【正文】 I 摘 要 人類社會已經(jīng)進入 21世紀，計算機信息網(wǎng)絡已深入到世界的各個角落，地域、國家、政府、企業(yè)甚至家庭。計算機網(wǎng)絡的飛速發(fā)展給人來帶來了諸多便利，而然其潛在的網(wǎng)絡信息安全威脅也彌漫在各個領域。 本課題設計與論述的是關于網(wǎng)絡安全中常用的一種技術 —— 虛擬專用網(wǎng)（ VPN）技術 。該技術的主要作用：將不在同一區(qū)域的內(nèi)網(wǎng)之間，通過在互聯(lián)網(wǎng)中建立一種安全隧道，使得內(nèi)網(wǎng)數(shù)據(jù)流安全地穿越互聯(lián)網(wǎng)，而不被外網(wǎng)用戶獲悉，從而保證內(nèi)網(wǎng)之間的數(shù)據(jù)通信安全地穿越互聯(lián)網(wǎng)。 本課題所探討的 VPN技術則是建立在 GRE over IPSec技術 之上， 并通過 合肥百大集團 的網(wǎng)絡拓撲對其進行設計與仿真。 GRE over IPSec VPN技術是通過 GRE與 IPSec相結合，而形成的一種安全性更好 VPN技術，其主要借用 IPSec的安全加密和 GRE支持多播的優(yōu)點，從而使得 VPN網(wǎng)絡更加安全。 該項技術的主要工作原理： 將一個完整的組播、廣播數(shù)據(jù)包或非 IP 數(shù)據(jù)包封裝在一個單播數(shù)據(jù)包（ IPSEC）里，以處理如 OSPF的組播或 RIP的廣播數(shù)據(jù)流，以完成在 IPSec隧道里通信實體之間的動態(tài)路由學習。 關鍵字： 網(wǎng)絡安全， VPN， IPSec， GRE，動態(tài)路由協(xié)議 （具體是 OSPF協(xié)議） II Abstract The human society has entered the 21st century, and the puter information work has perated every corner of the world, regional, state, government, businesses and even families. The rapid development of puter works has brought much convenience to people, and then the potential security threat work information filled in the various fields. Design and discussion of the topic is about a kind monly used in work security technologies virtual private work (VPN) technology. The main function of the technology: the work is not within the same region between the Inter by establishing a secure tunnel so that data flows within the work through the Inter safely without the user was informed by external work, thus ensuring the work between secure data munications through the Inter. The topics are discussed in VPN technology is built on top of GRE over IPSec technology, and through Hefei Baida Group to design their work topology and simulation. GRE over IPSec VPN technology is through the bination of GRE and IPSec, and the formation of a better VPN security technology, its main borrowing GRE IPSec encryption and security advantages of multicast support, which makes the work more secure VPN. The main working principle of the technology: a plete multicast, broadcast packets or IP packets are encapsulated in a unicast packet (IPSEC) in order to deal with, such as OSPF or RIP broadcast multicast data streams to plete the munication entities in the IPSec tunnel between the dynamic routing study. Keywords: Network Security, VPN, IPSec, GRE, Dynamic Routing Rrotocols (specifically, the OSPF protocol) III 目 錄 摘 要 .......................................................................................................................................... I Abstract ...........................................................................................................................................II 第一章 網(wǎng)絡安全與 VPN簡介 ..................................................................................................... 1 .................................................................................................................... 1 VPN技術簡介 ................................................................................................................... 2 第二章 GRE over IPSec VPN相關技術描述 ............................................................................... 5 GRE隧道協(xié)議 ................................................................................................................... 5 IPSec概述 .......................................................................................................................... 6 AH和 ESP.......................................................................................................................... 9 IKE協(xié)議 .......................................................................................................................... 12 第三章 系統(tǒng) VPN分析與概要設計 ........................................................................................... 17 VPN需求分析 ........................................................................................................ 17 VPN規(guī)劃與概要設計 ............................................................................................ 18 VPN規(guī)劃與概要設計 ............................................................................................ 20 第四章 GRE over IPSec VPN相關技術 分析 ............................................................................. 22 GRE基本配置與分析 ..................................................................................................... 22 配置網(wǎng)絡環(huán)境 ....................................................................................................... 22 配置 GRE VPN ..................................................................................................... 23 IPSec基本配置與分析 .................................................................................................... 24 IPSec VPN基本配置步驟 ..................................................................................... 24 IPSec VPN安利配置與分析 ................................................................................. 26 IPSec over GRE VPN和 GRE over IPSec VPN基本配置與分析 ................................ 36 IPSec over GRE VPN配置與分析 ........................................................................ 36 GRE over IPSec VPN配置與分析 ........................................................................ 42 GRE over IPSec VPN與 IPSec over GRE VPN的區(qū)別 ...................................... 46 第五章 基于 GRE over IPsec VPN設計與仿真的實現(xiàn) ............................................................ 47 GRE over IPsec VPN配置與實現(xiàn) .................................................................................. 47 查看本系統(tǒng) GRE over IPsec VPN配置文件 ................................................................ 54 網(wǎng)絡系統(tǒng)調(diào)試與分析 ..................................................................................................... 59 結 論 ....................................................................................................................................... 66 一、 技術要點和難點 ............................................................................................................ 66 （一） 技術要點 .