Ipsec 详细配置

1.Berlin(config)#crypto isakmp enable
启用IKE/isakmp(建立传送IPsec隧道参数的隧道)

2.Berlin(config)#crypto isakmp policy 1
设置isakmp策略
Berlin(config-isakmp)#authentication pre-share
身份验证方法：pre-share/rsa-encr/rsa-sig
Berlin(config-isakmp)#encryption 3des
加密的方法：des/3des/aes
Berlin(config-isakmp)#group 5
传密钥的方法D-H算法：1/2/5
Berlin(config-isakmp)#hash sha
完整性的方法：md5/sha
Berlin(config-isakmp)#lifetime 3600
isakmp/IKE的SA的存在时间
Berlin(config-isakmp)#exit
Berlin(config)#crypto isakmp key cisco address 192.168.0.1
预共享密钥是什么，IKE/isakmp对端是什么

3.Berlin(config)#crypto ipsec transform-set 10 esp-3des ah-sha-hmac
配置IPSec转换集合
Berlin(cfg-crypto-trans)#mode tunnel
采用隧道模式还是传输模式tunnel/transport
Berlin(cfg-crypto-trans)#exit
Berlin(config)#crypto ipsec security-association lifetime seconds 3600
IPSec安全关联存在的时间

4.Berlin(config)#access-list 101 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255
什么样的流量要进隧道加密

5.Berlin(config)#crypto map mymap 110 ipsec-isakmp
建立加密映射
Berlin(config-crypto-map)#match address 101
访问控制列表101的流量要加密
Berlin(config-crypto-map)#set peer 192.168.0.1
IPSEC SA对端是192.168.0.1
Berlin(config-crypto-map)#set transform-set 10
IPSEC SA的参数采用转换集名称10
Berlin(config-crypto-map)#exit

6.Berlin(config)#int f0/0
Berlin(config-if)#crypto map mymap
加密映射应用到接口上

Berlin#show crypto isakmp policy
查看IKE/isakmp策略
Global IKE policy
Protection suite of priority 1
encryption algorithm: Three key triple DES
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #5 (1536 bit)
lifetime: 3600 seconds, no volume limit
Default protection suite
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature
Diffie-Hellman group: #1 (768 bit)
lifetime: 86400 seconds, no volume limit

Berlin#show crypto ipsec transform-set
查看ipsec转换集
Transform set 10: { ah-sha-hmac }
will negotiate = { Tunnel, },
{ esp-3des }
will negotiate = { Tunnel, },

Berlin#show crypto isakmp sa
查看IKE/isakmp的安全关联
dst src state conn-id slot status
192.168.0.1 192.168.0.2 QM_IDLE 1 0 ACTIVE