IPSEC-over-GRE-over-MULTICAST
做題思路：
1. layer2 reachability ： PPP authentication over serial links
12.1通12.2 ； 13.1 通 13.3 。
2. WAN-AS reachability ： EIGRP/OSPF/RIPv2
12.2 通 13.3 。
3. layer3 GRE tunnel reachability ：GRE encryption/chechsum/sequencing
23.2 通 23.3 。
4. full-network reachability ： BGP
2.2 通 3.3 。
5. multicast routing reachability ： PIM-DM/SM
2.2 通 224.1.2.3
6. layer3 IPSEC encapsulation
2.2 通 224.1.2.3
做題思路：
1. layer2 reachability ： PPP authentication over serial links
12.1通12.2 ； 13.1 通 13.3 。
2. WAN-AS reachability ： EIGRP/OSPF/RIPv2
12.2 通 13.3 。
3. layer3 GRE tunnel reachability ：GRE encryption/chechsum/sequencing
23.2 通 23.3 。
4. full-network reachability ： BGP
2.2 通 3.3 。
5. multicast routing reachability ： PIM-DM/SM
2.2 通 224.1.2.3
6. layer3 IPSEC encapsulation
2.2 通 224.1.2.3
配置：
R1-WAN#show run
!
!
ip multicast-routing
!
!
username R2 password 0 cisco
username R3 password 0 huawei
!
!
interface Serial1/0
ip address 12.12.12.1 255.255.255.0
ip pim dense-mode
encapsulation ppp
serial restart-delay 0
clock rate 64000
ppp authentication pap
!
interface Serial1/1
ip address 13.13.13.1 255.255.255.0
ip pim dense-mode
encapsulation ppp
serial restart-delay 0
clock rate 64000
ppp authentication chap
!
!
router eigrp 100
network 12.12.12.1 0.0.0.0
network 13.13.13.1 0.0.0.0
no auto-summary
!
End
R2#show run
!
!
ip multicast-routing
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
lifetime 3600
crypto isakmp key ilovetg2008 address 13.13.13.3
!
crypto ipsec security-association lifetime kilobytes 102400
!
crypto ipsec transform-set sun2 ah-md5-hmac esp-des esp-md5-hmac comp-lzs
!
crypto map sun2 10 ipsec-isakmp
set peer 13.13.13.3
set transform-set sun2
set pfs group2
match address ***
!
!
interface Loopback2
ip address 2.2.2.2 255.255.255.0
ip pim dense-mode
!
interface Tunnel0
ip address 23.23.23.2 255.255.255.0
tunnel source Serial1/0
tunnel destination 13.13.13.3
tunnel key 10
tunnel sequence-datagrams
tunnel checksum
!
!
interface Serial1/0
ip address 12.12.12.2 255.255.255.0
ip pim dense-mode
encapsulation ppp
serial restart-delay 0
ppp pap sent-username R2 password 0 cisco
crypto map sun2
!
!
router eigrp 100
network 12.12.12.2 0.0.0.0
no auto-summary
!
router bgp 200
no synchronization
bgp router-id 2.2.2.2
bgp log-neighbor-changes
network 2.2.2.0 mask 255.255.255.0
neighbor 23.23.23.3 remote-as 300
no auto-summary
!
!
ip access-list extended ***
permit gre host 12.12.12.2 host 13.13.13.3
!
!
End
R3#show run
!
!
ip multicast-routing
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
lifetime 3600
crypto isakmp key ilovetg2008 address 12.12.12.2
!
crypto ipsec security-association lifetime kilobytes 102400
!
crypto ipsec transform-set sun3 ah-md5-hmac esp-des esp-md5-hmac comp-lzs
!
crypto map sun3 10 ipsec-isakmp
set peer 12.12.12.2
set transform-set sun3
set pfs group2
match address ***
!
!
interface Tunnel0
ip address 23.23.23.3 255.255.255.0
tunnel source Serial1/1
tunnel destination 12.12.12.2
tunnel key 10
tunnel sequence-datagrams
tunnel checksum
!
interface FastEthernet0/0
ip address 3.3.3.1 255.255.255.0
ip pim dense-mode
duplex auto
speed auto
!
!
interface Serial1/1
ip address 13.13.13.3 255.255.255.0
ip pim dense-mode
encapsulation ppp
serial restart-delay 0
ppp chap hostname R3
ppp chap password 0 huawei
crypto map sun3
!
!
router eigrp 100
network 13.13.13.3 0.0.0.0
no auto-summary
!
router bgp 300
no synchronization
bgp router-id 3.3.3.1
bgp log-neighbor-changes
network 3.3.3.0 mask 255.255.255.0
neighbor 23.23.23.2 remote-as 200
no auto-summary
!
!
ip access-list extended ***
permit gre host 13.13.13.3 host 12.12.12.2
!
!
End
receiver#show run
!
interface FastEthernet0/0
no switchport
ip address 3.3.3.3 255.255.255.0
no ip route-cache
ip igmp join-group 224.1.2.3
!
!
ip default-gateway 3.3.3.1
!
!
End
結果：
R1-WAN#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 12.12.12.0/24 is directly connected, Serial1/0
C 12.12.12.2/32 is directly connected, Serial1/0
13.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 13.13.13.0/24 is directly connected, Serial1/1
C 13.13.13.3/32 is directly connected, Serial1/1
R1-WAN#show ip mroute
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
L - Local, P - Pruned, R - RP-bit set, F - Register flag,
T - SPT-bit set, J - Join SPT, M - MSDP created entry,
X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
U - URD, I - Received Source Specific Host Report,
Z - Multicast Tunnel, z - MDT-data group sender,
Y - Joined MDT-data group, y - Sending to MDT-data group
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 224.0.1.40), 01:40:42/stopped, RP 0.0.0.0, flags: DCL
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
Serial1/1, Forward/Dense, 01:39:23/00:00:00
Serial1/0, Forward/Dense, 01:40:42/00:00:00
R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
2.0.0.0/24 is subnetted, 1 subnets
C 2.2.2.0 is directly connected, Loopback2
3.0.0.0/24 is subnetted, 1 subnets
B 3.3.3.0 [20/0] via 23.23.23.3, 00:16:28
23.0.0.0/24 is subnetted, 1 subnets
C 23.23.23.0 is directly connected, Tunnel0
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 12.12.12.0/24 is directly connected, Serial1/0
C 12.12.12.1/32 is directly connected, Serial1/0
13.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
D 13.13.13.0/24 [90/2681856] via 12.12.12.1, 01:57:14, Serial1/0
D 13.13.13.3/32 [90/2681856] via 12.12.12.1, 01:57:14, Serial1/0
R2#show ip mroute
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
L - Local, P - Pruned, R - RP-bit set, F - Register flag,
T - SPT-bit set, J - Join SPT, M - MSDP created entry,
X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
U - URD, I - Received Source Specific Host Report,
Z - Multicast Tunnel, z - MDT-data group sender,
Y - Joined MDT-data group, y - Sending to MDT-data group
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 224.0.1.40), 01:40:49/stopped, RP 0.0.0.0, flags: DCL
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
Serial1/0, Forward/Dense, 01:40:49/00:00:00
R3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
2.0.0.0/24 is subnetted, 1 subnets
B 2.2.2.0 [20/0] via 23.23.23.2, 00:16:51
3.0.0.0/24 is subnetted, 1 subnets
C 3.3.3.0 is directly connected, FastEthernet0/0
23.0.0.0/24 is subnetted, 1 subnets
C 23.23.23.0 is directly connected, Tunnel0
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
D 12.12.12.0/24 [90/2681856] via 13.13.13.1, 01:57:31, Serial1/1
D 12.12.12.2/32 [90/2681856] via 13.13.13.1, 01:57:31, Serial1/1
13.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 13.13.13.1/32 is directly connected, Serial1/1
C 13.13.13.0/24 is directly connected, Serial1/1
R3#show ip mroute
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
L - Local, P - Pruned, R - RP-bit set, F - Register flag,
T - SPT-bit set, J - Join SPT, M - MSDP created entry,
X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
U - URD, I - Received Source Specific Host Report,
Z - Multicast Tunnel, z - MDT-data group sender,
Y - Joined MDT-data group, y - Sending to MDT-data group
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 224.1.2.3), 01:28:56/00:02:57, RP 0.0.0.0, flags: DC
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
FastEthernet0/0, Forward/Dense, 01:20:12/00:00:00
Serial1/1, Forward/Dense, 01:28:56/00:00:00
(*, 224.0.1.40), 01:40:14/stopped, RP 0.0.0.0, flags: DCL
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
Serial1/1, Forward/Dense, 01:40:14/00:00:00
R2#show crypto isakmp sa
dst src state conn-id slot status
13.13.13.3 12.12.12.2 QM_IDLE 4 0 ACTIVE
R2#show crypto ipsec sa
interface: Serial1/0
Crypto map tag: sun2, local addr 12.12.12.2
protected vrf: (none)
local ident (addr/mask/prot/port): (12.12.12.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (13.13.13.3/255.255.255.255/47/0)
current_peer 13.13.13.3 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 50, #pkts encrypt: 50, #pkts digest: 50
#pkts decaps: 30, #pkts decrypt: 30, #pkts verify: 30
#pkts compressed: 8, #pkts decompressed: 2
#pkts not compressed: 42, #pkts compr. failed: 0
#pkts not decompressed: 28, #pkts decompress failed: 0
#send errors 44, #recv errors 0
local crypto endpt.: 12.12.12.2, remote crypto endpt.: 13.13.13.3
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
current outbound spi: 0xCBA659A1(3416676769)
R3#show crypto isakmp sa
dst src state conn-id slot status
13.13.13.3 12.12.12.2 QM_IDLE 4 0 ACTIVE
R3#show crypto ipsec sa
interface: Serial1/1
Crypto map tag: sun3, local addr 13.13.13.3
protected vrf: (none)
local ident (addr/mask/prot/port): (13.13.13.3/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (12.12.12.2/255.255.255.255/47/0)
current_peer 12.12.12.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 30, #pkts encrypt: 30, #pkts digest: 30
#pkts decaps: 50, #pkts decrypt: 50, #pkts verify: 50
#pkts compressed: 2, #pkts decompressed: 8
#pkts not compressed: 28, #pkts compr. failed: 0
#pkts not decompressed: 42, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 13.13.13.3, remote crypto endpt.: 12.12.12.2
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/1
current outbound spi: 0x3AED48EF(988629231)
R2#ping 224.1.2.3 repeat 5 source lo2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 224.1.2.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
Reply to request 0 from 3.3.3.3, 12 ms
Reply to request 1 from 3.3.3.3, 204 ms
Reply to request 2 from 3.3.3.3, 84 ms
Reply to request 3 from 3.3.3.3, 48 ms
Reply to request 4 from 3.3.3.3, 224 ms
receiver#
*Mar 1 02:17:00.731: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2
receiver#
*Mar 1 02:17:16.391: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2
receiver#
*Mar 1 02:17:18.671: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2
receiver#
*Mar 1 02:17:20.347: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2
receiver#
*Mar 1 02:17:22.403: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2
receiver#
*Mar 1 02:17:24.479: ICMP: echo reply sent, src 3.3.3.3, dst 12.12.12.2