IPsec VPN配置实验（固定地址）

IPsec VPN配置实验（固定地址）

引用

CSDN

1.

https://m.blog.csdn.net/m0_69435261/article/details/144796500

IPsec VPN（Internet Protocol Security Virtual Private Network）是一种基于IP层的安全协议，用于在公共网络上建立安全的通信隧道。它通过加密和认证机制保护数据传输的安全性，广泛应用于企业网络、远程办公等场景。本文将详细介绍在固定IP地址环境下配置IPsec VPN的具体步骤。

实验需求

R1为企业总部网关，R3为企业分部网关，分部与总部通过公网建立通信。总部子网为100.1.12.0/24，分部子网为100.1.23.0/24。企业希望对分部子网与总部子网之间相互访问的流量进行安全保护。分部与总部通过公网建立通信，可以在分部网关与总部网关之间建立一个IPSec隧道来实施安全保护。

实验拓扑图：

基础配置

R1

[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 100.1.12.1 24
[R1-GigabitEthernet0/0/0]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 192.168.1.254 24
[R1]ip route-static 0.0.0.0 0.0.0.0 100.1.12.2

R2_ISP

[R2_ISP]int g0/0/0
[R2_ISP-GigabitEthernet0/0/0]ip add 100.1.12.2 24
[R2_ISP-GigabitEthernet0/0/0]int g0/0/1
[R2_ISP-GigabitEthernet0/0/1]ip add 100.1.23.2 24

R3

[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ip add 100.1.23.1 24
[R3-GigabitEthernet0/0/0]int g0/0/1
[R3-GigabitEthernet0/0/1]ip add 192.168.2.254 24
[R3-GigabitEthernet0/0/1]q
[R3]ip route-static 0.0.0.0 0.0.0.0 100.1.23.2

配置第一阶段 IKE SA

协商出IKE SA ，对第二阶段IPsecSA的协商过程做保护

R1

[R1]ike proposal 1
[R1-ike-proposal-1]encryption-algorithm 3des-cbc
[R1-ike-proposal-1]authentication-algorithm md5
[R1-ike-proposal-1]dh group5
[R1-ike-proposal-1]q
[R1]ike peer 1 v1
[R1-ike-peer-1]ike-proposal 1
[R1-ike-peer-1]pre-shared-key simple 110
[R1-ike-peer-1]remote-address 100.1.23.1

R3

[R3]ike proposal 1
[R3-ike-proposal-1]encryption-algorithm 3des-cbc
[R3-ike-proposal-1]authentication-algorithm md5
[R3-ike-proposal-1]dh group5
[R3-ike-proposal-1]q
[R3]ike peer 1 v1
[R3-ike-peer-1]ike-proposal 1
[R3-ike-peer-1]pre-shared-key simple 110
[R3-ike-peer-1]remote-address 100.1.12.1

配置第二阶段 IPsec SA

在阶段1建立的IKE SA的保护下完成IPSec SA的协商

R1

[R1]acl 3000
[R1-acl-adv-3000]rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
[R1-acl-adv-3000]q
[R1]ipsec proposal 1
[R1-ipsec-proposal-1]esp encryption-algorithm 3des
[R1-ipsec-proposal-1]esp authentication-algorithm md5
[R1-ipsec-proposal-1]encapsulation-mode tunnel
[R1-ipsec-proposal-1]q
[R1]ipsec policy aaa 1 isakmp
[R1-ipsec-policy-isakmp-aaa-1]ike-peer 1
[R1-ipsec-policy-isakmp-aaa-1]proposal 1
[R1-ipsec-policy-isakmp-aaa-1]security acl 3000
[R1-ipsec-policy-isakmp-aaa-1]q
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ipsec policy aaa

R3

[R3]acl 3000
[R3-acl-adv-3000]rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
[R3-acl-adv-3000]q
[R3]ipsec proposal 1
[R3-ipsec-proposal-1]encapsulation-mode tunnel
[R3-ipsec-proposal-1]esp authentication-algorithm md5
[R3-ipsec-proposal-1]esp encryption-algorithm 3des
[R3-ipsec-proposal-1]q
[R3]ipsec policy aaa 1 isakmp
[R3-ipsec-policy-isakmp-aaa-1]ike-peer 1
[R3-ipsec-policy-isakmp-aaa-1]proposal 1
[R3-ipsec-policy-isakmp-aaa-1]security acl 3000
[R3-ipsec-policy-isakmp-aaa-1]q
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ipsec policy aaa

测试结果

查看基本命令

查看IKE SA 的基本信息

查看IPSEC SA 的基本信息

清除IKE / IPsec SA命令

在IPsec VPN 建立完成后，我们想修改一些东西的时候，需要把SA清除干净，这个时候才会去重新建立IPsec VPN,我们所添加的东西才会生效