路由與交換技術(shù) 課件 12 IPSec VPN

第十二章IPSecVPN理解IPSecVPN的作用與應(yīng)用場(chǎng)景理解IPSecVPN的基本工作原理熟悉IPSecVPN的配置流程掌握IPSecVPN的配置(手動(dòng)模式)掌握IPSecVPN的配置(自動(dòng)模式)重難點(diǎn)IPSecVPN的應(yīng)用場(chǎng)景(重點(diǎn))IPSecVPN的基本工作原理（重點(diǎn)，難點(diǎn)）IPSecVPN的配置流程（重點(diǎn)）IPSecVPN的配置(手動(dòng)模式)（重點(diǎn)，難點(diǎn)）IPSecVPN的配置(自動(dòng)模式)（重點(diǎn)，難點(diǎn)）IPsecVPN應(yīng)用場(chǎng)景企業(yè)總部企業(yè)分支IPSec隧道企業(yè)分支可以通過(guò)IPSecVPN接入到企業(yè)總部網(wǎng)絡(luò)。IPSec架構(gòu)IPSec不是一個(gè)單獨(dú)的協(xié)議，它通過(guò)AH和ESP這兩個(gè)安全協(xié)議來(lái)實(shí)現(xiàn)IP數(shù)據(jù)報(bào)的安全傳送。IKE協(xié)議提供密鑰協(xié)商，建立和維護(hù)安全聯(lián)盟SA等服務(wù)。TCP/UDPTCP/UDPSA協(xié)商IKERTARTBAH/ESPAH/ESP加密的IP報(bào)文IKE安全聯(lián)盟SAIPSec隧道RTARTBLocalAddressRemoteAddressSPIinboundSPIoutboundKeyTransform(Proposal)LocalAddressRemoteAddressSPIinboundSPIoutboundKeyTransform(Proposal)安全聯(lián)盟定義了IPSec對(duì)等體間將使用的數(shù)據(jù)封裝模式、認(rèn)證和加密算法、密鑰等參數(shù)。安全聯(lián)盟是單向的，兩個(gè)對(duì)等體之間的雙向通信，至少需要兩個(gè)SA。IPSec傳輸模式AHIPTCPDataAH認(rèn)證部分IPTCPDataESP加密部分認(rèn)證部分ESPTrailerESPAuthIPTCPDataESP加密部分認(rèn)證部分ESPTrailerESPAuthAHESPAH-ESP在傳輸模式下，

AH或ESP報(bào)頭位于IP報(bào)頭和傳輸層報(bào)頭之間。IPSec隧道模式IPTCPDataAHIP認(rèn)證部分IPIPTCPDataESPESPTrailerESPAuth加密部分認(rèn)證部分IPIPTCPDataESPESPTrailerESPAuth加密部分認(rèn)證部分AHAHESPAH-ESP在隧道模式下，IPSec會(huì)另外生成一個(gè)新的IP報(bào)頭，并封裝在AH或ESP之前。IPSecVPN配置步驟配置網(wǎng)絡(luò)可達(dá)配置ACL識(shí)別興趣流創(chuàng)建安全提議創(chuàng)建安全策略應(yīng)用安全策略IPSecVPN配置（手動(dòng)協(xié)商）實(shí)現(xiàn)AR1的lb1與AR2的lb2之間實(shí)現(xiàn)VPN通信S1：實(shí)現(xiàn)網(wǎng)絡(luò)互連實(shí)現(xiàn)AR1的g0/0/0與AR2的g0/0/1之間的網(wǎng)絡(luò)互聯(lián)S2：配置感興趣流[AR1]acl3001[AR1-acl-adv-3001]rulepermitipsource192.168.11.00.0.0.255destination192.168.22.00.0.0.255[AR1]acl3002//兩個(gè)路由器的ACL編號(hào)無(wú)關(guān)聯(lián)[AR1-acl-adv-3002]rulepermitipsource192.168.22.00.0.0.255destination192.168.11.00.0.0.255S3：配置IPSec安全提議[AR1]ipsecproposalAR12[AR1-ipsec-proposal-AR12]espauthentication-algorithmsha1[AR1-ipsec-proposal-AR12]espencryption-algorithm3des[AR2]ipsecproposalAR21//安全提議名字并不要求相同[AR2-ipsec-proposal-AR21]espauthentication-algorithmsha1[AR2-ipsec-proposal-AR21]espencryption-algorithm3desS4：配置IPSec安全策略//AR1的[AR1]ipsecpolicyp1212manual[AR1-ipsec-policy-manual-p12-12][AR1-ipsec-policy-manual-p12-12]securityacl3001[AR1-ipsec-policy-manual-p12-12]proposalAR12[AR1-ipsec-policy-manual-p12-12]tunnellocal202.103.1.1[AR1-ipsec-policy-manual-p12-12]tunnelremote220.141.2.2[AR1-ipsec-policy-manual-p12-12]saspiinboundesp654321[AR1-ipsec-policy-manual-p12-12]sastring-keyinboundespcipheryhz123[AR1-ipsec-policy-manual-p12-12]saspioutboundesp123456[AR1-ipsec-policy-manual-p12-12]sastring-keyoutboundespcipher123yhzS4：配置IPSec安全策略//AR2的[AR2]ipsecpolicyp2121manual[AR2-ipsec-policy-manual-p21-21]securityacl3002[AR2-ipsec-policy-manual-p21-21]proposalAR21[AR2-ipsec-policy-manual-p21-21]tunnellocal220.141.2.2[AR2-ipsec-policy-manual-p21-21]tunnelremote202.103.1.1[AR2-ipsec-policy-manual-p21-21]saspiinboundesp123456[AR2-ipsec-policy-manual-p21-21]sastring-keyinboundespcipher123yhz[AR2-ipsec-policy-manual-p21-21]saspioutboundesp654321[AR2-ipsec-policy-manual-p21-21]sastring-keyoutboundespcipheryhz123S5：應(yīng)用IPSec安全策略[AR1]intg0/0/0[AR1-GigabitEthernet0/0/0]ipsecpolicyp12[AR2]intg0/0/1[AR2-GigabitEthernet0/0/1]ipsecpolicyp21IPSecVPN配置（自動(dòng)協(xié)商）實(shí)現(xiàn)AR1的lb1與AR2的lb2之間實(shí)現(xiàn)VPN通信S1：實(shí)現(xiàn)網(wǎng)絡(luò)互連實(shí)現(xiàn)AR1的g0/0/0與AR2的g0/0/1之間的網(wǎng)絡(luò)互聯(lián)S2：配置感興趣流[AR1]acl3001[AR1-acl-adv-3001]rulepermitipsource192.168.11.00.0.0.255destination192.168.22.00.0.0.255[AR1]acl3002//兩個(gè)路由器的ACL編號(hào)無(wú)關(guān)聯(lián)[AR1-acl-adv-3002]rulepermitipsource192.168.22.00.0.0.255destination192.168.11.00.0.0.255S3：配置IPSec安全提議[AR1]ipsecproposalAR12[AR1-ipsec-proposal-AR12]espauthentication-algorithmsha1[AR1-ipsec-proposal-AR12]espencryption-algorithm3des[AR2]ipsecproposalAR21//安全提議名字并不要求相同[AR2-ipsec-proposal-AR21]espauthentication-algorithmsha1[AR2-ipsec-proposal-AR21]espencryption-algorithm3desS4：配置IKE安全提議[AR1]ikeproposal55[AR1-ike-proposal-55]encryption-algorithmaes-cbc-256[AR1-ike-proposal-55]authentication-algorithmaes-xcbc-mac-96[AR2]ikeproposal55//IKE安全提議編號(hào)可以不同[AR2-ike-proposal-55]encryption-algorithmaes-cbc-256[AR2-ike-proposal-55]authentication-algorithmaes-xcbc-mac-96S5：配置IKEpeer[AR1]ikepeerpeer11v2//peer名可以不同[AR1-ike-peer-peer11]pre-shared-keycipher123456//密碼必須相同[AR1-ike-peer-peer11]ike-proposal55[AR1-ike-peer-peer11]remote-address220.141.2.2[AR2]ikepeerpeer11v2[AR2-ike-peer-peer11]pre-shared-keycipher123456[AR2-ike-peer-peer11]ike-proposal55[AR2-ike-peer-peer11]remote-address202.103.1.1S6：配置IPSec安全策略[AR1]ipsecpolicyp1212isakmp[AR1-ipsec-policy-isakmp-p12-12]securityacl3001[AR1-ipsec-policy-isakmp-p12-12]ike-peerpeer11[AR1-ipsec-policy-isakmp-p12-12]proposalAR12[AR2]ipsecpolicyp2121isakmp[AR2-ipsec-policy-isakmp-p21-21]s