IPSECVPNWord文档下载推荐.docx

1、1.1.4、VPN配制R1=access-list 101 permit ip host 10.1.1.1 host 10.2.2.1crypto isakmp policy 1 authentication pre-share hash md5crypto isakmp key 0 cisco address 200.200.100.2 255.255.255.0 crypto ipsec transform-set shanghai esp-des esp-md5-hmaccrypto map vpn_to_shanghai 10 ipsec-isakmp match add 101 se

2、t peer 200.200.100.2 set transform shanghaiip route 10.2.2.0 255.255.255.0 200.200.100.2crypto map vpn_to_shanghaiR2 =access-list 101 permit ip host 10.2.2.1 host 10.1.1.1 exitcrypto isakmp key 0 cisco address 200.200.100.1 255.255.255.0 set peer 200.200.100.1ip route 10.1.1.0 255.255.255.0 200.200.

3、100.11.1.5、校验在R1上扩展ping 10.2.2.1R1#pingProtocol ip:Target IP address:Repeat count 5:Datagram size 100:Timeout in seconds 2:Extended commands n: ySource address or interface: loo 0Type of service 0:Set DF bit in IP header? no:Validate reply data?Data pattern 0xABCD:Loose, Strict, Record, Timestamp, V

4、erbosenone:Sweep range of sizes n:Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:Packet sent with a source address of 10.1.1.1 .!Success rate is 60 percent （3/5）, round-trip min/avg/max = 172/238/288 msR1#show crypto mapCrypto Map vpn_to_shanghai 10 ip

5、sec-isakmp Peer = 200.200.100.2 Extended IP access list 101 access-list 101 permit ip host 10.1.1.1 host 10.2.2.1 Current peer: 200.200.100.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS （Y/N）: N Transform sets= shanghai, Interfaces using crypto map vpn_to_shanghai: Serial1/1R1#

6、show crypto ipsec sainterface: Crypto map tag: vpn_to_shanghai, local addr 200.200.100.1 protected vrf: （none） local ident （addr/mask/prot/port）: （10.1.1.1/255.255.255.255/0/0） remote ident （addr/mask/prot/port）: （10.2.2.1/255.255.255.255/0/0） current_peer 200.200.100.2 port 500 PERMIT, flags=origin

7、_is_acl, #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3 #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: #pkts not decompressed: 0, #pkts decompress failed: #send errors 2, #recv errors 0 local crypto endpt.

8、: 200.200.100.1, remote crypto endpt.: path mtu 1500, ip mtu 1500 current outbound spi: 0xC57F1ABD（3313441469） inbound esp sas: spi: 0x9C8542B5（2625979061） transform: esp-des esp-md5-hmac , in use settings =Tunnel, conn id: 2001, flow_id: SW:1, crypto map: vpn_to_shanghai sa timing: remaining key li

9、fetime （k/sec）: （4416419/3493） IV size: 8 bytes replay detection support: Y Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: 2002, flow_id:2, crypto map: （4416419/3492） outbound ah sas: outbound pcp sas:R1#show crypto isakmp saQOS一、描述QOS：策略设置，一般分为几个步骤第一：分类流量 1.1.1、根据IP地址分类，配制的时候使用AC

10、L访问控制列表 1.1.2、根据思科NBARnba:来分类，它可以根据七层来识别Router（config）#class-map map名Router（config-cmap）#match?access-groupAccessgroupanyAnypacketsclass-mapClassmapcosIEEE802.1Q/ISLclassofservice/userpriorityvaluesdestination-addressDestinationaddressinput-interfaceSelectaninputinterfacetomatchipIPspecificmplsMulti

11、ProtocolLabelSwitchingnotNegatethismatchresultprotocol /NBARqos-groupQos-groupsource-addressSource第二：标记流量（marking） 标记可以基于二层ipprecedenc（IP优先级）也可以基于三层DSCP来标记识别的流量一般在标记的时候分为几大块：语音流、视频流、重要业务流、其它业务流分为从07这么几个级别7和6保留0也保留级别流量种类dscp标记 实例5 语音 ef voip4 流媒体 af4x视频会议等3 业务流量 af3xERP、SQL等办公系统2传统流量 af2x mail、ftp、we

12、b等1 垃圾流量 af1x 抢占带宽的流量例：bt,迅雷，ppstream等注：x代表（1-9）是同一个级别内在分类设置policy-map名称 class-mapsetdscpDSCP setprecedencePRECEDENCECOS设置标记第三：设置策略在policy-map下，匹配class-map后Kbps|percentPERCENTbc定义优先级流量的带宽以及突发流量bandwidth定义保留带宽random-detect启用WREDpoliceCIRBCBEconform-actionactionexceed-actionviolated-actionaction使用令牌桶限

13、速queue-limitPACKETS定义队列中数据报的最大个数service-policypolicy-name调用其它的策略进行嵌套shapeaverage|peakBCBE整形drop丢弃第四：在接口上应用Router（config-if）#service-policyinput|outputpolicy_map名字 input设置在进口上 output设置在出口上如果对QOS不太懂建议看 是一个哥儿们写的笔记很不错二、拓扑图中，COM路由器接内网，ISP路由器是模拟的外网，R2属于边界路由器三、实验说明我们在R2的s1/0和s1/1口上配制接口带宽为 16Kbit/s，然后在s1/0即

14、进口上做标记，标记为，满足条件打20的标记，超出的打10的标记。在s1/1出口上做策略对于打了10标记的流量，做相应的drop四、配制基本配制R1:interface Serial1/1 ip address 10.1.1.2 255.255.255.0 no ship route 20.1.1.0 255.255.255.0 10.1.1.1R2:access-list 100 permit ip 10.1.1.0 0.0.0.255 20.1.1.0 0.0.0.25516000为带宽限制，2000为BC，3000为BEclass-map in-put match access-group

15、 100policy-map in-put class in-put police 16000 2000 3000 conform-action set-dscp-transmit 20 exceed-action set-dscp-transmit 10class-map out-put对于超出的流量做dropmatch ip dscp 10policy-map out-put class out-put police 8000 1500 3000 conform-action transmit exceed-action drop bandwidth 16 ip address 10.1.

16、1.1 255.255.255.0 clock rate 64000 service-policy input in-put ip address 20.1.1.1 255.255.255.0 service-policy output out-putR3:interface Serial1/0 ip address 20.1.1.2 255.255.255.0ip route 10.1.1.0 255.255.255.0 20.1.1.1验证R1#ping ip 20.1.1.2 10 2000Sending 10, 2000-byte ICMP Echos to 20.1.1.2, tim

17、eout is 2 seconds:.!Success rate is 60 percent （6/10）, round-trip min/avg/max = 204/457/596 msR2#show policy-map Policy Map out-put Class out-put police cir 8000 bc 1500 be 3000 conform-action transmit exceed-action drop Policy Map in-put Class in-put police cir 16000 bc 2000 be 3000 conform-action

18、set-dscp-transmit af22 exceed-action set-dscp-transmit af11从show policy-map我们就可以知道，我们先前设置的police 16000 2000 3000 conform-action set-dscp-transmit 20 exceed-action set-dscp-transmit 10police 8000 1500 3000 conform-action transmit exceed-action drop语名的意义 16000是CAR承诺接入速率 其中bc是令牌桶 be是当信令在bc放满后放到be中R2#sh

19、ow policy-map int s1/0 Serial1/0 Class-map: in-put （match-all） 405 packets, 460260 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: access-group 100 police: cir 16000 bps, bc 2000 bytes conformed 175 packets, 137072 bytes; actions: set-dscp-transmit af22 exceeded 230 packets, 323188 byte

20、s; set-dscp-transmit af11 conformed 1000 bps, exceed 0 bps class-default （match-any） 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps any R2#show policy-map int s1/1 Serial1/1 out-put （match-all） 165 packets, 231820 bytes ip dscp af11 （10） cir 8000 bps, bc 1500 bytes conformed 88 packets, 117892 bytes; transmit exceeded 77 packets, 113928 bytes; drop conformed 0 bps, exceed 0 bps 261 packets, 122786 bytes