【導(dǎo)讀】域網(wǎng)間實(shí)現(xiàn)安全通信甚至是通過ISP傳遞各自私網(wǎng)路由信息的。路由器3640的IOS來模擬企業(yè)局域網(wǎng)和中間互聯(lián)網(wǎng)服務(wù)提供商的設(shè)備以實(shí)現(xiàn)相關(guān)的實(shí)驗(yàn)操作過程，我們將會(huì)在完成整個(gè)配置后通過debug或show等命令來驗(yàn)證實(shí)驗(yàn)結(jié)果是否符合我們的期望。

　　

【正文】 to abort. Sending 5, 100byte ICMP Echos to , timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), roundtrip min/avg/max = 68/118/172 ms R6trace Type escape sequence to abort. Tracing the route to 1 88 msec 68 msec 88 msec 2 [MPLS: Labels 16/22 Exp 0] 128 msec 148 msec 132 msec 河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 24 3 [MPLS: Label 22 Exp 0] 80 msec 132 msec 132 msec 4 140 msec 140 msec * R7ping Type escape sequence to abort. Sending 5, 100byte ICMP Echos to , timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), roundtrip min/avg/max = 80/121/200 ms R7trace Type escape sequence to abort. Tracing the route to 1 72 msec 72 msec 120 msec 2 [MPLS: Labels 17/21 Exp 0] 116 msec 236 msec 160 msec 3 [MPLS: Label 21 Exp 0] 100 msec 112 msec 72 msec 4 116 msec 144 msec * 河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 25 6 IPsec VPN（ sitetosite） 實(shí)例分析與 配置 某公司網(wǎng)絡(luò)邏輯拓?fù)鋱D如圖 所示，其在總部和分支機(jī)構(gòu)的網(wǎng)關(guān)外接口上都申請(qǐng)了固定的公網(wǎng) IP 地址，它們需要實(shí)現(xiàn)私網(wǎng)間的互相通信，并且可能未來在擴(kuò)展方面需要能通過總部網(wǎng)關(guān)為移動(dòng)用戶下放 IP 地址，使移動(dòng)用戶能夠訪問公司內(nèi)網(wǎng)。（由于配置集中在邊界網(wǎng)關(guān)等設(shè)備，故其它不參與配置 VPN 的設(shè)備在此用網(wǎng)絡(luò)云替代）。 圖 某網(wǎng)絡(luò)環(huán)境邏輯拓?fù)鋱D 需求分析 實(shí)施方案 由企業(yè)需求可知，我們需要用到 IPsec VPN（ sitetosite） 技術(shù)來對(duì)應(yīng)解決。 方案實(shí)施難點(diǎn)分析與解決 控制層面實(shí)施 IPsec 由于建立了自己的傳輸隧道，所以它 在控制層面上 是 不需要通過運(yùn)營商傳遞自己的私網(wǎng)路由 的，而只需把數(shù)據(jù)流發(fā)向網(wǎng)關(guān)即可。為了 解決了建立安全傳輸通道的問題，這個(gè)建立在 3 層上的技術(shù)主要提供了認(rèn)證、加密和確保數(shù)據(jù)完整性的功能。 IKE（ Inter Key Exchange）是工作在控制層上的主要協(xié)議（ IKE 的介紹在 “ IPsec 技術(shù)簡介 ”中有介紹）， sitetosite VPN 中 IKE 分為兩個(gè)步驟，步驟一中包括了 peer 的認(rèn)證、協(xié)商 SA、兩種模式 （主要模式和積極 模式） 的選擇 ，步驟二包括了協(xié)商報(bào)文的封裝模式（ ESP/AH）和進(jìn)入快速模式。所以在控制層面上主要是做步驟一中幾方面的部署。 數(shù)據(jù)層面實(shí)施 企業(yè)內(nèi)用戶發(fā)出的原始數(shù)據(jù)報(bào)文到達(dá)邊界網(wǎng)關(guān)的時(shí)候，分裝的源 IP 地址和目標(biāo) IP 地址都是私網(wǎng)河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 26 地址，所以 必須為原始報(bào)文加上新的 IP（即圖中 R2 的 e0/0 和 R3 的 e0/1 的 IP 地址）包頭后，這些數(shù)據(jù)才能通過 ISP 傳輸。 中 還說過， IKE 的步驟二是工作在數(shù)據(jù)層面上的，主要是解決了對(duì)數(shù)據(jù)報(bào)文加密和認(rèn)證，由于 ESP 既支持加密也支持認(rèn)證而 AH 只支持認(rèn)證，所以通常情 況下優(yōu)選 ESP。在為原始信息添加新的 IP 包頭和認(rèn)證模式后 ，數(shù)據(jù)包就可以在隧道中傳輸了。 配置路由器 圖 某網(wǎng)絡(luò)實(shí)施方案拓?fù)鋱D 運(yùn)營商邊界 配置 詳見附錄 C 客戶 端 網(wǎng)關(guān) 配置 詳見附錄 D 連通性測(cè)試 R2debug crypto isakmp Crypto ISAKMP debugging is on R2debug crypto ipsec Crypto IPSEC debugging is on R2ping source Type escape sequence to abort. Sending 5, 100byte ICMP Echos to , timeout is 2 seconds: Packet sent with a source address of 河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 27 *Mar 1 00:45:: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= , remote= , local_proxy= (type=4), remote_proxy= (type=4), protocol= ESP, transform= espdes espmd5hmac (Tunnel), lifedur= 3600s and 4608000kb, spi= 0x5C8513C3(1552225219), conn_id= 0, keysize= 0, flags= 0x400A *Mar 1 00:45:: ISAKMP: received ke message (1/1) *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): SA request profile is (NULL) *Mar 1 00:45:: ISAKMP: Created a peer struct for , peer port 500 *Mar 1 00:45:: ISAKMP: New peer created peer = 0x643C65AC peer_handle = 0x80000002 *Mar 1 00:45:: ISAKMP: Locking peer struct 0x643C65AC, IKE refcount 1 for isakmp_initiator *Mar 1 00:45:: ISAKMP: local port 500, remote port 500 *Mar 1 00:45:: ISAKMP: set new node 0 to QM_IDLE *Mar 1 00:45:: insert sa successfully sa = 642967FC *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode. *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):found peer preshared key matching *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): constructed NATT vendor07 ID *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): constructed NATT vendor03 ID *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): constructed NATT vendor02 ID *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1 *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): sending packet to my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 1 00:45:: ISAKMP (0:0): received packet from dport 500 sport 500 Global (I) MM_NO_STATE *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH 河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 28 *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New .!!!! Success rate is 80 percent (4/5), roundtrip min/avg/max = 36/87/152 ms R2State = IKE_I_MM2 *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0 *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): processing vendor id payload *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch *Mar 1 00:45:: ISAKMP (0:0): vendor ID is NATT v7 *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):found peer preshared key matching *Mar 1 00:45:: ISAKMP:(0:0:N/A:0): local preshared key found *Mar 1 00:45:: ISAKMP : Scanning profiles for xauth ... *Mar 1 00:45:: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 10 policy *Mar 1 00:45:: ISAKMP: encryption DESCBC *Mar 1 00:45:: ISAKMP: hash MD5 *Mar 1 00:45:: ISAKMP: default group 2 *Mar 1 00:45:: ISAKMP: auth preshare *Mar 1 00:45:: ISAKMP: life type in seconds *Mar 1 00:45:: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Mar 1 00:45: R203: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0 *Mar 1 00:45:: ISAKMP:(0:1:SW:1): processing vendor id payload *Mar 1 00:45:: ISAKMP:(0:1:SW:1): vendor ID seems Unity/DPD but major 245 mismatch *Mar 1 00:45:: ISAKMP (0:134217729): vendor ID is NATT v7 *Mar 1 00:45:: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00:45:: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2 *Mar 1 00:45:: ISAKMP:(0:1:SW:1): sending packet to my_port 500 peer_port 500 (I) MM_SA_SETUP *Mar 1 00:45:: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, 河南農(nóng)業(yè)大學(xué)理學(xué)院本科畢業(yè)論文 29 IKE_PROCESS_COMPLETE *Mar 1 00:45:: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3 *Mar 1 00:45:: ISAKMP (0:134217729): received packet from dport 500 sport 500 Global (I) MM_SA_SETUP *Mar 1 00:45:: ISAKMP:(0:1: