- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 新华三人才研学中心
- 关于我们
16-MSR系列路由器IPsec over GRE + OSPF功能的配置举例
本章节下载： 16-MSR系列路由器IPsec over GRE + OSPF功能的配置举例 (151.45 KB)
MSR系列路由器IPsec over GRE + OSPF功能的配置举例
|
Copyright © 2014杭州华三通信技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部， 并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。 |
|
目 录
本文档介绍MSR路由器IPsec over GRE + OSPF功能的典型配置举例。
本文档不严格与具体软、硬件版本对应，如果使用过程中与产品实际情况有差异，请参考相关产品手册，或以设备实际情况为准。
本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。
本文档假设您已了解IPsec、GRE和OSPF特性。
如图1所示，Router A为某机构总部网关，Router B和Router C为分支网关，要求：
· 总部和分支之间建立GRE隧道。
· 总部和分支之间实现内网的互通。
· 运用IPsec技术对总部和分支内网之间指定的流量进行加密。
图1 MSR路由器IPsec over GRE + OSPF功能的配置组网图
|
设备 |
接口 |
IP地址 |
设备 |
接口 |
IP地址 |
|
Router A |
Eth0/0 |
1.0.0.254/24 |
Router C |
Eth0/0 |
1.0.0.2/24 |
|
|
Eth0/1 |
10.0.0.1/24 |
|
Eth0/1 |
192.168.2.1 |
|
|
Loop0 |
192.168.255.255/32 |
|
Loop0 |
192.168.255.2/32 |
|
Router B |
Eth0/0 |
1.0.0.1/24 |
|
|
|
|
|
Eth0/1 |
192.168.1.1/24 |
|
|
|
|
|
Loop0 |
192.168.255.1/32 |
|
|
|
· 将GRE隧道与OSPF结合使用，可以通过GRE来传递OSPF路由，从而使企业私网之间可以互通。
· 将IPsec与GRE结合使用，可以对通过GRE隧道的路由即企业私网间的通信进行保护。
· 将ACL中源、目的IP地址与建立GRE隧道的源、目的IP地址配置不相同，并将策略应用在隧道接口下，可以对通过GRE隧道的部分数据流进行保护。
本举例是在Release 2317版本上进行配置和验证的。
· 要将所有的IPsec策略都绑定在对应的GRE接口上；
· 所有的出接口Ethernet0/0都不使能OSPF，且必须保证总部和分支出接口能互通；
· ACL一定不要最后添加一条deny ip的规则，该配置会导致不需要加密的流量被丢弃。
# 配置接口Ethernet0/1的IP地址。
<RouterA> system-view
[RouterA] interface ethernet 0/1
[RouterA-Ethernet0/1] ip address 10.0.0.1 255.255.255.0
[RouterA-Ethernet0/1] quit
# 配置接口Ethernet0/0的IP地址。
[RouterA] interface ethernet 0/0
[RouterA-Ethernet0/0] ip address 1.0.0.254 255.255.255.0
[RouterA-Ethernet0/0] quit
# 配置OSPF Router ID的Loopback接口地址。
[RouterA] interface loopback 0
[RouterA-LoopBack0] ip address 192.168.255.255 255.255.255.255
[RouterA-LoopBack0] quit
# 配置到branch1的GRE隧道。
[RouterA] interface tunnel 0
[RouterA-Tunnel0] ip address 192.168.0.1 255.255.255.252
[RouterA-Tunnel0] source ethernet 0/0
[RouterA-Tunnel0] destination 1.0.0.1
[RouterA-Tunnel0] quit
# 配置到branch2的GRE隧道。
[RouterA] interface tunnel 1
[RouterA-Tunnel1] ip address 192.168.0.5 255.255.255.252
[RouterA-Tunnel1] source ethernet 0/0
[RouterA-Tunnel1] destination 1.0.0.2
[RouterA-Tunnel1] quit
# 配置OSPF路由协议。
[RouterA] router id 192.168.255.255
[RouterA] ospf 1
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 10.0.0.0 0.0.0.255
[RouterA-ospf-1-area-0.0.0.0] network 192.168.255.255 0.0.0.0
[RouterA-ospf-1-area-0.0.0.0] network 192.168.0.0 0.0.0.3
[RouterA-ospf-1-area-0.0.0.0] network 192.168.0.4 0.0.0.3
[RouterA-ospf-1-area-0.0.0.0] quit
# 创建ACL3000,定义与branch1之间需要IPsec保护的数据流。
[RouterA] acl number 3000
[RouterA-acl-adv-3000] rule 0 permit ip source 10.0.0.0 0.255.255.255 destination
192.168.1.0 0.0.0.255
[RouterA-acl-adv-3000] quit
# 创建ACL3001,定义与branch2之间需要IPsec保护的数据流。
[RouterA] acl number 3001
[RouterA-acl-adv-3001] rule 0 permit ip source 10.0.0.0 0.255.255.255 destination
192.168.2.0 0.0.0.255
[RouterA-acl-adv-3001] quit
# 配置IKE对等体branch1。
[RouterA] ike peer branch1
[RouterA-ike-peer-branch1] pre-shared-key 123
[RouterA-ike-peer-branch1] remote-address 192.168.0.2
[RouterA-ike-peer-branch1] quit
# 配置IKE对等体branch2。
[RouterA] ike peer branch2
[RouterA-ike-peer-branch2] pre-shared-key 123
[RouterA-ike-peer-branch2] remote-address 192.168.0.6
[RouterA-ike-peer-branch2] quit
# 采用安全提议的缺省配置。
[RouterA] ipsec transform-set def
# 配置ESP协议采用md5认证算法。
[RouterA-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterA-ipsec-transform-set-def] quit
# 创建IPsec安全策略branch1，其协商方式为isakmp。
[RouterA] ipsec policy branch1 1 isakmp
[RouterA-ipsec-policy-isakmp-branch1-1] security acl 3000
[RouterA-ipsec-policy-isakmp-branch1-1] ike-peer branch1
[RouterA-ipsec-policy-isakmp-branch1-1] transform-set def
[RouterA-ipsec-policy-isakmp-branch1-1] quit
# 创建IPsec安全策略branch2，其协商方式为isakmp。
[RouterA] ipsec policy branch2 1 isakmp
[RouterA-ipsec-policy-isakmp-branch2-1] security acl 3001
[RouterA-ipsec-policy-isakmp-branch2-1] ike-peer branch2
[RouterA-ipsec-policy-isakmp-branch2-1] transform-set def
[RouterA-ipsec-policy-isakmp-branch2-1] quit
# 在GRE接口上应用安全策略。
[RouterA] interface tunnel 0
[RouterA-Tunnel0] ipsec policy branch1
[RouterA-Tunnel0] quit
[RouterA] interface tunnel 1
[RouterA-Tunnel1] ipsec policy branch2
[RouterA-Tunnel1] quit
# 配置接口Ethernet0/1的IP地址。
<RouterB> system-view
[RouterB] interface ethernet 0/1
[RouterB-Ethernet0/1] ip address 192.168.1.1 255.255.255.0
[RouterB-Ethernet0/1] quit
# 配置接口Ethernet0/0的IP地址。
[RouterB]interface ethernet 0/0
[RouterB-Ethernet0/0] ip address 1.0.0.1 255.255.255.0
[RouterB-Ethernet0/0] quit
# 配置OSPF Router ID的Loopback接口地址。
[RouterB] interface loopback 0
[RouterB-LoopBack0] ip address 192.168.255.1 255.255.255.255
[RouterB-LoopBack0] quit
# 配置到center的GRE隧道。
[RouterB] interface tunnel 0
[RouterB-Tunnel0] ip address 192.168.0.2 255.255.255.252
[RouterB-Tunnel0] source ethernet 0/0
[RouterB-Tunnel0] destination 1.0.0.254
[RouterB-Tunnel0] quit
# 配置OSPF路由协议。
[RouterB] router id 192.168.255.1
[RouterB] ospf 1
[RouterB-ospf-1] area 0
[RouterB-ospf-1-area-0.0.0.0] network 192.168.255.1 0.0.0.0
[RouterB-ospf-1-area-0.0.0.0] network 192.168.0.0 0.0.0.3
[RouterB-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255
[RouterB-ospf-1-area-0.0.0.0] quit
# 创建ACL3000,定义需要IPsec保护的数据流。
[RouterB] acl number 3000
[RouterB-acl-adv-3000] rule 0 permit ip source 192.168.1.0 0.0.0.255 destination
10.0.0.0 0.0.0.255
[RouterB-acl-adv-3000] quit
# 配置IKE对等体center。
[RouterB] ike peer center
[RouterB-ike-peer-center] pre-shared-key 123
[RouterB-ike-peer-center] remote-address 192.168.0.1
[RouterB-ike-peer-center] quit
# 采用安全提议的缺省配置。
[RouterB] ipsec transform-set def
# 配置ESP协议采用md5认证算法。
[RouterB-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterB-ipsec-transform-set-def] quit
# 创建IPsec安全策略center，其协商方式为isakmp。
[RouterB] ipsec policy center 1 isakmp
[RouterB-ipsec-policy-isakmp-center-1] security acl 3000
[RouterB-ipsec-policy-isakmp-center-1] ike-peer center
[RouterB-ipsec-policy-isakmp-center-1] transform-set def
[RouterB-ipsec-policy-isakmp-center-1] quit
# 在GRE接口上应用安全策略。
[RouterB] interface tunnel 0
[RouterB-Tunnel0] ipsec policy center
[RouterB-Tunnel0] quit
# 配置接口Ethernet0/1的IP地址。
<RouterC> system-view
[RouterC] interface ethernet 0/1
[RouterC-Ethernet0/1] ip address 192.168.2.1 255.255.255.0
[RouterC-Ethernet0/1] quit
# 配置接口Ethernet0/0的IP地址。
[RouterC] interface ethernet 0/0
[RouterC-Ethernet0/0] ip address 1.0.0.2 255.255.255.0
[RouterC-Ethernet0/0] quit
# 配置OSPF Router ID的Loopback接口地址。
[RouterC] interface loopback 0
[RouterC-LoopBack0] ip address 192.168.255.2 255.255.255.255
[RouterC-LoopBack0] quit
# 配置到center的GRE隧道。
[RouterC] interface tunnel 0
[RouterC-Tunnel0] ip address 192.168.0.6 255.255.255.252
[RouterC-Tunnel0] source ethernet 0/0
[RouterC-Tunnel0] destination 1.0.0.254
[RouterC-Tunnel0] quit
# 配置OSPF路由协议。
[RouterC] router id 192.168.255.2
[RouterC] ospf 1
[RouterC-ospf-1] area 0
[RouterC-ospf-1-area-0.0.0.0] network 192.168.255.2 0.0.0.0
[RouterC-ospf-1-area-0.0.0.0] network 192.168.0.4 0.0.0.3
[RouterC-ospf-1-area-0.0.0.0] network 192.168.2.0 0.0.0.255
[RouterC-ospf-1-area-0.0.0.0] quit
# 创建ACL3000,定义需要IPsec保护的数据流。
[RouterC] acl number 3000
[RouterC-acl-adv-3000] rule 0 permit ip source 192.168.2.0 0.0.0.255 destination
10.0.0.0 0.255.255.255
[RouterC-acl-adv-3000] quit
# 配置IKE对等体center。
[RouterC] ike peer center
[RouterC-ike-peer-center] pre-shared-key 123
[RouterC-ike-peer-center] remote-address 192.168.0.5
[RouterC-ike-peer-center] quit
# 采用安全提议的缺省配置。
[RouterC] ipsec transform-set def
# 配置ESP协议采用md5认证算法。
[RouterC-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterC-ipsec-transform-set-def] quit
# 创建IPsec安全策略center，其协商方式为isakmp。
[RouterC] ipsec policy center 1 isakmp
[RouterC-ipsec-policy-isakmp-center-1] security acl 3000
[RouterC-ipsec-policy-isakmp-center-1] ike-peer center
[RouterC-ipsec-policy-isakmp-center-1] transform-set def
[RouterC-ipsec-policy-isakmp-center-1] quit
# 在GRE接口上应用安全策略。
[RouterC] interface tunnel 0
[RouterC-Tunnel0] ipsec policy center
[RouterC-Tunnel0] quit
完成以上配置后，总部与分支的所有内网之间可以互通，且只有ACL定义的流量被加密。
这里以Router B为例进行验证，Router A和Router B验证方法相同。
# 通过以下显示信息可以看到，Router B和Router C的内网之间可以互通。
<RouterB> ping -a 192.168.1.1 192.168.2.1
PING 192.168.2.1: 56 data bytes, press CTRL_C to break
Reply from 192.168.2.1: bytes=56 Sequence=0 ttl=254 time=3 ms
Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=254 time=2 ms
Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=254 time=2 ms
Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=254 time=2 ms
Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=254 time=3 ms
--- 192.168.2.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 2/2/3 ms
# 通过以下显示信息可以看到，由于Router B和Router C内网的流量不属于ACL定义的需加密的流量，因此，不能触发IPsec。
<RouterB> dis ike sa
total phase-1 SAs: 0
connection-id peer flag phase doi
----------------------------------------------------------------
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK--REKEY
<RouterB> dis ipsec sa
# 通过以下显示信息可以看到，Router B和Router A之间的内网之间可以互通。
<RouterB> ping -a 192.168.1.1 10.0.0.1
PING 10.0.0.1: 56 data bytes, press CTRL_C to break
Request time out
Reply from 10.0.0.1: bytes=56 Sequence=1 ttl=255 time=3 ms
Reply from 10.0.0.1: bytes=56 Sequence=2 ttl=255 time=3 ms
Reply from 10.0.0.1: bytes=56 Sequence=3 ttl=255 time=2 ms
Reply from 10.0.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms
--- 10.0.0.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 2/2/3 ms
# 由于Router B和Router A内网的流量已在ACL中定义为需加密保护的流量，因此将触发IPsec进行加密。可以通过如下显示信息看到，IKE协商成功，生成了两个阶段的SA。
<RouterB> display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------------
1 192.168.0.1 RD|ST 1 IPSEC
2 192.168.0.1 RD|ST 2 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK—REKEY
# 可以通过如下显示信息查看协商生成的IPsec SA。
<RouterB> display ipsec sa
===============================
Interface: Tunnel0
path MTU: 1476
===============================
-----------------------------
IPsec policy name: "center"
sequence number: 1
acl version: ACL4
mode: isakmp
-----------------------------
PFS: N, DH group: none
tunnel:
local address: 192.168.0.2
remote address: 192.168.0.1
flow:
sour addr: 192.168.1.0/255.255.255.0 port: 0 protocol: IP
dest addr: 10.0.0.0/255.255.255.0 port: 0 protocol: IP
[inbound ESP SAs]
spi: 0xD37AE9A4(3548047780)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5
in use setting: Tunnel
connection id: 1
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1843199/3539
anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: N
[outbound ESP SAs]
spi: 0x86700DE2(2255490530)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5
in use setting: Tunnel
connection id: 2
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1843199/3539
anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: N
# 可以通过如下显示信息查看GRE隧道的建立情况。
<RouterB> display interface tunnel0
Tunnel0 current state: UP
Line protocol current state: UP
Description: Tunnel0 Interface
The Maximum Transmit Unit is 1476
Internet Address is 192.168.0.2/30 Primary
Encapsulation is TUNNEL, service-loopback-group ID not set.
Tunnel source 1.0.0.1 (Ethernet0/0), destination 1.0.0.254
Tunnel bandwidth 64 (kbps)
Tunnel keepalive disabled
Tunnel protocol/transport GRE/IP
GRE key disabled
Checksumming of GRE packets disabled
Output queue : (Urgent queuing : Size/Length/Discards) 0/100/0
Output queue : (Protocol queuing : Size/Length/Discards) 0/500/0
Output queue : (FIFO queuing : Size/Length/Discards) 0/75/0
Last clearing of counters: Never
Last 300 seconds input: 8 bytes/sec, 0 packets/sec
Last 300 seconds output: 8 bytes/sec, 0 packets/sec
184 packets input, 13716 bytes
0 input error
174 packets output, 12812 bytes
0 output error
# 可以通过如下显示信息查看OSPF路由表和邻居建立情况。
<RouterB> display ospf routing
OSPF Process 1 with Router ID 192.168.255.1
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
192.168.255.255/32 1562 Stub 192.168.0.1 192.168.255.255 0.0.0.0
10.0.0.1/32 1562 Stub 192.168.0.1 192.168.255.255 0.0.0.0
192.168.0.0/30 1562 Stub 192.168.0.2 192.168.255.1 0.0.0.0
192.168.0.4/30 3124 Stub 192.168.0.1 192.168.255.255 0.0.0.0
192.168.1.1/32 0 Stub 192.168.1.1 192.168.255.1 0.0.0.0
192.168.2.1/32 3124 Stub 192.168.0.1 192.168.255.2 0.0.0.0
192.168.255.1/32 0 Stub 192.168.255.1 192.168.255.1 0.0.0.0
192.168.255.2/32 3124 Stub 192.168.0.1 192.168.255.2 0.0.0.0
Total Nets: 8
Intra Area: 8 Inter Area: 0 ASE: 0 NSSA: 0
<RouterB> display ospf lsdb
OSPF Process 1 with Router ID 192.168.255.1
Link State Database
Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 192.168.255.255 192.168.255.255 1281 96 80000006 0
Router 192.168.255.2 192.168.255.2 1266 72 80000004 0
Router 192.168.255.1 192.168.255.1 1355 72 80000004 0
<RouterB> display ospf peer
OSPF Process 1 with Router ID 192.168.255.1
Neighbor Brief Information
Area: 0.0.0.0
Router ID Address Pri Dead-Time Interface State
192.168.255.255 192.168.0.1 1 31 Tun0 Full/ -
· Router A：
#
router id 192.168.255.255
#
acl number 3000
rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.1.0 0.0.0.25
5
acl number 3001
rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.2.0 0.0.0.25
5
#
ike peer branch1
pre-shared-key cipher $c$3$Hrwy5G5GJ4yA62gpcP5+JqEtifSvmw==
remote-address 192.168.0.2
#
ike peer branch2
pre-shared-key cipher $c$3$wogCOxJn/Yt9/Ix/bpcub18oq0kLXA==
remote-address 192.168.0.6
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy branch1 1 isakmp
security acl 3000
ike-peer branch1
transform-set def
#
ipsec policy branch2 1 isakmp
security acl 3001
ike-peer branch2
transform-set def
#
interface Ethernet0/1
port link-mode route
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet0/0
port link-mode route
ip address 1.0.0.254 255.255.255.0
#
interface LoopBack0
ip address 192.168.255.255 255.255.255.255
#
interface Tunnel0
ip address 192.168.0.1 255.255.255.252
source Ethernet0/0
destination 1.0.0.1
ipsec policy branch1
#
interface Tunnel1
ip address 192.168.0.5 255.255.255.252
source Ethernet0/0
destination 1.0.0.2
ipsec policy branch2
#
ospf 1
area 0.0.0.0
network 10.0.0.0 0.0.0.255
network 192.168.255.255 0.0.0.0
network 192.168.0.0 0.0.0.3
network 192.168.0.4 0.0.0.3
#
· Router B：
#
router id 192.168.255.1
#
acl number 3000
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
#
ike peer center
pre-shared-key cipher $c$3$pR4XoeELsbjG9RfWfrm5GT3Ro3EsOQ==
remote-address 192.168.0.1
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy center 1 isakmp
security acl 3000
ike-peer center
transform-set def
#
interface Ethernet0/1
port link-mode route
ip address 192.168.1.1 255.255.255.0
#
interface Ethernet0/0
port link-mode route
ip address 1.0.0.1 255.255.255.0
#
interface LoopBack0
ip address 192.168.255.1 255.255.255.255
#
interface Tunnel0
ip address 192.168.0.2 255.255.255.252
source Ethernet0/0
destination 1.0.0.254
ipsec policy center
#
ospf 1
area 0.0.0.0
network 192.168.255.1 0.0.0.0
network 192.168.0.0 0.0.0.3
network 192.168.1.0 0.0.0.255
#
· Router C：
#
router id 192.168.255.2
#
acl number 3000
rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.255.255.25
5
#
ike peer center
pre-shared-key cipher $c$3$b/tFRG/i1Mg/80d4fZWThzLcNzcVag==
remote-address 192.168.0.5
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy center 1 isakmp
security acl 3000
ike-peer center
transform-set def
#
interface Ethernet0/1
port link-mode route
ip address 192.168.2.1 255.255.255.0
#
interface Ethernet0/0
port link-mode route
ip address 1.0.0.2 255.255.255.0
#
interface LoopBack0
ip address 192.168.255.2 255.255.255.255
#
interface Tunnel0
ip address 192.168.0.6 255.255.255.252
source Ethernet0/0
destination 1.0.0.254
ipsec policy center
#
ospf 1
area 0.0.0.0
network 192.168.255.2 0.0.0.0
network 192.168.0.4 0.0.0.3
network 192.168.2.0 0.0.0.255
#
· H3C MSR 系列路由器 命令参考(V5)-R2311
· H3C MSR 系列路由器 配置指导(V5)-R2311
不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!
支持
售前咨询
售后咨询
人工在线咨询
