配置路由器配置

知GREVPNIPSecVPN史晓虎2019-08-21发表MSR2600-XX-X1/3610-X1系列路由器配置GREOVERIPSEC配置方法组网及说明1配置需求或说明1.
1适用产品系列本案例适用于如2600-6-X1、MSR2600-10-X1、MSR3600-28-X1、MSR3600-28-X1-DP等MSR2600-XX-X1、3610-X1系列的路由器.
1.
2配置需求及实现的效果RTA路由器外网口G0/0的地址为1.
1.
1.
1(模拟运营商公网固定地址环境),RTB路由器外网口G0/0的地址为2.
2.
2.
1(模拟运营商公网固定地址环境),两个路由器外网口地址之间路由可达可以互相ping通.
要对RTA路由器所在的内网(192.
168.
1.
0/24)与RTB路由器所在的内网(172.
16.
1.
0/24),实现两端内网终端通过GREoverIPsecVPN隧道进行互访.
2组网图配置步骤3配置步骤3.
1配置路由器基本上网#路由器基本上网配置省略,MSRV7路由器的上网具体设置步骤请参考"2.
1.
2路由器外网使用固定IP地址上网配置方法"章节中"MSR830-WiNet系列路由器基本上网(静态IP)命令行配置(V7)"案例3.
2设置A路由器#配置GRE隧道,system-viewSystemView:returntoUserViewwithCtrl+Z.
[H3C]interfaceTunnel0modegre[H3C-Tunnel0]ipaddress10.
1.
2.
124[H3C-Tunnel0]source1.
1.
1.
1[H3C-Tunnel0]destination2.
2.
2.
1#配置一个访问控制列表3000,定义由子网1.
1.
1.
0/24去子网2.
2.
2.
0/24的数据流,封装GRE数据流.
[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]rulepermitipsource1.
1.
1.
00.
0.
0.
255destination2.
2.
2.
00.
0.
0.
255[H3C-acl-ipv4-adv-3000]quit#配置公网口NAT要关联的ACl3001,作用是把IPSec感兴趣流从NAT转换的数据流deny掉,防止IPSec数据流被NAT优先转换[H3C]aclnumber3001[H3C-acl-adv-3001]rule0denyipsource1.
1.
1.
00.
0.
0.
255destination2.
2.
2.
00.
0.
0.
255[H3C-acl-adv-3001]rule1permitip[H3C-acl-adv-3001]quit#创建一条IKE提议1,指定IKE提议使用的认证算法为MD5,加密算法为3des-cbc[H3C]ikeproposal1[H3C-ike-proposal-1]authentication-algorithmmd5[H3C-ike-proposal-1]encryption-algorithm3des-cbc[H3C-ike-proposal-1]quit#创建并配置IKEkeychain,名称为RTA.
[H3C]ikekeychainRTA#配置对端IP地址为2.
2.
2.
1,使用的预共享密钥为明文123456[H3C-ike-keychain-RTA]pre-shared-keyaddress2.
2.
2.
1255.
255.
255.
0keysimple123456[H3C-ike-keychain-RTA]quit#创建并配置IKEprofile,名称为RTA,引用上面配置的keychainRTA,配置本地地址为本端的公网接口地址1.
1.
1.
1,对端地址为对端公网接口地址2.
2.
2.
1,引用之前配置IKE提议1[H3C]ikeprofileRTA[H3C-ike-profile-RTA]keychainRTA[H3C-ike-profile-RTA]local-identityaddress1.
1.
1.
1[H3C-ike-profile-RTA]matchremoteidentityaddress2.
2.
2.
1255.
255.
255.
0[H3C-ike-profile-RTA]proposal1[H3C-ike-profile-RTA]quit#配置IPsec安全提议1,ESP协议采用的加密算法为3des-cbc,认证算法为md5[H3C]ipsectransform-set1[H3C-ipsec-transform-set-1]espencryption-algorithm3des-cbc[H3C-ipsec-transform-set-1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-1]quit#创建IPsec安全策略,名称为RTA,序列号为1,设置对端地址为对端公网地址2.
2.
2.
1,引用之前创建的ACL3000,引用之前创建的IKEprofileRTA,引用之前的IPSec安全提议1[H3C]ipsecpolicyRTA1isakmp[H3C-ipsec-policy-isakmp-RTA-1]remote-address2.
2.
2.
1[H3C-ipsec-policy-isakmp-RTA-1]securityacl3000[H3C-ipsec-policy-isakmp-RTA-1]transform-set1[H3C-ipsec-policy-isakmp-RTA-1]ike-profileRTA[H3C-ipsec-policy-isakmp-RTA-1]quit#设置外网口做NAT转换的时候关联ACL3001(如果之前已经在外网口配置了natoutbound,需要先undo掉),并将IPSec安全策略RTA应用在外网接口[H3C]interfaceGigabitEthernet0/0[H3C-GigabitEthernet0/0]undonatoutbound[H3C-GigabitEthernet0/0]natoutbound3001[H3C-GigabitEthernet0/0]ipsecapplypolicyRTA[H3C-GigabitEthernet0/0]quit#配置到对端内网的路由[H3C]iproute-static172.
16.
1.
024Tunnel0#保存配置[H3C]saveforce3.
3设置B路由器#配置GRE隧道,system-viewSystemView:returntoUserViewwithCtrl+Z.
[H3C]interfaceTunnel0modegre[H3C-Tunnel0]ipaddress10.
1.
2.
224[H3C-Tunnel0]source2.
2.
2.
1[H3C-Tunnel0]destination1.
1.
1.
1#配置一个访问控制列表3000,定义由子网1.
1.
1.
0/24去子网2.
2.
2.
0/24的数据流,封装GRE数据流.
[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]rulepermitipsource2.
2.
2.
00.
0.
0.
255destination1.
1.
1.
00.
0.
0.
255[H3C-acl-ipv4-adv-3000]quit#配置公网口NAT要关联的ACl3001,作用是把IPSec感兴趣流从NAT转换的数据流deny掉,防止IPSec数据流被NAT优先转换[H3C]aclnumber3001[H3C-acl-adv-3001]rule0denyipsource2.
2.
2.
00.
0.
0.
255destination1.
1.
1.
00.
0.
0.
255[H3C-acl-adv-3001]rule1permitip[H3C-acl-adv-3001]quit#创建一条IKE提议1,指定IKE提议使用的认证算法为MD5,加密算法为3des-cbc[H3C]ikeproposal1[H3C-ike-proposal-1]authentication-algorithmmd5[H3C-ike-proposal-1]encryption-algorithm3des-cbc[H3C-ike-proposal-1]quit#创建并配置IKEkeychain,名称为RTA.
[H3C]ikekeychainRTA#配置对端IP地址为1.
1.
1.
1,使用的预共享密钥为明文123456[H3C-ike-keychain-RTA]pre-shared-keyaddress1.
1.
1.
1255.
255.
255.
0keysimple123456[H3C-ike-keychain-RTA]quit#创建并配置IKEprofile,名称为RTA,引用上面配置的keychainRTA,配置本地地址为本端的公网接口地址2.
2.
2.
1,对端地址为对端公网接口地址1.
1.
1.
1,引用之前配置IKE提议1[H3C]ikeprofileRTA[H3C-ike-profile-RTA]keychainRTA[H3C-ike-profile-RTA]local-identityaddress2.
2.
2.
1[H3C-ike-profile-RTA]matchremoteidentityaddress1.
1.
1.
1255.
255.
255.
0[H3C-ike-profile-RTA]proposal1[H3C-ike-profile-RTA]quit#配置IPsec安全提议1,ESP协议采用的加密算法为3des-cbc,认证算法为md5[H3C]ipsectransform-set1[H3C-ipsec-transform-set-1]espencryption-algorithm3des-cbc[H3C-ipsec-transform-set-1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-1]quit#创建IPsec安全策略,名称为RTA,序列号为1,设置对端地址为对端公网地址1.
1.
1.
1,引用之前创建的ACL3000,引用之前创建的IKEprofileRTA,引用之前的IPSec安全提议1[H3C]ipsecpolicyRTA1isakmp[H3C-ipsec-policy-isakmp-RTA-1]remote-address1.
1.
1.
1[H3C-ipsec-policy-isakmp-RTA-1]securityacl3000[H3C-ipsec-policy-isakmp-RTA-1]transform-set1[H3C-ipsec-policy-isakmp-RTA-1]ike-profileRTA[H3C-ipsec-policy-isakmp-RTA-1]quit#设置外网口做NAT转换的时候关联ACL3001(如果之前已经在外网口配置了natoutbound,需要先undo掉),并将IPSec安全策略RTA应用在外网接口[H3C]interfaceGigabitEthernet0/0[H3C-GigabitEthernet0/0]undonatoutbound[H3C-GigabitEthernet0/0]natoutbound3001[H3C-GigabitEthernet0/0]ipsecapplypolicyRTA[H3C-GigabitEthernet0/0]quit#配置到对端内网的路由[H3C]iproute-static192.
168.
1.
024Tunnel0#保存配置[H3C]saveforce3.
4验证配置结果#在RTA路由器上带源pingRTB路由器内网网关地址配置关键点