【正文】 實(shí)驗(yàn)中的疑問解決 ........................................... 44 5 總結(jié) ............................................................. 45 參考文獻(xiàn) ........................................................... 46 致謝 ............................................................... 47 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 1 題目一、 基于 IPSec 的 GRE 實(shí)現(xiàn) 實(shí)訓(xùn)任務(wù) 組網(wǎng)需求 分部 1和分部 2通過野蠻 IPSec 的方式連接到中心，采用 GRE OverIPSec的方式，在 tunnel 上運(yùn)行 OSPF 協(xié)議來實(shí)現(xiàn)總部和分部之間的互通。 [center]int e0/1 [centerEther0/1]ip add 24 [centerEther0/1]int s1/0 [centerSerial1/0]ip add 30 [centerSerial1/0]int s2/0 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 3 [centerSerial2/0]ip add 30 [centerSerial2/0]quit 用訪問控制列表實(shí)現(xiàn)包過濾即 Acl配置。 interface Tunnel0 ip address source destination interface Tunnel1 ip address source destination 配置 OSPF 動態(tài)路由。 ospf 1 area work work area work area work Ike 和 ipsec 的配置 ike peer branch1//設(shè)置 IKE 對等體，名稱為 brance1 exchangemode aggressive //設(shè)置 IPsec 為野蠻模式 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 4 presharedkey cipher J5fBBpuCrvQ= //設(shè)立預(yù)共享密鑰 idtype name//選擇 ID 類型為名字 remotename branch1 //定義遠(yuǎn)端對等體名稱為 brance1 ike peer branch2 exchangemode aggressive presharedkey cipher J5fBBpuCrvQ= idtype name remotename branch2 remoteaddress ike peer center remoteaddress 定義 ipsec proposal 的安全級別為 1。 interface Serial1/0 linkprotocol ppp ip address ipsec policy center interface Serial2/0 linkprotocol ppp ip address ipsec policy center 靜態(tài)路由配置 ip routestatic 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 5 分部 1 路由器的配置 [branch1]int e0/1 [branch1Ether0/1]ip add 24 [branch1Ether0/1] [branch1Ether0/1]int s2/0 [branch1Serial2/0]ip add 30 acl number 3001 rule 0 permit gre source 0 destination 0 interface Tunnel0 ip address source destination ospf 1 area work work work ike peer center exchangemode aggressive presharedkey cipher J5fBBpuCrvQ= idtype name remotename center remoteaddress ipsec proposal 1 ipsec policy branch1 10 isakmp ikepeer center proposal 1 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 6 interface Serial2/0 linkprotocol ppp ip address ipsec policy branch1 ip routestatic 分部 3 路由器的配置 [branch2]int e0/1 [branch2Ether0/1]ip add 24 [branch2Ether0/1]int s1/0 [branch2Serial1/0]ip add 30 [branch2Serial1/0] [branch2Serial1/0]quit [branch2]acl number 3002 [branch2acladv3002]rule 0 permit gre source 0 destination 0 [branch2acladv3002]quit [branch2]int Tunnel 1 [branch2Tunnel1]ip add 30 [branch2Tunnel1]source [branch2Tunnel1]destination [branch2Tunnel1]quit [branch2]ospf 1 []work []work []quit [branch2ospf1]quit [branch2]ike localname branch2 [branch2]ike peer center //配置 ike 對等體 peer [branch2ikepeercenter]exchangemode aggressive [branch2ikepeercenter]presharedkey abc [branch2ikepeercenter]idtype name 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 7 [branch2ikepeercenter]remotename center [branch2ikepeercenter]remoteaddress [branch2ikepeercenter]quit [branch2]ipsec proposal 1 //創(chuàng)建 ipsec 安全提議 [branch2ipsecproposal1]quit [branch2]ipsec policy branch2 20 isakmp [branch2ipsecpolicyisakmpbranch220]quit [branch2]ipsec policy branch2 20 isakmp //在分配 ipsec policy時通過 ike協(xié)商建立 sa [branch2ipsecpolicyisakmpbranch220]security acl 3002 //指定安全策略所引用的訪問控制列表號 [branch2ipsecpolicyisakmpbranch220]ikepeer center [branch2ipsecpolicyisakmpbranch220]proposal 1 [branch2ipsecpolicyisakmpbranch220]quit [branch2]int s1/0 [branch2Serial1/0]ipsec policy branch2 [branch2Serial1/0]quit [branch2]ip routestatic preference 60 效果查看 （ 1） 中心上的 ike sa 狀態(tài)； [center]dis ike sa total phase1 SAs: 2 connectionid peer flag phase doi 106 RD|ST 1 IPSEC 107 RD|ST 2 IPSEC 10 RD 2 IPSEC 1 RD 1 IPSEC flag meaning RDREADY STSTAYALIVE RLREPLACED FDFADING TO— TIMEOUT （ 2）中心上的 IPSec sa狀態(tài)； 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 8 [center]dis ipsec sa =============================== Interface: Serial1/0 path MTU: 1500 =============================== IPsec policy name: center sequence number: 10 mode: isakmp connection id: 3 encapsulation mode: tunnel perfect forward secrecy: None tunnel: local address: remote address: Flow : sour addr: : 0 protocol: GRE dest addr: : 0 protocol: GRE [inbound ESP SAs] spi: 4140546555 (0xf6cbb9fb) proposal: ESPENCRYPTDES ESPAUTHMD5 sa duration (kilobytes/sec): 1843200/3600 sa remaining duration (kilobytes/sec): 1843174/915 max received sequencenumber: 268 antireplay check enable: Y antireplay window size: 32 udp encapsulation used for nat traversal: N [outbound ESP SAs] spi: 3177135980 (0xbd5f3f6c) proposal: ESPENCRYPTDES ESPAUTHMD5 sa duration (kilobytes/sec): 1843200/3600 sa remaining duration (kilobytes/sec): 1843191/915 max sent sequencenumber: 87 重慶科技學(xué)院《網(wǎng)絡(luò)系統(tǒng)集成》實(shí)訓(xùn)報告 9 udp encapsulation used for nat traversal: N =============================== Interface: Serial2/0 path MTU: 1500 =============================== IPsec policy name: center sequence number: 20 mode: isakmp connection id: 4 encapsulation mode: tunnel perfect forward secrecy: None tunnel: local address: remote address: Flow : sour addr: : 0 protocol: GRE des