×××篇之ISAKMP Profile ×××

 

 

R1---------------------------R5 

.1       200.100.1.0/24     .2

 

R2---------------------------R5     其中R5模拟ISP

.1       200.100.2.0/24     .2

 

R3---------------------------R5 

.1       200.100.3.0/24     .2

 

优势：在一个企业当中，如果分部比较多的情况，单纯的IPSEC-×××就无法满足现有需求，因为IPSEC-×××一条命令把Peer给写死了，ISAKMP Profile ×××可以帮助公司总部与多个分部联系起来，既节省成本，又提高安全！

 

详细配置：

R1：

Building configuration...

Current configuration : 1930 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
ip cef
!
!
crypto keyring cisco
  pre-shared-key address 200.100.2.1 key 6 cisco
crypto keyring cisco1
  pre-shared-key address 200.100.3.1 key 6 cisco
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp profile cisco
   keyring cisco
   keyring cisco1
   match identity address 200.100.2.1 255.255.255.255
   match identity address 200.100.3.1 255.255.255.255
!
!
crypto ipsec transform-set cisco esp-3des esp-md5-hmac
!
!
crypto map tor2 1 ipsec-isakmp
 set peer 200.100.2.1
 set peer 200.100.3.1
 set transform-set cisco
 set isakmp-profile cisco
 match address 100
!        
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial1/0
 ip address 200.100.1.1 255.255.255.0
 serial restart-delay 0
 no dce-terminal-timing-enable
 crypto map tor2
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 200.100.1.2
!
!        
ip http server
no ip http secure-server
!
access-list 100 permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
access-list 100 permit ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255
!
control-plane
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
end

 

 

 

 

 

R2：

Building configuration...

Current configuration : 1548 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
ip cef

no ip domain lookup
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key 6 cisco address 200.100.1.1
!
!
crypto ipsec transform-set cisco esp-3des esp-md5-hmac
!
crypto map tor1 1 ipsec-isakmp
 set peer 200.100.1.1
 set transform-set cisco
 match address 100
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial1/0
 ip address 200.100.2.1 255.255.255.0
 serial restart-delay 0
 no dce-terminal-timing-enable
 crypto map tor1
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 200.100.2.2
!
!
ip http server
no ip http secure-server
!
access-list 100 permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

 

 

 

 

 

R3：

Current configuration : 1546 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key 6 cisco address 200.100.1.1
!
!
crypto ipsec transform-set tor1 esp-3des esp-md5-hmac
!
crypto map tor1 1 ipsec-isakmp
 set peer 200.100.1.1
 set transform-set tor1
 match address 100
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial1/0
 ip address 200.100.3.1 255.255.255.0
 serial restart-delay 0
 no dce-terminal-timing-enable
 crypto map tor1
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 200.100.3.2
!
!
ip http server
no ip http secure-server
!
access-list 100 permit ip 3.3.3.0 0.0.0.255 1.1.1.0 0.0.0.255
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

 

 

 

 

 

R5：（模拟ISP）

Current configuration : 1168 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISP
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
ip cef
    
!
no ip domain lookup
!
!        
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial1/0
 ip address 200.100.1.2 255.255.255.0
 serial restart-delay 0
 clock rate 64000
 no dce-terminal-timing-enable
!
interface Serial1/1
 ip address 200.100.2.2 255.255.255.0
 serial restart-delay 0
 clock rate 64000
 no dce-terminal-timing-enable
!
interface Serial1/2
 ip address 200.100.3.2 255.255.255.0
 serial restart-delay 0
 clock rate 64000
 no dce-terminal-timing-enable
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no dce-terminal-timing-enable
!
ip classless
!
!
ip http server
no ip http secure-server
!
 
control-plane
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

 

 

验证：

 

R2拼R1：

R2#ping 1.1.1.1 source 2.2.2.2 repeat 10

Type escape sequence to abort.
Sending 10, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!!!!!!
Success rate is 100 percent (10/10), round-trip min/avg/max = 112/249/436 ms

 

 

R3拼R1：

R3#ping 1.1.1.1 source 3.3.3.3 r 10

Type escape sequence to abort.
Sending 10, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 3.3.3.3
!!!!!!!!!!
Success rate is 100 percent (10/10), round-trip min/avg/max = 20/228/352 ms

 

注：两家分公司不能拼通，如要实现，需用动态多点×××。