一、部署IPsec關鍵點：
1) 先定義 ACL 和保證需要加密的數據 IP層可達；
2) 要定義 IKE Proposal、IKE Peer、IPSec Proposal 和 IPSec Policy；
3) 注意上述配置中只有 IPSec Policy 配置需引用 IPSec Proposal 和 IKE Peer；
4) 將定義好的 IPSec Policy 綁定到指定的出接口。
二、實驗Toplogy
三、實驗步驟：
1、省略R1、R2、R3的接口IP配置
2、R1:
1.配置需要加密傳送的ACL
[R1]acl num 3000
[R1-acl-adv-3000]rule permit ip source
2.IKE策略配置
[R1]ike proposal 10 //創建IKE提議，並進入IKE視圖
[R1-ike-proposal-10]encryption-algorithm 3des-cbc //使用3DES的加密算法
[R1-ike-proposal-10]authentication-method pre-share //使用預設口令身份驗證方式
[R1-ike-proposal-10]authentication-algorithm md5 //使用md5的認證算法
[R1-ike-proposal-10]dh group2 //使用的DH交換組
[R1-ike-proposal-10]sa duration 86400 //ISAKMP SA生存週期
[R1-ike-proposal-10]q
3.配置IKE對等體及密鑰
[R1]ike peer R3 //創建IKE對等體，並進入IKE對等體視圖
[R1-ike-peer-r3]exchange-mode main //IKE對等體的協商模式
[R1-ike-peer-r3]pre-shared-key h
[R1-ike-peer-r3]local-address
[R1-ike-peer-r3]remote-address
[R1-ike-peer-r3]remote-name R3 //對等體安全網關名稱
[R1]ike local-name R1 //本端安全網關名稱
4. IPSEC安全提議配置
[R1]ipsec proposal r1 //創建IPSEC安全提議
[R1-ipsec-proposal-r1]transform esp //安全協議
[R1-ipsec-proposal-r1]esp encryption-algorithm 3des //ESP協議採用加密算法
[R1-ipsec-proposal-r1]esp authentication-algorithm md5 //ESP協議採用認證算法
[R1-ipsec-proposal-r1]encapsulation-mode tunnel //ESP協議採用工作模式
[R1-ipsec-proposal-r1]q
5.配置IKE協商的安全策略
[R1]ipsec policy 1 10 isakmp //創建一條安全策略
[R1-ipsec-policy-isakmp-1-10]security acl 3000 //配置加密傳送所需的ACL
[R1-ipsec-policy-isakmp-1-10]proposal r1 //配安全策略所引用的安全提議
[R1-ipsec-policy-isakmp-1-10]ike-peer r3 //引用的IKE對等體
[R1-ipsec-policy-isakmp-1-10]pfs dh-group2 //DH組
[R1-ipsec-policy-isakmp-1-10]sa duration time-based 86400 //ipsec SA生存週期
[R1-ipsec-policy-isakmp-1-10]q
6.在接口上應用安全策略
[R1]int s0/2/0
[R1-Serial0/2/0]ipsec policy 1 //在接口上應用安全策略
7、最後在出口指缺省路由
[R1]ip route-static
R3:
[R3]ip route-static
[R3]acl number 3000
[R3-acl-adv-3000]rule permit ip source
[R3]ike proposal 10
[R3-ike-proposal-10]encryption-algorithm 3des-cbc
[R3-ike-proposal-10]authentication-method pre-share
[R3-ike-proposal-10]authentication-algorithm md5
[R3-ike-proposal-10]dh group2
[R3-ike-proposal-10]sa duration 86400
[R3-ike-proposal-10]q
[R3]ike peer R1
[R3-ike-peer-r1]exchange-mode main
[R3-ike-peer-r1]pre-shared-key h
[R3-ike-peer-r1]local-
[R3-ike-peer-r1]remote-address
[R3-ike-peer-r1]remote-name R1
[R3-ike-peer-r1]q
[R3]ipsec proposal r3
[R3-ipsec-proposal-r3]transform esp
[R3-ipsec-proposal-r3]esp encryption-algorithm 3des
[R3-ipsec-proposal-r3]esp authentication-algorithm md5
[R3-ipsec-proposal-r3]encapsulation-mode tunnel
[R3-ipsec-proposal-r3]q
[R3]ipsec policy 1 10 isakmp
[R3-ipsec-policy-isakmp-1-10]security acl 3000
[R3-ipsec-policy-isakmp-1-10]proposal r3
[R3-ipsec-policy-isakmp-1-10]ike-peer R1
[R1-ipsec-policy-isakmp-1-10]pfs dh-group2
[R3-ipsec-policy-isakmp-1-10]sa duration time-based 86400
[R3-ipsec-policy-isakmp-1-10]q
[R3]int s0/2/0
[R3-Serial0/2/0]ipsec policy 1
[R3-Serial0/2/0]q
四、測試結果
[R1]ping -
五、調試命令：
1.顯示IKE對等體配置參數
[R1]dis ike peer
---------------------------
IKE Peer: r3
exchange mode: main on phase 1
pre-shared-key cipher nw1kqzgZJnA=
peer id type: ip
peer ip address:
local ip address:
peer name: R3
nat traversal: disable
dpd:
---------------------------
[R1]
2.顯示當前ISAKMP SA的信息
[R1]dis ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
3
2
flag meaning
RD--
[R1]
3.顯示每個IKE提議的配置參數
[R1]dis ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
3
2
flag meaning
RD--
[R1]dis ike proposal
priority authentication authentication encryption Diffie-Hellman duration
method algorithm algorithm group (seconds)
---------------------------------------------------------------------------
10 PRE_SHARED MD5 3DES_CBC MODP_1024 86400
default PRE_SHARED SHA DES_CBC MODP_768 86400
[R1]
4.顯示IPsec安全策略信息
[R1]dis ipsec policy
===========================================
IPsec Policy Group: "1"
Using interface: {Ethernet0/1/0}
===========================================
-----------------------------
IPsec policy name: "1"
sequence number: 10
mode: isakmp
-----------------------------
security data flow : 3000
selector mode: standard
ike-peer name: r3
perfect forward secrecy: DH group 2
proposal name: r1
IPsec sa local duration(time based): 86400 seconds
IPsec sa local duration(traffic based): 1843200 kilobytes
[R1]
5.顯示IPSEC安全提議信息
[R1]dis ipsec proposal
IPsec proposal name: r1
encapsulation mode: tunnel
transform: esp-new
ESP protocol: authentication md5-hmac-96, encryption 3des
[R1]
6.顯示IPSEC SA的信息
[R1]dis ipsec sa
===============================
Interface: Ethernet0/1/0
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "1"
sequence number: 10
mode: isakmp
-----------------------------
connection id: 3
encapsulation mode: tunnel
perfect forward secrecy: DH group 2
tunnel:
local address:
remote address:
Flow :
sour addr:
dest addr:
ersal: N
[outbound ESP SAs]
spi: 1974141924 (0x75ab03e4)
proposal: ESP-ENCRYPT-3DES ESP-AUTH-MD5
sa remaining key duration (bytes/sec): 1887435624/84789
max sent sequence-number: 15
udp encapsulation used for nat traversal: N
[R1]
7.顯示IPSEC處理的報文信息
[R1]dis ipsec statistics
the security packet statistics:
input/output security packets: 14/14
input/output security bytes: 1176/1176
input/output dropped security packets: 0/1
dropped security packet detail:
not enough memory: 0
can't find SA: 1
queue is full: 0
authentication has failed: 0
wrong length: 0
replay packet: 0
packet too long: 0
wrong SA: 0
[R1]