cisco gre over ipsec详细配置
Cisco GRE OVER IPSEC详细配置
网络环境：
A公司总部路由器R1需要与分支机构R3通信，由于总部有很多不同服务器网段，而分支机构也有一些部门要访问这些服务器，则考虑两路由器之间跑动态路由协议EIGRP，由于IPSEC本身不支持动态路由协议，所以考虑使用GRE隧道，由于GRE本身采用明文传递数据，不能对数据提供安全措施，所以采用IPSEC加密GRE隧道提供安全访问。
总部配置：
interface Loopback0
ip address 1.1.1.1 255.255.255.0
interface Loopback1
ip address 2.2.2.2 255.255.255.0
interface Serial0/0
ip address 209.16.1.1 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 209.16.1.2
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key 6 ciscoh3c address 211.16.1.1
crypto ipsec transform-set ccna esp-3des esp-md5-hmac
mode transport
crypto ipsec profile ccnp
set transform-set ccna
interface Tunnel0
ip address 172.16.1.1 255.255.255.0
tunnel source Serial0/0
tunnel destination 211.16.1.1
tunnel protection ipsec profile ccnp
//配置IPSEC保护GRE流量
router eigrp 10
network 1.0.0.0
network 2.0.0.0
network 172.16.0.0
no auto-summary
exit
互联网路由器配置：
interface Serial0/0
ip address 209.16.1.2 255.255.255.0
no shut
interface Serial0/1
ip address 211.16.1.2 255.255.255.0
no shut
分支机构配置：
int loopback 0
ip add 3.3.3.3 255.255.255.0
int loopback 1
ip add 4.4.4.4 255.255.255.0
int s0/1
ip add 211.16.1.1 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 211.16.1.2
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key 6 ciscoh3c address 209.16.1.1
crypto ipsec transform-set ccna esp-3des esp-md5-hmac
mode transport
crypto ipsec profile ccnp
set transform-set ccna
interface Tunnel0
ip address 172.16.1.2 255.255.255.0
tunnel source Serial0/1
tunnel destination 209.16.1.1
tunnel protection ipsec profile ccnp
router eigrp 10
network 3.0.0.0
network 4.0.0.0
network 172.16.0.0
no auto-summary
通信测试：
(1)
测试从R1
到R3
的通信：
R1#ping 3.3.3.3 source 2.2.2.2 repeat 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 12/122/272 ms
(2)
显示ISAKMP
的情况：
R3#show crypto isakmp sa
dst
src state conn-id slot status
209.16.1.1
211.16.1.1 QM_IDLE 1 0 ACTIVE
(3)
显示IPSEC
的情况：
R3#show crypto ipsec sa
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 211.16.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (211.16.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (209.16.1.1/255.255.255.255/47/0)
current_peer 209.16.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 136, #pkts encrypt: 136, #pkts digest: 136
#pkts decaps: 141, #pkts decrypt: 141, #pkts verify: 141
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 211.16.1.1, remote crypto endpt.: 209.16.1.1
path mtu 1500, ip mtu 1500
current outbound spi: 0x83CCD6EB(2211239659)
inbound esp sas:
spi: 0x46568795(1180075925)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2001, flow_id: 1, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4536878/3450)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x83CCD6EB(2211239659)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2002, flow_id: 2, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4536878/3436)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
(4)
显示加解密数据包的情况：
R3#show crypto engine connections active
ID Interface
IP-Address State Algorithm Encrypt Decrypt 1 Tunnel0 172.16.1.2 set HMAC_MD5+3DES_56_C 0 0
2001 Tunnel0
211.16.1.1 set 3DES+MD5 0 154
2002 Tunnel0
211.16.1.1 set 3DES+MD5 149 0
(5)报文封装格式
：
| 211.16.1.1 | 209.16.1.1 | ESP | GRE | 内网IP报头 | 真实用户数据 | ESP |
测试R1
到R3
的通信结果也是可以PING
通的