H3Cv7版本ipsecovergre配置指導

Ipsecovergre配置RT1和RT3用環(huán)回口來模擬私網(wǎng)上的接口。它們的封裝方式是先封裝ipsec，而后在進行gre的封裝，因此在ipsec的ACL中要般配的事兩端私網(wǎng)的地址。報文的封裝格式：IP公|gre|ip頭|esp頭|ip私|date|esp尾RT1的主要配置：進入系統(tǒng)試圖<H3C>system-view配置接口IP[H3C]interfaceGigabitEthernet0/0創(chuàng)立環(huán)回接口：[H3C-GigabitEthernet0/0]quit[H3C]interfaceLoopBack0創(chuàng)立Tunnel口：[H3C-LoopBack0]quit.[H3C]interfaceTunnel0modegre指定Tunnel口源接口地址指定Tunnel口目的端地址[H3C-Tunnel0]quit創(chuàng)立接見控制列表[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]quit創(chuàng)立ipsec安全建議tran1[H3C]ipsectransform-settran1指定安全協(xié)議的工作模式為地道模式[H3C-ipsec-transform-set-tran1]encapsulation-modetunnel選擇安全協(xié)議為esp[H3C-ipsec-transform-set-tran1]protocolesp加密算法為des[H3C-ipsec-transform-set-tran1]espencryption-algorithmdes-cbc考據(jù)算法為md5[H3C-ipsec-transform-set-tran1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-tran1]quit配置ikekaychain，創(chuàng)立ike1[H3C]ikekeychainike1配置對端tunnel口的IP和使用的預共享秘鑰[H3C-ike-keychain-ike1]quit.創(chuàng)立ikeprofile，名稱為profile1[H3C]ikeprofileprofile1綁定ikekeychain[H3C-ike-profile-profile1]keychainike1配置當?shù)胤庋b的IP地址配置對端封裝的IP地址[H3C-ike-profile-profile1]matchremoteidentityaddress100.1.1.224[H3C-ike-profile-profile1]quit創(chuàng)立一條ike協(xié)商方式的ipsec安全策略，序列號為1，名字為policy1[H3C]ipsecpolicypolicy11isakmp指定引用ACL3000[H3C-ipsec-policy-isakmp-policy1-1]securityacl3000指定引用的ikeprofile為profile1[H3C-ipsec-policy-isakmp-policy1-1]ike-profileprofile1指定引用的安全協(xié)議為tran1[H3C-ipsec-policy-isakmp-policy1-1]transform-settran1指定對端地道地址[H3C-ipsec-policy-isakmp-policy1-1]quit進入Tunnel0[H3C]interfaceTunnel0把ipsec策略在Tunnel口奏效[H3C-Tunnel0]ipsecapplypolicypolicy1在三個路由器之間使用rip路由協(xié)議[H3C]rip[H3C-rip-1]version2.[H3C-rip-1]undosummaryRT2的主要配置：<H3C>system-view[H3C]interfaceGigabitEthernet0/0[H3C-GigabitEthernet0/0]quit[H3C]interfaceGigabitEthernet0/1[H3C-GigabitEthernet0/1]quit配置rip路由協(xié)議[H3C]rip[H3C-rip-1]version2[H3C-rip-1]undosummaryRT3的主要配置：進入系統(tǒng)試圖<H3C>system-view配置接口IP[H3C]interfaceGigabitEthernet0/0創(chuàng)立環(huán)回接口：[H3C-GigabitEthernet0/0]quit[H3C]interfaceLoopBack0.創(chuàng)立Tunnel口：[H3C-LoopBack0]quit[H3C]interfaceTunnel0modegre指定Tunnel口源接口地址指定Tunnel口目的端地址[H3C-Tunnel0]quit創(chuàng)立接見控制列表[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]quit創(chuàng)立ipsec安全建議tran1[H3C]ipsectransform-settran1指定安全協(xié)議的工作模式為地道模式[H3C-ipsec-transform-set-tran1]encapsulation-modetunnel選擇安全協(xié)議為esp[H3C-ipsec-transform-set-tran1]protocolesp加密算法為des[H3C-ipsec-transform-set-tran1]espencryption-algorithmdes-cbc考據(jù)算法為md5[H3C-ipsec-transform-set-tran1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-tran1]quit配置ikekaychain，創(chuàng)立ike1[H3C]ikekeychainike1.配置對端tunnel口的IP和使用的預共享秘鑰[H3C-ike-keychain-ike1]quit創(chuàng)立ikeprofile，名稱為profile1[H3C]ikeprofileprofile1綁定ikekeychain[H3C-ike-profile-profile1]keychainike1配置當?shù)胤庋b的IP地址配置對端封裝的IP地址[H3C-ike-profile-profile1]matchremoteidentityaddress100.1.1.124[H3C-ike-profile-profile1]quit創(chuàng)立一條ike協(xié)商方式的ipsec安全策略，序列號為1，名字為policy1[H3C]ipsecpolicypolicy11isakmp指定引用ACL3000[H3C-ipsec-policy-isakmp-policy1-1]securityacl3000指定引用的ikeprofile為profile1[H3C-ipsec-policy-isakmp-policy1-1]ike-profileprofile1指定引用的安全協(xié)議為tran1[H3C-ipsec-policy-isakmp-policy1-1]transform-settran1指定對端地道地址[H3C-ipsec-policy-isakmp-policy1-1]quit進入Tunnel0[H3C]interfaceTunnel0把ipsec策略在Tunnel口奏效[H3C-Tunnel0]ipsecapplypolicypolicy1.配置rip路由協(xié)議[H3C]rip[H3C-rip-1]version2[H3C-rip-1]undosummary測試從RT1的環(huán)回口來pingRT3的環(huán)回口Ping192.168.2.1(192.168.2.1)from192.168.1.1:56databytes,pressCTRL_CtobreakRequesttimeout56bytesfrom192.168.2.1:icmp_seq=1ttl=255time=2.