ipsec技术isakmp（动态）应用

 

IPSEC技术应用

 

isakmp模式

 

 

 

 

 

 

F1配置：

[f1]inter eth0/0

[f1-Ethernet0/0]ip address 192.168.1.254 24

[f1-Ethernet0/0]loopback

[f1-Ethernet0/0]inter eth0/1

[f1-Ethernet0/1]ip address 1.1.1.1 24

[f1-Ethernet0/1]quit

[f1]ip route 0.0.0.0 0 1.1.1.2做路由

加区域：

[f1]fire zone trust

[f1-zone-trust]add inter eth0/0

[f1-zone-trust]quit

[f1]fire zone untrust

[f1-zone-untrust]add inter eth0/1

制做控制列表：

[f1]acl num 3000

[f1-acl-adv-3000]rule 10 permit ip source 192.168.1.0 0.0.0.255 dest 192.168.2.0 0.0.0.255

[f1-acl-adv-3000]rule 20 deny ip source any dest any

[f1-acl-adv-3000]quit

做安全提议：

[f1]ipsec proposal tran1安全提议名字

[f1-ipsec-proposal-tran1]?

Ipsec-proposal view commands:

 display              Display current system information

 encapsulation-mode Specify the packet encapsulation mode

 esp                  Specify the ESP protocol(RFC2406) parameters

 nslookup             Query Internet name servers

 ping                 Ping function

 quit                 Exit from current command view

 return               Exit to User View

  save                 Save current configuration

 tracert              Trace route function

 transform            Specify the security protocol(s) used to transform the

                      packet

 undo                 Cancel current setting

 vrbd                 Show application version

 

[f1-ipsec-proposal-tran1]encap ?

 transport Only the payload of IP packet is protected(transport mode)

 tunnel      The entire IP packet is protected(tunnel mode)

 

[f1-ipsec-proposal-tran1]encap tunnel 制定安全协议报文封装模式（隧道）

[f1-ipsec-proposal-tran1]transform ?

 ah       AH protocol defined in RFC2402

 ah-esp ESP protocol first, then AH protocol

 esp      ESP protocol defined in RFC2406

 

[f1-ipsec-proposal-tran1]transform esp 制定对报文进行安全转换的安全协议（esp）

[f1-ipsec-proposal-tran1]esp encry des 加密算法类型

[f1-ipsec-proposal-tran1]esp auth md5 验证算法类型

[f1-ipsec-proposal-tran1]quit

建立邻居：

[f1]ike peer f2

共享密钥：

[f1-ike-peer-f2]pre-shared-key simple 123456

目的：

[f1-ike-peer-f2]remote-address 1.1.2.1

 

 

 

 

制作安全策略：

 

[f1]ipsec policy policy1 10 isakmp

[f1-ipsec-policy-isakmp-policy1-10]security acl 3000

[f1-ipsec-policy-isakmp-policy1-10]proposal tran1

建立邻居

[f1-ipsec-policy-isakmp-policy1-10]ike-peer f2

应用到接口：

[f1]inter eth0/1

[f1-Ethernet0/1]ipsec policy policy1

 

配置f2：

[f2]inter eth0/0

[f2-Ethernet0/0]ip address 192.168.2.254 24

[f2-Ethernet0/0]inter eth0/1

[f2-Ethernet0/1]ip address 1.1.2.1 24

[f2-Ethernet0/1]quit

[f2]ip route 0.0.0.0 0 1.1.2.2

[f2]fire pack defau permi

[f2]fire zone trust

[f2-zone-trust]add inter eth0/0

 The interface has been added to trust security zone.

[f2-zone-trust]quit

[f2]fire zone untrust

[f2-zone-untrust]add inter eth0/1

[f2-zone-untrust]quit

[f2]acl num 3000

[f2-acl-adv-3000]rule 10 permit ip source 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255

[f2-acl-adv-3000]rule 20 deny ip source any dest any

[f2-acl-adv-3000]quit

[f2]ipsec proposal tran1

[f2-ipsec-proposal-tran1]encap tunnel

[f2-ipsec-proposal-tran1]transform esp

[f2-ipsec-proposal-tran1]esp encry des

[f2-ipsec-proposal-tran1]esp auth md5

[f2-ipsec-proposal-tran1]quit

建立邻居：

[f2]ike peer f1

[f2-ike-peer-f1]pre-share?

   pre-shared-key

 

[f2-ike-peer-f1]pre-shared-key 123456

[f2-ike-peer-f1]remote-address 1.1.1.1

做策略：

[f2]ipsec policy policy1 10 isakmp

[f2-ipsec-policy-isakmp-policy1-10]security acl 3000

[f2-ipsec-policy-isakmp-policy1-10]proposal tran1

[f2-ipsec-policy-isakmp-policy1-10]ike-peer f1

[f2-ipsec-policy-isakmp-policy1-10]quit

[f2]inter eth0/1

[f2-Ethernet0/1]

[f2-Ethernet0/1]ipsec policy polict1

 No such policy exists.

[f2-Ethernet0/1]ipsec policy policy1

 

 

配置交换机：

[Quidway]vlan 10

[Quidway-vlan10]port eth0/10

[Quidway-vlan10]ip address 1.1.1.2 255.255.255.0

                ^

 % Unrecognized command found at '^' position.

[Quidway-vlan10]vlan 20

[Quidway-vlan20]port eth0/20

 

[Quidway]inter vlan 10

[Quidway-Vlan-interface10]

%Dec 14 10:30:20 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:

 Vlan-interface10: turns into UP state

       

[Quidway-Vlan-interface10]ip address 1.1.1.2 255.255.255.0

[Quidway-Vlan-interface10]

%Dec 14 10:30:38 2012 Quidway IFNET/5/UPDOWN:Line protocol on the interface Vlan-interface10 turns into UP state

 

[Quidway-Vlan-interface10]inter vlan 20

[Quidway-Vlan-interface20]

%Dec 14 10:30:45 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:

 Vlan-interface20: turns into UP state

 

[Quidway-Vlan-interface20]ip address 1.1.2.2 255.255.255.0

 

测试：

[f2]dis ip rout 查看路由表

 Routing Table: public net

Destination/Mask    Protocol Pre Cost        Nexthop         Interface

0.0.0.0/0           STATIC   60   0           1.1.2.2         Ethernet0/1

1.1.2.0/24         DIRECT   0    0           1.1.2.1         Ethernet0/1

1.1.2.1/32          DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.0/8         DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.1/32        DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.2.0/24      DIRECT   0    0           192.168.2.254   Ethernet0/0

192.168.2.254/32    DIRECT   0    0           127.0.0.1       InLoopBack0

[f2]ping -a 192.168.2.254 192.168.1.254

 PING 192.168.1.254: 56 data bytes, press CTRL_C to break

    Request time out

    Reply from 192.168.1.254: bytes=56 Sequence=2 ttl=255 time=17 ms

    Reply from 192.168.1.254: bytes=56 Sequence=3 ttl=255 time=16 ms

    Reply from 192.168.1.254: bytes=56 Sequence=4 ttl=255 time=16 ms

    Reply from 192.168.1.254: bytes=56 Sequence=5 ttl=255 time=15 ms

 

 --- 192.168.1.254 ping statistics ---

    5 packet(s) transmitted

    4 packet(s) received

    20.00% packet loss

    round-trip min/avg/max = 15/16/17 ms

 

 野蛮模式

 

野蛮模式：

F1自动获得

 

 

 

 

配置f2：

[f2]inter eth0/0

[f2-Ethernet0/0]ip addres 192.168.2.254 24

[f2-Ethernet0/0]loopback

[f2-Ethernet0/0]inter eth0/1

[f2-Ethernet0/1]ip address 1.1.2.1 24

[f2]ip route 0.0.0.0 0 1.1.2.2

加区域：

[f2]firewall packet-filter default permit

[f2]firewall zone trust

[f2-zone-trust]add inter eth0/0

[f2]firewall zone untrust

[f2-zone-untrust]add inter eth0/1

做控制列表：

[f2]acl number 3000

[f2-acl-adv-3000]rule 10 permit ip source 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255

[f2-acl-adv-3000]rule 20 deny ip source any dest any

 

做安全提议：

[f2]ipsec proposal tran1

[f2-ipsec-proposal-tran1]encapsulation-mode tunnel

[f2-ipsec-proposal-tran1]transform esp

[f2-ipsec-proposal-tran1]esp encryption-algorithm des

[f2-ipsec-proposal-tran1]esp authentication-algorithm md5

做邻居;

[f2]ike peer f1

[f2-ike-peer-f1]?

Ike-peer 系统视图命令:

 certificate      设置证书的参数

 display          显示当前系统信息

 dpd              配置peer的DPD

 exchange-mode    指定IKE阶段一使用的协商模式

 id-type          设置地址或名字作为ID

 local            设置隧道本端子网类型

 local-address    指定本端IP地址

 nat              使用udp封装进行nat透传

 nslookup         查询域名服务

 peer             设置隧道对端子网类型

 ping             检查网络连接或主机是否可达

 pre-shared-key 指定预共享密钥

 quit             退出当前的命令视图

 remote-address 指定对端IP地址

 remote-name      指定对端网关名

 return           退到用户视图

 save             保存当前有效配置

 tracert          跟踪到达目的地的路由

 undo             取消当前设置

 vrbd             显示VRP版本

 

[f2-ike-peer-f1]exchange-mode ? 

 aggressive 野蛮模式

 main         主模式

 

[f2-ike-peer-f1]exchange-mode aggressive

[f2-ike-peer-f1]id-type name               设置名字作为id

[f2-ike-peer-f1]pre-shared-key simple 123456

[f2-ike-peer-f1]remote-name f1

[f2-ike-peer-f1]local-address 1.1.2.1

[f2]ike local-name f2

做策略：

[f2]ipsec policy policy1 10 isakmp

[f2-ipsec-policy-isakmp-policy1-10]security acl 3000

[f2-ipsec-policy-isakmp-policy1-10]proposal tran1

[f2-ipsec-policy-isakmp-policy1-10]ike-peer f1

应用：

[f2]inter eth0/1

[f2-Ethernet0/1]ipsec policy policy1

建立控制列表：

[f1]acl number 3000

[f1-acl-adv-3000]rule 10 permit ip source 192.168.1.0 0.0.0.255 dest 192.168.2.0 0.0.0.255

[f1-acl-adv-3000]rule 20 deny ip source any dest any

安全提议：

[f1]ipsec proposal tran1

[f1-ipsec-proposal-tran1]encap      

[f1-ipsec-proposal-tran1]encapsulation-mode tunnel

[f1-ipsec-proposal-tran1]transform esp

[f1-ipsec-proposal-tran1]esp encry       

[f1-ipsec-proposal-tran1]esp encryption-algorithm des

[f1-ipsec-proposal-tran1]esp auth 

[f1-ipsec-proposal-tran1]esp authentication-algorithm md5

建立邻居：

[f1]ike peer f2

[f1-ike-peer-f2]exchange-mode aggressive

[f1-ike-peer-f2]id-type name

[f1-ike-peer-f2]remote-address 1.1.2.1

[f1-ike-peer-f2]remote-name f2

密钥：

[f1-ike-peer-f2]pre-shared-key simple 123456

安全策略：

[f1-ike-peer-f2]quit

[f1]ipsec policy policy1 10 isakmp

[f1-ipsec-policy-isakmp-policy1-10]security acl 3000

[f1-ipsec-policy-isakmp-policy1-10]proposal tran1

[f1-ipsec-policy-isakmp-policy1-10]ike-peer f2

[f1-ipsec-policy-isakmp-policy1-10]quit

应用：

[f1]inter eth0/1

[f1-Ethernet0/1]ipsec policy policy1

设置接口为自动获得地址：

[f1]inter eth0/1

[f1-Ethernet0/1]ip ?

 address           设置接口的IP地址

 fast-forwarding 快转开关信息

 policy            使能策略路由

 relay             中继

 urpf              单播反向路径查找功能

 

[f1-Ethernet0/1]ip address ?

 X.X.X.X       IP地址

 bootp-alloc 使用BOOTP协商分配IP地址

 dhcp-alloc    使用DHCP协商分配IP地址

 

[f1-Ethernet0/1]ip address dhcp-alloc

[f1-Ethernet0/1]

%2012/12/13 00:51:52:687 f1 IFNET/4/UPDOWN:链路协议在接口Ethernet0/1上状态变为UP

[f1]inter eth0/0

[f1-Ethernet0/0]ip address 192.168.1.254 24

[f1-Ethernet0/0]loopback

[f1]ip route 0.0.0.0 0 1.1.1.2

交换机配置：

[Quidway]vlan 10

[Quidway-vlan10]port eth0/10

[Quidway-vlan10]vlan 20

[Quidway-vlan20]port eth0/20

[Quidway-vlan20]quit

[Quidway]inter vlan 10

[Quidway-Vlan-interface10]ip address 1.1.1.2 255.255.255.0

[Quidway]inter vlan 20

[Quidway-Vlan-interface20]

%Dec 14 12:10:27 2012 Quidway L2INF/5/VLANIF LINK STATUS CHANGE:

 Vlan-interface20: turns into UP state

 

[Quidway-Vlan-interface20]ip address 1.1.2.2 255.255.255.0

做dhcp服务器：

[Quidway]dhcp server ip-pool f1

[Quidway-dhcp-f1]network 1.1.1.0 mask 255.255.255.0

[Quidway-dhcp-f1]gateway-list 1.1.1.2

 

测试：

[f1]ping -a 192.168.1.254 192.168.2.254

 PING 192.168.1.254: 56 data bytes, press CTRL_C to break

    Request time out

    Reply from 192.168.2.254: bytes=56 Sequence=2 ttl=255 time=17 ms

    Reply from 192.168.2.254: bytes=56 Sequence=3 ttl=255 time=16 ms

    Reply from 192.168.2.254: bytes=56 Sequence=4 ttl=255 time=16 ms

    Reply from 192.168.2.254: bytes=56 Sequence=5 ttl=255 time=15 ms

 

 --- 192.168.1.254 ping statistics ---

    5 packet(s) transmitted

    4 packet(s) received

    20.00% packet loss

    round-trip min/avg/max = 15/16/17 ms