实验2 Ipsec VPN设计与应用.docx
《实验2 Ipsec VPN设计与应用.docx》由会员分享,可在线阅读,更多相关《实验2 Ipsec VPN设计与应用.docx(17页珍藏版)》请在冰豆网上搜索。
![实验2 Ipsec VPN设计与应用.docx](https://file1.bdocx.com/fileroot1/2023-1/22/0860781d-a48c-4832-aaff-a989fb16d436/0860781d-a48c-4832-aaff-a989fb16d4361.gif)
实验2IpsecVPN设计与应用
实验二IpsecVPN设计与应用
一、实验目的:
1.掌握IPsec隧道配置。
2.深刻理解IKE阶段1与阶段2的协商过程。
二、实验拓扑图:
实验步骤及要求:
1.配置各台路由器的IP地址,并且使用Ping命令确认各路由器的直连口的互通。
2.在R1和R2上配置静态路由。
确保Internet网络骨干可以相互通信。
R1(config)#iproute0.0.0.00.0.0.0f0/0
R2(config)#iproute0.0.0.00.0.0.0f0/0
3.在R1路由器上配置IKE阶段一需要使用策略。
R1(config)#cryptoisakmpenable
4.配置预共享密钥,在两台对等体路由器上密钥必须一致。
R1(config)#cryptoisakmpkey6testkeyaddress200.1.1.2
5.为IKE阶段一的协商,配置ISAKMP的策略。
可以在本地配置多个ISAKMP的策略,在与对等体协商,会选择一个匹配策略,而不管策略的编号。
R1(config)#
R1(config)#cryptoisakmppolicy1
R1(config-isakmp)#hashmd5
R1(config-isakmp)#encryptiondes
R1(config-isakmp)#authenticationpre-share
R1(config-isakmp)#lifetime86400
R1(config-isakmp)#group1
R1(config-isakmp)#exit
R1(config)#
6.配置IPsec变换集,其用于IKE阶段二的IPsec的SA协商。
指定协商的加密参数。
其包含了安全和压缩协议、散列算法和加密算法。
本配置使用了esp与des的协作的认证加密算法,实现对数据的保护。
并且指定其用于隧道模式。
R1(config)#cryptoipsectransform-setTRANesp-desesp-md5-hmac
R1(cfg-crypto-trans)#modetunnel
R1(cfg-crypto-trans)#exit
R1(config)#
7.配置加密访问控制列表,用于指出那些数据流是需要加密的,有时也被称为定义IPsec的感兴趣流。
R1(config)#access-list100permitip192.168.0.00.0.0.255192.168.1.00.0.0.255
R1(config)#
8.配置加密映射表,用于关联相关的变换集。
R1(config)#cryptomapvpn_to_R210ipsec-isakmp
%NOTE:
Thisnewcryptomapwillremaindisableduntilapeer
andavalidaccesslisthavebeenconfigured.
R1(config-crypto-map)#setpeer200.1.1.2
R1(config-crypto-map)#settransform-setTRAN
R1(config-crypto-map)#matchaddress100
R1(config-crypto-map)#exit
R1(config)#exit
R1#
9.将加密映射表应用到需要建立隧道接口。
R1(config)#interfacef0/0
R1(config-if)#cryptomapvpn_to_R2
R1(config-if)#exit
R1(config)#
10.在R2采用如上配置进行配置IKE阶段1和阶段2。
R2(config)#cryptoisakmpenable
R2(config)#
R2(config)#cryptoisakmpkey6testkeyaddress200.1.1.1
R2(config)#
R2(config)#cryptoisakmppolicy2
R2(config-isakmp)#hashmd5
R2(config-isakmp)#encryptiondes
R2(config-isakmp)#authenticationpre-share
R2(config-isakmp)#lifetime86400
R2(config-isakmp)#group1
R2(config-isakmp)#exit
R2(config)#
R2(config)#cryptoipsectransform-setTRANesp-desesp-md5-hmac
R2(cfg-crypto-trans)#modetunnel
R2(cfg-crypto-trans)#exit
R2(config)#
R2(config)#access-list100permitip192.168.1.00.0.0.255192.168.0.00.0.0.255
R2(config)#
R2(config)#cryptomapvpn_to_R110ipsec-isakmp
%NOTE:
Thisnewcryptomapwillremaindisableduntilapeer
andavalidaccesslisthavebeenconfigured.
R2(config-crypto-map)#setpeer200.1.1.1
R2(config-crypto-map)#settransform-setTRAN
R2(config-crypto-map)#matchaddress100
R2(config-crypto-map)#exit
R2(config)#interfacef0/0
R2(config-if)#cryptomapvpn_to_R1
R2(config-if)#exit
R2(config)#
11.在R1路由器打开ISAKMP的调试。
R1#
R1#debugcryptoisakmp
CryptoISAKMPdebuggingison
R1#
R1#debugcryptoipsec
CryptoIPSECdebuggingison
R1#
12.确认R1和R2的ISAKMP的策略。
R1#showcryptoisakmppolicy
GlobalIKEpolicy
Protectionsuiteofpriority1
encryptionalgorithm:
DES-DataEncryptionStandard(56bitkeys).
hashalgorithm:
MessageDigest5
authenticationmethod:
Pre-SharedKey
Diffie-Hellmangroup:
#1(768bit)
lifetime:
86400seconds,novolumelimit
Defaultprotectionsuite
encryptionalgorithm:
DES-DataEncryptionStandard(56bitkeys).
hashalgorithm:
SecureHashStandard
authenticationmethod:
Rivest-Shamir-AdlemanSignature
Diffie-Hellmangroup:
#1(768bit)
lifetime:
86400seconds,novolumelimit
R1#
R2#showcryptoisakmppolicy
GlobalIKEpolicy
Protectionsuiteofpriority2
encryptionalgorithm:
DES-DataEncryptionStandard(56bitkeys).
hashalgorithm:
MessageDigest5
authenticationmethod:
Pre-SharedKey
Diffie-Hellmangroup:
#1(768bit)
lifetime:
86400seconds,novolumelimit
Defaultprotectionsuite
encryptionalgorithm:
DES-DataEncryptionStandard(56bitkeys).
hashalgorithm:
SecureHashStandard
authenticationmethod:
Rivest-Shamir-AdlemanSignature
Diffie-Hellmangroup:
#1(768bit)
lifetime:
86400seconds,novolumelimit
R2#
13.在R1与R2上查看ISAKMP的预共享密钥配置,并确认双方配置一致。
R1#showcryptoisakmpkey
KeyringHostname/AddressPresharedKey
default200.1.1.2testkey
R1#
R2#showcryptoisakmpkey
KeyringHostname/AddressPresharedKey
default200.1.1.1testkey
R2#
14.在R1与R2上查看IPsec的变换集。
R1#showcryptoipsectransform-set
TransformsetTRAN:
{esp-des}
willnegotiate={Tunnel,},
R1#
R2#showcryptoipsectransform-set
TransformsetTRAN:
{esp-des}
willnegotiate={Tunnel,},
R2#
15.在R1上使用扩展命令去ping路由器R2回环口的私有地址。
R1#ping
Protocol[ip]:
TargetIPaddress:
192.168.1.254
Repeatcount[5]:
Datagramsize[100]:
Timeoutinseconds[2]:
Extendedcommands[n]:
y
Sourceaddressorinterface:
192.168.0.254
Typeofservice[0]:
SetDFbitinIPheader?
[no]:
Validatereplydata?
[no]:
Datapattern[0xABCD]:
Loose,Strict,Record,Timestamp,Verbose[none]:
Sweeprangeofsizes[n]:
Typeescapesequencetoabort.
Sending5,100-byteICMPEchosto192.168.1.1,timeoutis2seconds:
Packetsentwithasourceaddressof172.16.1.1
*Jun517:
08:
59.519:
IPSEC(sa_request):
(keyeng.msg.)OUTBOUNDlocal=200.1.1.1,remote=200.1.1.2,
local_proxy=172.16.0.0/255.255.0.0/0/0(type=4),
remote_proxy=192.168.0.0/255.255.0.0/0/0(type=4),
protocol=ESP,transform=NONE(Tunnel),
lifedur=3600sand4608000kb,
spi=0x0(0),conn_id=0,keysize=0,flags=0x0
*Jun517:
08:
59.535:
ISAKMP:
(0):
SArequestprofileis(NULL)
*Jun517:
08:
59.539:
ISAKMP:
Createdapeerstructfor200.1.1.2,peerport500
*Jun517:
08:
59.539:
ISAKMP:
Newpeercreatedpeer=0x653F9630peer_handle=0x80000005
*Jun517:
08:
59.543:
ISAKMP:
Lockingpeerstruct0x653F9630,refcount1forisakmp_initiator
*Jun517:
08:
59.547:
ISAKMP:
localport500,remoteport500
*Jun517:
08:
59.547:
ISAKMP:
setnewnode0toQM_IDLE
*Jun517:
08:
59.551:
insertsasuccessfullysa=65D68724
*Jun517:
08:
59.555:
ISAKMP:
(0):
CannotstartAggressivemode,tryingMainmode.
*Jun517:
08:
59.555:
ISAKMP:
(0):
foundpeerpre-sharedkeymatching200.1.1.2
*Jun517:
08:
59.559:
ISAKMP:
(0):
constructedNAT-Tvendor-07ID
*Jun517:
08:
59.559:
ISAKMP:
(0):
constructedNAT-Tvendor-03ID
*Jun517:
08:
59.559:
ISAKMP:
(0):
constructedNAT-Tvendor-02ID
*Jun517:
08:
59.559:
ISAKMP:
(0):
Input=IKE_MESG_FROM_IPSEC,IKE_SA_REQ_MM
*Jun517:
08:
59.559:
ISAKMP:
(0):
OldState=IKE_READYNewState=IKE_I_MM1
*Jun517:
08:
59.559:
ISAKMP:
(0):
beginningMainModeexchange
*Jun517:
08:
59.559:
ISAKMP:
(0):
sendingpacketto200.1.1.2my_port500peer_port500(I)MM_NO_STATE
*Jun517:
08:
59.663:
ISAKMP(0:
0):
receivedpacketfrom200.1.1.2dport500sport500Global(I)MM_NO_STATE
*Jun517:
08:
59.671:
ISAKMP:
(0):
Input=IKE_MESG_FROM_PEER,IKE_MM_EXCH
*Jun517:
08:
59.671:
ISAKMP:
(0):
OldState=IKE_I_MM1NewState=IKE_I_MM2
*Jun517:
08:
59.683:
ISAKMP:
(0):
processingSApayload.messageID=0
*Jun517:
08:
59.687:
ISAKMP:
(0):
processingvendoridpayload
*J.
Successrateis80percent(4/5),round-tripmin/avg/max=36/53/64ms
R1#un517:
08:
59.687:
ISAKMP:
(0):
vendorIDseemsUnity/DPDbutmajor245mismatch
*Jun517:
08:
59.691:
ISAKMP(0:
0):
vendorIDisNAT-Tv7
*Jun517:
08:
59.691:
ISAKMP:
(0):
foundpeerpre-sharedkeymatching200.1.1.2
*Jun517:
08:
59.695:
ISAKMP:
(0):
localpresharedkeyfound
*Jun517:
08:
59.695:
ISAKMP:
Scanningprofilesforxauth...
*Jun517:
08:
59.699:
ISAKMP:
(0):
CheckingISAKMPtransform1againstpriority1policy
*Jun517:
08:
59.699:
ISAKMP:
encryptionDES-CBC
*Jun517:
08:
59.703:
ISAKMP:
hashMD5
*Jun517:
08:
59.703:
ISAKMP:
defaultgroup1
*Jun517:
08:
59.707:
ISAKMP:
authpre-share
*Jun517:
08:
59.711:
ISAKMP:
lifetypeinseconds
*Jun517:
08:
59.711:
ISAKMP:
lifeduration(VPI)of0x00x10x510x80
*Jun517:
08:
59.719:
ISAKMP:
(0):
attsareacceptable.Nextpayloadis0
*Jun517:
08:
59.723:
ISAKMP:
(0):
processingvendoridpayload
*Jun517:
08:
59.723:
ISAKMP:
(0):
vendorIDseemsUnity/DPDbutmajor245mismatch
*Jun517:
08:
59.727:
ISAKMP(0:
0):
vendorIDisNAT-Tv7
*Jun517:
08:
59.727:
ISAKMP:
(0):
Input=IKE_MESG_INTERNAL,IKE_PROCESS_MAIN_MODE
*Jun517:
08:
59.727:
ISAKMP:
(0):
OldState=IKE_I_MM2NewState=IKE_I_MM2
*Jun517:
08:
59.727:
ISAKMP:
(0):
sendingpacketto200.1.1.2my_port500peer_port500(I)MM_SA_SETUP
*Jun517:
08:
59.727:
ISAKMP:
(0):
Input=IKE_MESG_INTERNAL,IKE_PROCESS_COMPLETE
*Jun517:
08:
59.731:
ISAKMP:
(0):
OldState=IKE_I_MM2NewState=IKE_I_MM3
*Jun517:
08:
59.951:
ISAKMP(0:
0):
receivedpacketfrom200.1.1.2dport500sport500Global(I)MM_SA_SETUP
*Jun517:
08:
59.959:
ISAKMP:
(0):
Input=IKE_MESG_FROM_PEER,IKE_MM_EXCH
*Jun517:
08:
59.959:
ISAKMP:
(0):
OldState=IKE_I_MM3NewState=IKE_I_MM4
*Jun517:
08:
59.975:
ISAKMP:
(0):
processingKEpayload.messageID=0
*Jun517:
09:
00.007:
ISAKMP:
(0):
processingNONCEpayload.messageID=0
*Jun517:
09:
00.007:
ISAKMP:
(0):
foundpeerpre-sharedkeymatching200.1.1.2
*Jun517:
09:
00.019:
ISAKMP:
(1001):
processingvendoridpayload
*Jun517:
09:
00.019:
ISAKMP:
(1001):
vendorIDisUnity
*Jun517:
09:
00.023:
ISAKMP:
(1001):
processingvendoridpayload
*Jun517:
09:
00.023:
ISAKMP:
(1001):
vendorIDisDPD
*Jun517:
09:
00.027:
ISAKMP:
(1001):
processingvendoridpayload
*Jun517:
09:
00.031:
ISAKMP:
(1001):
speakingtoanotherIOSbox!
*Jun517:
09:
00.031:
ISAKMP:
(1001):
Input=IKE_MESG_INTERNAL,IKE_PROCESS_MAIN_MODE
*Jun517:
09:
00.031:
ISAKMP:
(1001):
OldState=IKE_I_MM4NewState=IKE_I_MM4
*Jun517:
09:
00.031:
ISAKMP:
(1001):
Sendinitialcontact
*Jun517:
09:
00.031:
ISAKMP:
(1001):
SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR
*Jun517:
09:
00.031:
ISAKMP(0:
1001):
IDpayload
next-payload:
8
type:
1
address:
200.1.1.1
protocol:
17
port:
500
length:
12
*Jun517:
09:
00.031:
ISAKMP:
(1001):
Totalpayloadlength:
12
*Jun517:
09:
00.031:
ISAKMP:
(1001):
sendingpacket