当前位置：首页 > news >正文

IPSec综合配置实验

news 2025/9/10 9:04:51

一、前言

企业对网络安全性的需求日益提升，而传统的TCP/IP协议缺乏有效的安全认证和保密机制。IPSec(Internet Protocol Security）作为一种开放标准的安全框架结构，可以用来保证IP数据报文在网络上传输的机密性、完整性和防重放。

二、IPSec VPN概念

2.1应用场景

1756820573413

企业分支可以通过IPSecVPN接入到企业总部网络。

2.2IPSec架构

1756820888748

IPSec不是一个单独的协议，它通过AH和ESP这两个安全协议来实现IP数据报文的安全传送。
IKE协议提供密钥协商，建立和维护安全联盟SA等服务。

2.3安全联盟SA

1756821068495

安全联盟定义了IPSec对等体间将使用的数据封装模式、认证和加密算法、密钥等参数。
安全联盟是单向的，两个对等体之间的双向通信，至少需要两个SA。

2.4IPSec传输模式

1756821169776

在传输模式下，AH或ESP报头位于IP报头和传输层报头之间。

2.5IPSec隧道模式

1756821240116

在隧道模式下，IPSec会另外生成一个新的IP报头，并封装在AH或ESP之前。

2.6IPSec VPN配置步骤

1756821630231

三、IPSec VPN配置

1756821701485

1756821727893

3.1拓扑图

1756914601284

3.2配置步骤

配置网络可达

1.配置PC的IP地址，静态IP地址

2.配置路由器的IP地址

<Huawei>sys
[Huawei]sys AR1
[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 192.168.10.254 24
[AR1-GigabitEthernet0/0/0]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip add 100.1.1.1 30
[AR1-GigabitEthernet0/0/1]q

<Huawei>sys
[Huawei]sys	
[Huawei]sysname ISP
[ISP]int g0/0/0
[ISP-GigabitEthernet0/0/0]ip add 100.1.1.2 30
[ISP-GigabitEthernet0/0/0]int g0/0/1
[ISP-GigabitEthernet0/0/1]ip add 200.1.1.2 30
[ISP-GigabitEthernet0/0/1]q
[ISP]interface LoopBack 0
[ISP-LoopBack0]ip add 2.2.2.2 32

<Huawei>sys
[Huawei]sysname AR2
[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]ip add 200.1.1.1 30
[AR2-GigabitEthernet0/0/0]int g0/0/1
[AR2-GigabitEthernet0/0/1]ip add 192.168.20.254 24
[AR2-GigabitEthernet0/0/1]q

配置静态路由和NAT
<AR1>sys
[AR1]ip route-static 0.0.0.0 0 100.1.1.2
[AR1]acl 2000
[AR1-acl-basic-2000]rule 10 permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2000]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 2000
[AR1-GigabitEthernet0/0/1]q

在PC1上测试，模拟能够访问互联网
PC>ping 2.2.2.2Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=31 ms

配置出口路由器可以访问互联网
<AR2>sys
[AR2]ip route-static 0.0.0.0 0 200.1.1.2
[AR2]acl 2000
[AR2-acl-basic-2000]rule 20 permit source 192.168.20.0 0.0.0.255
[AR2-acl-basic-2000]q
[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]nat outbound 2000

在PC2中测试
PC>ping 2.2.2.2Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=15 ms

目前为止PC1和PC2是两个私网地址，不能通信，下面使用IPSec技术实现两个私网地址能够互通。

配置ACL识别兴趣流

定义需要保护的数据流

在AR1中配置
[AR1]acl 3000
[AR1-acl-adv-3000]rule 10 permit ?<1-255>  Protocol numbergre      GRE tunneling(47)icmp     Internet Control Message Protocol(1)igmp     Internet Group Management Protocol(2)ip       Any IP protocolipinip   IP in IP tunneling(4)ospf     OSPF routing protocol(89)tcp      Transmission Control Protocol (6)udp      User Datagram Protocol (17)
[AR1-acl-adv-3000]rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

在AR2路由器中配置
[AR2]acl 3000
[AR2-acl-adv-3000]rule 10 permit ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255
[AR2-acl-adv-3000]q

创建安全提议

在AR1中配置
安全提议名称cd
[AR1]ipsec proposal cd
配置认证算法
[AR1-ipsec-proposal-cd]esp authentication-algorithm ?md5       Use HMAC-MD5-96 algorithmsha1      Use HMAC-SHA1-96 algorithmsha2-256  Use SHA2-256 algorithmsha2-384  Use SHA2-384 algorithmsha2-512  Use SHA2-512 algorithmsm3       Use SM3 algorithm[AR1-ipsec-proposal-cd]esp authentication-algorithm md5配置加密算法[AR1-ipsec-proposal-cd]esp encryption-algorithm ?3des     Use 3DESaes-128  Use AES-128aes-192  Use AES-192aes-256  Use AES-256des      Use DESsm1      Use SM1<cr>     Please press ENTER to execute command 
[AR1-ipsec-proposal-cd]esp encryption-algorithm des [AR1]display ipsec proposalNumber of proposals: 1IPSec proposal name: cd                            Encapsulation mode: Tunnel                            Transform         : esp-newESP protocol      : Authentication MD5-HMAC-96                             Encryption     DES

在AR2中配置
[AR2]ipsec proposal bj
[AR2-ipsec-proposal-bj]esp authentication-algorithm md5
[AR2-ipsec-proposal-bj]esp encryption-algorithm des
[AR2-ipsec-proposal-bj]q

创建安全策略

在AR1中配置
配置IPSEC策略chengdu，方式为手动
[AR1]ipsec policy chengdu 10 manual 
包含ACL3000的流量
[AR1-ipsec-policy-manual-chengdu-10]security acl 3000
采用IPSEC提议cd
[AR1-ipsec-policy-manual-chengdu-10]proposal cd
配置隧道本地地址100.1.1.1
[AR1-ipsec-policy-manual-chengdu-10]tunnel local 100.1.1.1
配置隧道远端地址200.1.1.1
[AR1-ipsec-policy-manual-chengdu-10]tunnel remote 200.1.1.1
配置入方向SA编号54321
[AR1-ipsec-policy-manual-chengdu-10]sa spi inbound esp 54321
配置入方向SA的认证秘钥为yt
[AR1-ipsec-policy-manual-chengdu-10]sa string-key inbound esp cipher yt
配置出方向SA编号12345
[AR1-ipsec-policy-manual-chengdu-10]sa spi outbound esp 12345
配置出方向SA的认证秘钥为yt
[AR1-ipsec-policy-manual-chengdu-10]sa string-key outbound esp cipher yt
[AR1-ipsec-policy-manual-chengdu-10]q

手动配置隧道模式

在AR2中配置
配置IPSEC策略chengdu，方式为手动
[AR2]ipsec policy beijing 10 manual 包含ACL3000的流量
[AR2-ipsec-policy-manual-beijing-10]security acl 3000采用IPSEC提议bj
[AR2-ipsec-policy-manual-beijing-10]proposal bj配置隧道本地地址200.1.1.1
[AR2-ipsec-policy-manual-beijing-10]tunnel local 200.1.1.1配置隧道远端地址100.1.1.1
[AR2-ipsec-policy-manual-beijing-10]tunnel remote 100.1.1.1配置入方向SA编号12345,与AR1中的配置对应
[AR2-ipsec-policy-manual-beijing-10]sa spi inbound esp 12345配置入方向SA的认证秘钥为yt
[AR2-ipsec-policy-manual-beijing-10]sa string-key inbound esp cipher yt配置出方向SA编号54321，与AR1中的配置对应
[AR2-ipsec-policy-manual-beijing-10]sa spi outbound esp 54321配置出方向SA的认证秘钥为yt
[AR2-ipsec-policy-manual-beijing-10]sa string-key outbound esp cipher yt
[AR2-ipsec-policy-manual-beijing-10]q

应用安全策略

在AR1中配置
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]ipsec policy chengdu

在AR2中配置
[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]ipsec policy beijing

测试一下PC1和PC2能否正常通信：不能正常通信

PC>ping 192.168.20.1Ping 192.168.20.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!

原因分析：ACL 2000的配置需要修改，不做NAT的地址转换

[AR1]display current-configuration | b acl
acl number 2000rule 10 permit source 192.168.10.0 0.0.0.255 
#
acl number 3000  rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.
255 
#
ipsec proposal cd
#
ipsec policy chengdu 10 manualsecurity acl 3000proposal cdtunnel local 100.1.1.1tunnel remote 200.1.1.1sa spi inbound esp 54321sa string-key inbound esp cipher %$%$abxE5$gr#/Y%#14q45}L,.2n%$%$sa spi outbound esp 12345sa string-key outbound esp cipher %$%$abxE5$gr#/Y%#14q45}L,.2n%$%$
#

[AR1]undo acl 2000
Error: The designated ACL group is in use, so it cannot be deleted!
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]undo nat outbound 2000
[AR1-GigabitEthernet0/0/1]q
[AR1]undo acl 2000
[AR1]acl 3001
[AR1-acl-adv-3001]rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
[AR1-acl-adv-3001]rule 20 permit ip
[AR1-acl-adv-3001]q
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 3001
[AR1-GigabitEthernet0/0/1]q

[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]undo nat outbound 2000
[AR2-GigabitEthernet0/0/0]q[AR2]undo acl 2000
[AR2]acl 3001
[AR2-acl-adv-3001]rule 10 deny ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255
[AR2-acl-adv-3001]q
[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]nat outbound 3001
[AR2-GigabitEthernet0/0/0]q配置可以访问互联网
[AR2]acl 3001
[AR2-acl-adv-3001]rule 20 permit ip

在PC2测试
PC>ping 2.2.2.2Ping 2.2.2.2: 32 data bytes, Press Ctrl_C to break
From 2.2.2.2: bytes=32 seq=1 ttl=254 time=31 ms
From 2.2.2.2: bytes=32 seq=2 ttl=254 time=31 ms

在PC1测试PC2是否通信正常
PC>ping 192.168.20.1Ping 192.168.20.1: 32 data bytes, Press Ctrl_C to break
From 192.168.20.1: bytes=32 seq=1 ttl=127 time=15 ms
From 192.168.20.1: bytes=32 seq=2 ttl=127 time=31 ms

抓包发现内容是被IPSEC加密的

1756914514157