Просмотреть исходный

В текущей статье будут приведены примеры конфигурации Route-based IPsec VPN между ESR и Cisco для IKEv1 и IKEv2:

1. Пример настройки Route-based IPsec VPN между ESR и Cisco для IKEv1

Схема:
Eltex Knowledge Base > Примеры настройки Route-based IPsec VPN между ESR и Cisco для IKEv1 и IKEv2 > route_based_ipsec_between_esr_and_cisco.png
Задача: Построить Route-based IPsec VPN туннель между ESR и Cisco.

Параметры IKE:
- версия IKE: v1;
- алгоритм шифрования: aes192;
- алгоритм аутентификации: sha2-384;
- группа Диффи-Хэллмана: 20.

Параметры IPSec:
-алгоритм шифрования: aes256;
-алгоритм аутентификации: sha2-256;
-pfs группа Диффи-Хэллмана: 19.

Пример конфигурации ESR:

ESR# show running-config
hostname ESR

interface gigabitethernet 1/0/1
ip firewall disable
ip address 203.0.113.2/30
exit

tunnel vti 1
ip firewall disable
local address 203.0.113.2
remote address 203.0.113.6
ip address 192.0.2.1/30
enable
exit

security ike proposal ike_proposal
authentication algorithm sha2-384
encryption algorithm aes192
dh-group 20
exit

security ike policy ike_policy
pre-shared-key ascii-text PASSWORD
proposal ike_proposal
exit

security ike gateway ike_gateway
ike-policy ike_policy
mode route-based
mobike disable
bind-interface vti 1
exit

security ipsec proposal ipsec_proposal
authentication algorithm sha2-256
encryption algorithm aes256
pfs dh-group 19
exit

security ipsec policy ipsec_policy
proposal ipsec_proposal
exit

security ipsec vpn ipsec_vpn
ike establish-tunnel route
ike gateway ike_gateway
ike ipsec-policy ipsec_policy
enable
exit

ip route 203.0.113.4/30 203.0.113.1

Пример конфигурации Cisco:

Для работы interface Tunnel в режиме Route-based IPsec VPN на Cisco необходимо добавить команду tunnel mode ipsec ipv4 в конфигурацию данного interface Tunnel.

Router#show running-config
...
crypto isakmp policy 1

encryption aes 192

hash sha384

authentication pre-share

group 20

crypto isakmp key PASSWORD address 203.0.113.2

!

crypto ipsec transform-set IPsec esp-aes 256 esp-sha256-hmac

mode tunnel

!

crypto ipsec profile IPsec_profile

set transform-set IPsec

set pfs group19

!

interface Tunnel2

ip address 192.0.2.2 255.255.255.252

tunnel source 203.0.113.6

tunnel mode ipsec ipv4

tunnel destination 203.0.113.2

tunnel protection ipsec profile IPsec_profile

!

interface GigabitEthernet1

ip address 203.0.113.6 255.255.255.252

!

ip route 203.0.113.0 255.255.255.252 203.0.113.5

Вывод оперативной информации IPsec-туннеля со стороны ESR:

ESR# ping 192.0.2.2

PING 192.0.2.2 (192.0.2.2) 56 bytes of data.

!!!!!

--- 192.0.2.2 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4003ms

rtt min/avg/max/mdev = 0.954/13.882/65.340/25.729 ms

ESR# show security ipsec vpn status

Name Local host Remote host Initiator spi Responder spi State

------------------------------- --------------- --------------- ------------------ ------------------ -----------

ipsec_vpn 203.0.113.2 203.0.113.6 0x263711e71c636980 0x3ab0c637e094a3a6 Established

ESR# show security ipsec vpn status ipsec_vpn

Currently active IKE SA:

Name: ipsec_vpn

State: Established

Version: v1-only

Unique ID: 1

Local host: 203.0.113.2

Remote host: 203.0.113.6

Role: Responder

Initiator spi: 0x263711e71c636980

Responder spi: 0x3ab0c637e094a3a6

Encryption algorithm: aes192

Authentication algorithm: sha2-384

Diffie-Hellman group: 20

Established (d,h:m:s): 00,00:12:57

Rekey time (d,h:m:s): 00,00:00:00

Reauthentication time (d,h:m:s): 00,02:31:02

Child IPsec SAs:

Name: ipsec_vpn-2

State: Installed

Protocol: esp

Mode: Tunnel

Encryption algorithm: aes256

Authentication algorithm: sha2-256

Rekey time (d,h:m:s): 00,00:33:57

Life time (d,h:m:s): 00,00:47:03

Established (d,h:m:s): 00,00:12:57

Traffic statistics:

Input bytes: 420

Output bytes: 420

Input packets: 5

Output packets: 5

-------------------------------------------------------------

Вывод оперативной информации IPsec-туннеля со стороны Cisco:

Router#ping 192.0.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
Router#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
203.0.113.2 203.0.113.6 QM_IDLE 1001 ACTIVE

IPv6 Crypto ISAKMP SA

Router#show crypto ipsec sa

interface: Tunnel2
Crypto map tag: Tunnel2-head-0, local addr 203.0.113.6

protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 203.0.113.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
#pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 203.0.113.6, remote crypto endpt.: 203.0.113.2
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1
current outbound spi: 0xCBBE1E81(3418234497)
PFS (Y/N): Y, DH group: group19

inbound esp sas:
spi: 0x1009BA0D(269072909)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: CSR:1, sibling_flags FFFFFFFF80004048, crypto map: Tunnel2-head-0
sa timing: remaining key lifetime (k/sec): (4607997/2586)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xCBBE1E81(3418234497)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: CSR:2, sibling_flags FFFFFFFF80004048, crypto map: Tunnel2-head-0
sa timing: remaining key lifetime (k/sec): (4607998/2586)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas:

2. Пример настройки Route-based IPsec VPN между ESR и Cisco для IKEv2

Схема:

Eltex Knowledge Base > Примеры настройки Route-based IPsec VPN между ESR и Cisco для IKEv1 и IKEv2 > route_based_ipsec_between_esr_and_cisco.png

Задача: Построить Route-based IPsec VPN туннель между ESR и Cisco.

Параметры IKE:
- версия IKE: v2;
- алгоритм шифрования: aes192;
- алгоритм аутентификации: sha2-384;
- группа Диффи-Хэллмана: 20.

Параметры IPSec:
-алгоритм шифрования: aes256;
-алгоритм аутентификации: sha2-256;
-pfs группа Диффи-Хэллмана: 19.

Пример конфигурации ESR:

ESR# show running-config
hostname ESR

interface gigabitethernet 1/0/1
ip firewall disable
ip address 203.0.113.2/30
exit

tunnel vti 1
ip firewall disable
local address 203.0.113.2
remote address 203.0.113.6
ip address 192.0.2.1/30
enable
exit

security ike proposal ike_proposal
authentication algorithm sha2-384
encryption algorithm aes192
dh-group 20
exit

security ike policy ike_policy
pre-shared-key ascii-text encrypted AC95305E87207ADF
proposal ike_proposal
exit

security ike gateway ike_gateway
version v2-only
ike-policy ike_policy
mode route-based
mobike disable
bind-interface vti 1
exit

security ipsec proposal ipsec_proposal
authentication algorithm sha2-256
encryption algorithm aes256
pfs dh-group 19
exit

security ipsec policy ipsec_policy
proposal ipsec_proposal
exit

security ipsec vpn ipsec_vpn
ike establish-tunnel route
ike gateway ike_gateway
ike ipsec-policy ipsec_policy
enable
exit

ip route 203.0.113.4/30 203.0.113.1

Пример конфигурации Cisco:

Для работы interface Tunnel в режиме Route-based IPsec VPN на Cisco необходимо добавить команду tunnel mode ipsec ipv4 в конфигурацию данного interface Tunnel.

Router#show running-config
...

crypto ikev2 proposal ike_proposal

encryption aes-cbc-192

integrity sha384

group 20

!

crypto ikev2 policy ike_policy

proposal ike_proposal

!

crypto ikev2 profile ike_profile

match address local interface GigabitEthernet1

match identity remote address 203.0.113.2 255.255.255.255

authentication remote pre-share key PASSWORD

authentication local pre-share key PASSWORD

!

crypto ipsec transform-set IPsec esp-aes 256 esp-sha256-hmac

mode tunnel

!

crypto ipsec profile ipsec_profile

set transform-set IPsec

set pfs group19

set ikev2-profile ike_profile

!

interface Tunnel2

ip address 192.0.2.2 255.255.255.252

tunnel source 203.0.113.6

tunnel mode ipsec ipv4

tunnel destination 203.0.113.2

tunnel protection ipsec profile ipsec_profile

!

interface GigabitEthernet1

ip address 203.0.113.6 255.255.255.252

!

ip route 203.0.113.0 255.255.255.252 203.0.113.5

Вывод оперативной информации IPsec-туннеля со стороны ESR:

ESR# ping 192.0.2.2

PING 192.0.2.2 (192.0.2.2) 56 bytes of data.

!!!!!

--- 192.0.2.2 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4003ms

rtt min/avg/max/mdev = 0.877/0.938/1.020/0.065 ms

ESR# show security ipsec vpn status

Name Local host Remote host Initiator spi Responder spi State

------------------------------- --------------- --------------- ------------------ ------------------ -----------

ipsec_vpn 203.0.113.2 203.0.113.6 0x7cb32f786d55a54b 0x132608d04f8b04f9 Established

ESR# show security ipsec vpn status ipsec_vpn

Currently active IKE SA:

Name: ipsec_vpn

State: Established

Version: v2-only

Unique ID: 2

Local host: 203.0.113.2

Remote host: 203.0.113.6

Role: Responder

Initiator spi: 0x7cb32f786d55a54b

Responder spi: 0x132608d04f8b04f9

Encryption algorithm: aes192

Authentication algorithm: sha2-384

Diffie-Hellman group: 20

Established (d,h:m:s): 00,00:32:56

Rekey time (d,h:m:s): 00,00:00:00

Reauthentication time (d,h:m:s): 00,02:16:50

Child IPsec SAs:

Name: ipsec_vpn-4

State: Installed

Protocol: esp

Mode: Tunnel

Encryption algorithm: aes256

Authentication algorithm: sha2-256

Rekey time (d,h:m:s): 00,00:10:38

Life time (d,h:m:s): 00,00:27:04

Established (d,h:m:s): 00,00:32:56

Traffic statistics:

Input bytes: 2640

Output bytes: 840

Input packets: 35

Output packets: 10

-------------------------------------------------------------

Вывод оперативной информации IPsec-туннеля со стороны Cisco:

Router#ping 192.0.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Router#show crypto ikev2 sa
IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf Status
1 203.0.113.6/500 203.0.113.2/500 none/none READY
Encr: AES-CBC, keysize: 192, PRF: SHA384, Hash: SHA384, DH Grp:20, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/2028 sec

IPv6 Crypto IKEv2 SA

Router#show crypto ipsec sa

interface: Tunnel2
Crypto map tag: Tunnel2-head-0, local addr 203.0.113.6

protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 203.0.113.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40
#pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 203.0.113.6, remote crypto endpt.: 203.0.113.2
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1
current outbound spi: 0xCB9384B5(3415442613)
PFS (Y/N): N, DH group: none

inbound esp sas:
spi: 0x923F216E(2453610862)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: CSR:2, sibling_flags FFFFFFFF80000048, crypto map: Tunnel2-head-0
sa timing: remaining key lifetime (k/sec): (4607997/1565)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xCB9384B5(3415442613)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: CSR:1, sibling_flags FFFFFFFF80000048, crypto map: Tunnel2-head-0
sa timing: remaining key lifetime (k/sec): (4607996/1565)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)

outbound ah sas:

outbound pcp sas: