Dynamic P2P GRE over IPSec
1.拓撲
2.步驟
配置好各個設備的IP地址和默認路由（同Static GRE實驗一樣）。並在R2的外部接口上開啓DHCP動態IP。
R2#show ip int bri
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 26.26.26.1 YES DHCP up up
FastEthernet0/1 23.23.23.2 YES NVRAM up up
Loopback0 2.2.2.2 YES manual up up
R2#
2.1配置Dynamic P2P GRE over IPSec：
（1）在R1上配置終點爲R2的P2P GRE隧道：
R1(config)#interface tunnel 1
R1(config-if)#
*Mar 1 00:17:13.335: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
R1(config-if)#ip add 1.1.1.1 255.255.255.0
R1(config-if)#tunnel source 16.16.16.1
R1(config-if)#tunnel destination 2.2.2.2
R1(config-if)#ex
*Mar 1 00:19:07.587: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
R1(config-if)#ex
R1(config)#ip route 2.2.2.2 255.255.255.255 16.16.16.6
R1(config)#
說明：隧道的源點爲外網接口地址16.16.16.1，隧道的終點爲R2的lo0地址2.2.2.2.由於隧道終點地址在Internet上不可路由，因此必須配置靜態路由將2.2.2.2/24指向自己的Internet出口。
（2）在R2上配置終點爲R1的P2P GRE隧道：
R2(config)#int tunnel 2
R2(config-if)#ip add
*Oct 20 22:51:38.059: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel2, changed state to down
R2(config-if)#ip add 1.1.1.2 255.255.255.0
R2(config-if)#tunnel source 2.2.2.2
R2(config-if)#tunnel destination 16.16.16.1
R2(config-if)#e
*Oct 20 22:52:28.423: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel2, changed state to up
R2(config-if)#ex
R2(config)#
（3）在R1上查看當前P2P GRE接口的狀態以及連通性：
R1(config)#do show ip int bri
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 15.15.15.1 YES NVRAM up up
FastEthernet1/0 16.16.16.1 YES NVRAM up up
Tunnel1 1.1.1.1 YES manual up up
R1(config)#
R1(config)#do ping 1.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1(config)#
說明：當前P2P GRE隧道接口連接狀態正常，但不能使用。因爲當一方靜態IP和一方動態IP之間建立P2P GRE接口時，如果不配置P2P GRE over IPSec，P2P GRE無法工作。
（4）在R1上配置Dynamic L2L ***參數：
R1(config)#cry isakmp policy 1
R1(config-isakmp)#en e
^
% Invalid input detected at '^' marker.
R1(config-isakmp)#en 3
R1(config-isakmp)#au p
R1(config-isakmp)#gr 2
R1(config-isakmp)#ha s
R1(config-isakmp)#ex
R1(config)#cry isakmp key 0 cisco123 add 0.0.0.0 0.0.0.0
R1(config)#cry ipsec transf myset esp-3des esp-sha-hmac
R1(cfg-crypto-trans)#ex
R1(config)#crypto dynamic-map mydyn 10
R1(config-crypto-map)#set transform-set myset
R1(config-crypto-map)#ex
R1(config)#cry map dyl2l 10 ipsec-isakmp dynamic mydyn
R1(config)#cry map dyl2l local-address f1/0
R1(config)#int f1/0
R1(config-if)#cry map dyl2l
R1(config-if)#
*Mar 1 00:37:11.223: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#
（5）在R2上配置普通L2L ***：
R2(config)#cry isakmp policy 1
R2(config-isakmp)#en 3
R2(config-isakmp)#au p
R2(config-isakmp)#gr 2
R2(config-isakmp)#ha s
R2(config-isakmp)#ex
R2(config)#cry isakmp key 0 cisco123 add 16.16.16.1
R2(config)#crypto ipsec transf myset esp-3des esp-sha-hmac
R2(cfg-crypto-trans)#ex
R2(config)#access-list 100 per gre host 2.2.2.2 host 16.16.16.1
R2(config)#cry map dyl2l 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R2(config-crypto-map)#set peer 16.16.16.1
R2(config-crypto-map)#set transf myset
R2(config-crypto-map)#match add 100
R2(config-crypto-map)#ex
R2(config)#cry map dyl2l lo
R2(config)#cry map dyl2l local-address f0/0
R2(config)#
R2(config)#int f0/0
R2(config-if)#cry map dyl2l
R2(config-if)#
*Oct 20 23:13:42.047: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R2(config-if)#
（6）從靜態IP方R1向動態IP方發送流量R2是不會激活隧道的，需要從動態IP方R2向R1發流量才能激活隧道：
R2#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 108/129/168 ms
R2#
（7）查看R1上的***相關參數：
R1#show cry isakmp peers
Peer: 26.26.26.1 Port: 500 Local: 16.16.16.1
Phase1 id: 26.26.26.1
R1#show cry isakmp sa
dst src state conn-id slot status
16.16.16.1 26.26.26.1 QM_IDLE 1 0 ACTIVE
R1#show cry ipsec sa
interface: FastEthernet1/0
Crypto map tag: dyl2l, local addr 16.16.16.1
protected vrf: (none)
local ident (addr/mask/prot/port): (16.16.16.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/47/0)
current_peer 26.26.26.1 port 500
PERMIT, flags={}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 16.16.16.1, remote crypto endpt.: 26.26.26.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x2AD84842(718817346)
inbound esp sas:
spi: 0x9CA65B66(2628148070)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: dyl2l
sa timing: remaining key lifetime (k/sec): (4422911/3499)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x2AD84842(718817346)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: dyl2l
sa timing: remaining key lifetime (k/sec): (4422911/3498)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R1#
說明：當前IPSec SA顯示爲活動狀態，加密的數據報是指定的從R1的公網接口到R2的loopback 0.
（8）再次從靜態方R1 向動態方R2發送流量：
R1#ping 1.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/124/164 ms
R1#
（9） 測試R1到R2的lo0接口的連通性：
R1#ping 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1#
說明：雖然GRE爲活動狀態，但R2的lo0私有接口2.2.2.2沒有向外部通告的路由協議，因此需要在R1、R2上配置動態路由協議
2.2在雙方配置EIGRP動態路由協議：
（1）在R1、R2上配置EIGRP：
R1(config)#router eigrp 1
R1(config-router)#net 15.15.15.0
R1(config-router)#net 1.1.1.1
R1(config-router)#no au
R1(config-router)#ex
R1(config)#
R2(config)#router eigrp 1
R2(config-router)#net 1.1.1.2
R2(config-router)#net
*Oct 20 23:31:42.519: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 1.1.1.1 (Tunnel2) is up: new adjacency
R2(config-router)#net 23.23.23.0
R2(config-router)#no au
R2(config-router)#
*Oct 20 23:31:55.199: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 1.1.1.1 (Tunnel2) is resync: summary configured
R2(config-router)#ex
R2(config)#
（2）在R1上查看EIGRP鄰居和路由情況：
R1#show ip eigrp nei
IP-EIGRP neighbors for process 1
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 1.1.1.2 Tu1 12 00:01:53 126 5000 0 8
R1#
R1#show ip route
Gateway of last resort is 16.16.16.6 to network 0.0.0.0
16.0.0.0/24 is subnetted, 1 subnets
C 16.16.16.0 is directly connected, FastEthernet1/0
1.0.0.0/24 is subnetted, 1 subnets
C 1.1.1.0 is directly connected, Tunnel1
2.0.0.0/32 is subnetted, 1 subnets
S 2.2.2.2 [1/0] via 16.16.16.6
23.0.0.0/24 is subnetted, 1 subnets
D 23.23.23.0 [90/297246976] via 1.1.1.2, 00:02:08, Tunnel1
15.0.0.0/24 is subnetted, 1 subnets
C 15.15.15.0 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 16.16.16.6
R1#
R1#
（3）在R2上查看EIGRP鄰居和路由情況：
R2#show ip eigrp nei
IP-EIGRP neighbors for process 1
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 1.1.1.1 Tu2 11 00:04:40 134 5000 0 9
R2#
R2#show ip route
Gateway of last resort is 26.26.26.6 to network 0.0.0.0
1.0.0.0/24 is subnetted, 1 subnets
C 1.1.1.0 is directly connected, Tunnel2
2.0.0.0/24 is subnetted, 1 subnets
C 2.2.2.0 is directly connected, Loopback0
23.0.0.0/24 is subnetted, 1 subnets
C 23.23.23.0 is directly connected, FastEthernet0/1
26.0.0.0/24 is subnetted, 1 subnets
C 26.26.26.0 is directly connected, FastEthernet0/0
15.0.0.0/24 is subnetted, 1 subnets
D 15.15.15.0 [90/297246976] via 1.1.1.1, 00:05:02, Tunnel2
S* 0.0.0.0/0 [1/0] via 26.26.26.6
R2#
（4）測試R1與R2內網流量的通信：
R5#ping 23.23.23.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.23.23.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 172/204/236 ms
R5#
R3#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 144/181/264 ms
R3#
測試NAT對Dynamic L2L *** over IPSec的影響：
本實驗與在static P2P GRE over IPsec試驗中，NAT的影響是一樣的。可以採用同樣的方法是感興趣流量繞過NAT。這裏不再重複了。