kcvsr
 exchange-mode aggressive
 match remote identity fqdn 1841
 proposal 1
 quit

配置IPsec阶段加密和验证方式(配置转换集)：
ipsec transform-set ts1841
 esp encryption-algorithm 3des-cbc 
 esp authentication-algorithm md5
 quit

创建IPsec策略模板(H3C、华为配置必须通过模板方式配置野蛮模式的IPsec VPN)，模板关联转换集和IKE profile：
ipsec policy-template pt1841 1
 transform-set ts1841 
 ike-profile 1841
 quit

将与IPsec策略模板与IPsec VPN策略关联：
ipsec policy ipsecvsr 1 isakmp template pt1841

接口调用IPsec策略：
interface GigabitEthernet1/0
 ipsec apply policy ipsecvsr
 quit

创建Tunel接口：
interface Tunnel10 mode gre
 ip address 10.100.100.1 255.255.255.252
 source LoopBack10
 destination 10.195.195.2
 quit

3.4 状态验证

在Cisco VPN路由器上主动发起流量，以触发野蛮模式IPsec VPN隧道的建立

1841-Spoke#ping 10.195.195.1 source 10.195.195.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.195.195.1, timeout is 2 seconds:
Packet sent with a source address of 10.195.195.2 
.!!!!

验证本地Cisco VPN路由器IPsec VPN隧道状态

验证IKE阶段状态：
1841-Spoke#show crypto isakmp sa 
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
39.98.xxx.xxx   172.16.101.101  QM_IDLE           1004 ACTIVE

IPv6 Crypto ISAKMP SA

验证IPsec阶段状态：
1841-Spoke#show crypto ipsec sa                                         

interface: FastEthernet0/0
    Crypto map tag: vsrvpn, local addr 172.16.101.101

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.195.195.2/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (10.195.195.1/255.255.255.255/0/0)
   current_peer 39.98.xxx.xxx port 4500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 338, #pkts encrypt: 338, #pkts digest: 338
    #pkts decaps: 338, #pkts decrypt: 338, #pkts verify: 338
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

     local crypto endpt.: 172.16.101.101, remote crypto endpt.: 39.98.xxx.xxx
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0x26A607EF(648415215)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xFC90A349(4237337417)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2053, flow_id: FPGA:53, sibling_flags 80000046, crypto map: vsrvpn
        sa timing: remaining key lifetime (k/sec): (1769282/204)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
      spi: 0x3CE66A5(63858341)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2055, flow_id: FPGA:55, sibling_flags 80000046, crypto map: vsrvpn
        sa timing: remaining key lifetime (k/sec): (1782998/2905)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xDAE1C959(3672230233)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2054, flow_id: FPGA:54, sibling_flags 80000046, crypto map: vsrvpn
        sa timing: remaining key lifetime (k/sec): (1769282/204)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
      spi: 0x26A607EF(648415215)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2056, flow_id: FPGA:56, sibling_flags 80000046, crypto map: vsrvpn
        sa timing: remaining key lifetime (k/sec): (1782998/2905)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

验证云端VSR 1000路由器IPsec VPN隧道状态

验证IKE阶段状态：
[VSR1K]display ike sa
    Connection-ID   Local               Remote              Flag      DOI    
-------------------------------------------------------------------------
    63              172.25.25.88        121.69.xxx.xxx        RD        IPsec  
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY

验证IPsec阶段状态：
[VSR1K]display ipsec sa 
-------------------------------
Interface: GigabitEthernet1/0
-------------------------------

  -----------------------------
  IPsec policy: ipsecvsr
  Sequence number: 1
  Mode: Template
  -----------------------------
    Tunnel id: 0
    Encapsulation mode: tunnel
    Perfect Forward Secrecy: 
    Inside VPN: 
    Extended Sequence Numbers enable: N
    Traffic Flow Confidentiality enable: N
    Path MTU: 1436
    Tunnel:
        local  address: 172.25.25.88
        remote address: 121.69.xxx.xxx
    Flow:
        sour addr: 10.195.195.1/255.255.255.255  port: 0  protocol: ip
        dest addr: 10.195.195.2/255.255.255.255  port: 0  protocol: ip

    [Inbound ESP SAs]
      SPI: 648415215 (0x26a607ef)
      Connection ID: 47244640256
      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/2739
      Max received sequence-number: 5
      Anti-replay check enable: Y
      Anti-replay window size: 64
      UDP encapsulation used for NAT traversal: Y
      Status: Active

    [Outbound ESP SAs]
      SPI: 63858341 (0x03ce66a5)
      Connection ID: 47244640257
      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/2739
      Max sent sequence-number: 5
      UDP encapsulation used for NAT traversal: Y
      Status: Active

  -----------------------------
  IPsec policy: ipsecvsr
  Sequence number: 1
  Mode: Template
  -----------------------------
    Tunnel id: 0
    Encapsulation mode: tunnel
    Perfect Forward Secrecy: 
    Inside VPN: 
    Extended Sequence Numbers enable: N
    Traffic Flow Confidentiality enable: N
    Path MTU: 1436
    Tunnel:
        local  address: 172.25.25.88
        remote address: 121.69.xxx.xxx
    Flow:
        sour addr: 10.195.195.1/255.255.255.255  port: 0  protocol: ip
        dest addr: 10.195.195.2/255.255.255.255  port: 0  protocol: ip

    [Inbound ESP SAs]
      SPI: 3672230233 (0xdae1c959)
      Connection ID: 21474836482
      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843200/38
      Max received sequence-number: 0
      Anti-replay check enable: Y
      Anti-replay window size: 64
      UDP encapsulation used for NAT traversal: Y
      Status: Active

    [Outbound ESP SAs]
      SPI: 4237337417 (0xfc90a349)
      Connection ID: 30064771075
      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843200/38
      Max sent sequence-number: 0
      UDP encapsulation used for NAT traversal: Y
      Status: Active

验证Tunnel接口连通性：

[VSR1K]ping -a 10.100.100.1 10.100.100.2
Ping 10.100.100.2 (10.100.100.2) from 10.100.100.1: 56 data bytes, press CTRL+C to break
56 bytes from 10.100.100.2: icmp_seq=0 ttl=255 time=10.069 ms
56 bytes from 10.100.100.2: icmp_seq=1 ttl=255 time=9.780 ms
56 bytes from 10.100.100.2: icmp_seq=2 ttl=255 time=10.331 ms
56 bytes from 10.100.100.2: icmp_seq=3 ttl=255 time=9.759 ms
56 bytes from 10.100.100.2: icmp_seq=4 ttl=255 time=9.911 ms

--- Ping statistics for 10.100.100.2 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 9.759/9.970/10.331/0.212 ms

四、最后

如果条件允许，不建议使用野蛮模式的IPsec VPN，因为安全性较差。

本地Cisco与云端H3C建立GRE over IPsec

一、目标

二、拓扑

三、GRE over IPsec配置

3.1 配置思路

3.2 本地Cisco VPN路由器配置

3.3 云端H3C vSR1000路由器配置

3.4 状态验证

四、最后

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读