Примеры настройки Route-based IPsec VPN между ESR и Cisco для IKEv1 и IKEv2

ESR# show running-config 
hostname ESR

interface gigabitethernet 1/0/1
  ip firewall disable
  ip address 203.0.113.2/30
exit

tunnel vti 1
  ip firewall disable
  local address 203.0.113.2
  remote address 203.0.113.6
  ip address 192.0.2.1/30
  enable
exit

security ike proposal ike_proposal
  authentication algorithm sha2-384
  encryption algorithm aes192
  dh-group 20
exit

security ike policy ike_policy
  pre-shared-key ascii-text PASSWORD
  proposal ike_proposal
exit

security ike gateway ike_gateway
  ike-policy ike_policy
  mode route-based
  mobike disable
  bind-interface vti 1
exit

security ipsec proposal ipsec_proposal
  authentication algorithm sha2-256
  encryption algorithm aes256
  pfs dh-group 19
exit

security ipsec policy ipsec_policy
  proposal ipsec_proposal
exit

security ipsec vpn ipsec_vpn
  ike establish-tunnel route
  ike gateway ike_gateway
  ike ipsec-policy ipsec_policy
  enable
exit

ip route 203.0.113.4/30 203.0.113.1

Router#show running-config
...
crypto isakmp policy 1

 encryption aes 192

 hash sha384

 authentication pre-share

 group 20 

crypto isakmp key PASSWORD address 203.0.113.2    

!

crypto ipsec transform-set IPsec esp-aes 256 esp-sha256-hmac 

 mode tunnel

!

crypto ipsec profile IPsec_profile

 set transform-set IPsec 

 set pfs group19

!

interface Tunnel2

 ip address 192.0.2.2 255.255.255.252

 tunnel source 203.0.113.6

 tunnel mode ipsec ipv4

 tunnel destination 203.0.113.2

 tunnel protection ipsec profile IPsec_profile

!

interface GigabitEthernet1

 ip address 203.0.113.6 255.255.255.252

!

ip route 203.0.113.0 255.255.255.252 203.0.113.5

ESR# ping 192.0.2.2

PING 192.0.2.2 (192.0.2.2) 56 bytes of data.

!!!!!

--- 192.0.2.2 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4003ms

rtt min/avg/max/mdev = 0.954/13.882/65.340/25.729 ms

ESR# show security ipsec vpn status 

Name                              Local host        Remote host       Initiator spi        Responder spi        State         

-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   

ipsec_vpn                         203.0.113.2       203.0.113.6       0x263711e71c636980   0x3ab0c637e094a3a6   Established

ESR# show security ipsec vpn status ipsec_vpn 

Currently active IKE SA:

    Name:                            ipsec_vpn

    State:                           Established

    Version:                         v1-only

    Unique ID:                       1

    Local host:                      203.0.113.2

    Remote host:                     203.0.113.6

    Role:                            Responder

    Initiator spi:                   0x263711e71c636980

    Responder spi:                   0x3ab0c637e094a3a6

    Encryption algorithm:            aes192

    Authentication algorithm:        sha2-384

    Diffie-Hellman group:            20

    Established (d,h:m:s):           00,00:12:57

    Rekey time (d,h:m:s):            00,00:00:00

    Reauthentication time (d,h:m:s): 00,02:31:02

    Child IPsec SAs:

        Name:                            ipsec_vpn-2

        State:                           Installed

        Protocol:                        esp

        Mode:                            Tunnel

        Encryption algorithm:            aes256

        Authentication algorithm:        sha2-256

        Rekey time (d,h:m:s):            00,00:33:57

        Life time (d,h:m:s):             00,00:47:03

        Established (d,h:m:s):           00,00:12:57

        Traffic statistics: 

            Input bytes:                 420

            Output bytes:                420

            Input packets:               5

            Output packets:              5

        -------------------------------------------------------------

Router#ping 192.0.2.1       
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
Router#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
203.0.113.2     203.0.113.6     QM_IDLE           1001 ACTIVE

IPv6 Crypto ISAKMP SA

Router#show crypto ipsec sa 

interface: Tunnel2
    Crypto map tag: Tunnel2-head-0, local addr 203.0.113.6

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 203.0.113.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
    #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 203.0.113.6, remote crypto endpt.: 203.0.113.2
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1
     current outbound spi: 0xCBBE1E81(3418234497)
     PFS (Y/N): Y, DH group: group19

     inbound esp sas:
      spi: 0x1009BA0D(269072909)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2001, flow_id: CSR:1, sibling_flags FFFFFFFF80004048, crypto map: Tunnel2-head-0
         sa timing: remaining key lifetime (k/sec): (4607997/2586)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xCBBE1E81(3418234497)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2002, flow_id: CSR:2, sibling_flags FFFFFFFF80004048, crypto map: Tunnel2-head-0
         sa timing: remaining key lifetime (k/sec): (4607998/2586)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
          
     outbound ah sas:

     outbound pcp sas:

ESR# show running-config 
hostname ESR

interface gigabitethernet 1/0/1
  ip firewall disable
  ip address 203.0.113.2/30
exit

tunnel vti 1
  ip firewall disable
  local address 203.0.113.2
  remote address 203.0.113.6
  ip address 192.0.2.1/30
  enable
exit

security ike proposal ike_proposal
  authentication algorithm sha2-384
  encryption algorithm aes192
  dh-group 20
exit

security ike policy ike_policy
  pre-shared-key ascii-text encrypted AC95305E87207ADF
  proposal ike_proposal
exit

security ike gateway ike_gateway
  version v2-only
  ike-policy ike_policy
  mode route-based
  mobike disable
  bind-interface vti 1
exit

security ipsec proposal ipsec_proposal
  authentication algorithm sha2-256
  encryption algorithm aes256
  pfs dh-group 19
exit

security ipsec policy ipsec_policy
  proposal ipsec_proposal
exit

security ipsec vpn ipsec_vpn
  ike establish-tunnel route
  ike gateway ike_gateway
  ike ipsec-policy ipsec_policy
  enable
exit

ip route 203.0.113.4/30 203.0.113.1

Router#show running-config
...

crypto ikev2 proposal ike_proposal 

 encryption aes-cbc-192

 integrity sha384

 group 20

!

crypto ikev2 policy ike_policy 

 proposal ike_proposal

!

crypto ikev2 profile ike_profile

 match address local interface GigabitEthernet1

 match identity remote address 203.0.113.2 255.255.255.255 

 authentication remote pre-share key PASSWORD

 authentication local pre-share key PASSWORD

!

crypto ipsec transform-set IPsec esp-aes 256 esp-sha256-hmac 

 mode tunnel

!

crypto ipsec profile ipsec_profile

 set transform-set IPsec 

 set pfs group19

 set ikev2-profile ike_profile

!

interface Tunnel2

 ip address 192.0.2.2 255.255.255.252

 tunnel source 203.0.113.6

 tunnel mode ipsec ipv4

 tunnel destination 203.0.113.2

 tunnel protection ipsec profile ipsec_profile

!

interface GigabitEthernet1

 ip address 203.0.113.6 255.255.255.252

!

ip route 203.0.113.0 255.255.255.252 203.0.113.5

ESR# ping 192.0.2.2

PING 192.0.2.2 (192.0.2.2) 56 bytes of data.

!!!!!

--- 192.0.2.2 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4003ms

rtt min/avg/max/mdev = 0.877/0.938/1.020/0.065 ms

ESR# show security ipsec vpn status 

Name                              Local host        Remote host       Initiator spi        Responder spi        State         

-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   

ipsec_vpn                         203.0.113.2       203.0.113.6       0x7cb32f786d55a54b   0x132608d04f8b04f9   Established   

ESR# show security ipsec vpn status ipsec_vpn 

Currently active IKE SA:

    Name:                            ipsec_vpn

    State:                           Established

    Version:                         v2-only

    Unique ID:                       2

    Local host:                      203.0.113.2

    Remote host:                     203.0.113.6

    Role:                            Responder

    Initiator spi:                   0x7cb32f786d55a54b

    Responder spi:                   0x132608d04f8b04f9

    Encryption algorithm:            aes192

    Authentication algorithm:        sha2-384

    Diffie-Hellman group:            20

    Established (d,h:m:s):           00,00:32:56

    Rekey time (d,h:m:s):            00,00:00:00

    Reauthentication time (d,h:m:s): 00,02:16:50

    Child IPsec SAs:

        Name:                            ipsec_vpn-4

        State:                           Installed

        Protocol:                        esp

        Mode:                            Tunnel

        Encryption algorithm:            aes256

        Authentication algorithm:        sha2-256

        Rekey time (d,h:m:s):            00,00:10:38

        Life time (d,h:m:s):             00,00:27:04

        Established (d,h:m:s):           00,00:32:56

        Traffic statistics: 

            Input bytes:                 2640

            Output bytes:                840

            Input packets:               35

            Output packets:              10

        -------------------------------------------------------------

Router#ping 192.0.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Router#show crypto ikev2 sa
 IPv4 Crypto IKEv2  SA 

Tunnel-id Local                 Remote                fvrf/ivrf            Status 
1         203.0.113.6/500       203.0.113.2/500       none/none            READY  
      Encr: AES-CBC, keysize: 192, PRF: SHA384, Hash: SHA384, DH Grp:20, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/2028 sec

 IPv6 Crypto IKEv2  SA

Router#show crypto ipsec sa

interface: Tunnel2
    Crypto map tag: Tunnel2-head-0, local addr 203.0.113.6

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 203.0.113.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40
    #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 203.0.113.6, remote crypto endpt.: 203.0.113.2
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1
     current outbound spi: 0xCB9384B5(3415442613)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x923F216E(2453610862)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2002, flow_id: CSR:2, sibling_flags FFFFFFFF80000048, crypto map: Tunnel2-head-0
         sa timing: remaining key lifetime (k/sec): (4607997/1565)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xCB9384B5(3415442613)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 2001, flow_id: CSR:1, sibling_flags FFFFFFFF80000048, crypto map: Tunnel2-head-0
         sa timing: remaining key lifetime (k/sec): (4607996/1565)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
          
     outbound ah sas:

     outbound pcp sas: