关键词:MSR;GRE;IPSec;IKE;OSPF;VPN;多分支

 

一、组网需求

其中一台MSR作为总部网络的出口路由器,对2个分支提供GRE的接入,另外两台MSR分别是2个企业分支网络的出口路由器,通过GRE方式接入到总部。总部与各个分支在GRE隧道上启动OSPF路由协议,传送总部和分支的各个路由,总部和分支在GRE隧道上使用IPSec策略,对特定的流量进行加密,该应用相比于GRE Over IPSec + OSPF配置上的不同体现在IPSec配置上;在转发流量上的不同,只对部分流量加密,而不是所有

设备清单:MSR系列路由器3

二、组网图:

3.jpg

 

三、配置步骤:

设备和版本:MSR系列、Version 5.20, Beta 1202

 

 

Center的配置

#

 router id 192.168.255.255

#

ike peer branch1

 pre-shared-key h3c-msr

 remote-address 192.168.0.2

 local-address 192.168.0.1

#

ike peer branch2

 pre-shared-key h3c-msr

 remote-address 192.168.0.6

 local-address 192.168.0.5

#

ipsec proposal default

#

ipsec policy branch1 1 isakmp

 security acl 3000

 ike-peer branch1

 proposal default

#

ipsec policy branch2 1 isakmp

 security acl 3001

 ike-peer branch2

 proposal default

#

acl number 3000

 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.1.0 0.0.0.255

acl number 3001

 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.2.0 0.0.0.255

#

interface LoopBack0

 ip address 192.168.255.255 255.255.255.255

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.0.0.254 255.255.255.0

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 10.0.0.1 255.255.255.0

#

interface Tunnel0

 ip address 192.168.0.1 255.255.255.252

 source GigabitEthernet0/0

 destination 1.0.0.1

 ipsec policy branch1

#

interface Tunnel1

 ip address 192.168.0.5 255.255.255.252

 source GigabitEthernet0/0

 destination 1.0.0.2

 ipsec policy branch2

#

ospf 1

 area 0.0.0.0

  network 10.0.0.0 0.0.0.255

  network 192.168.255.255 0.0.0.0

  network 192.168.0.0 0.0.0.3

  network 192.168.0.4 0.0.0.3

#

Branch1配置

#

 router id 192.168.255.1

#

ike peer center

 pre-shared-key h3c-msr

 remote-address 192.168.0.1

 local-address 192.168.0.2

#

ipsec proposal default

#

ipsec policy center 1 isakmp

 security acl 3000

 ike-peer center

 proposal default

#

acl number 3000

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255

#

interface LoopBack0

 ip address 192.168.255.1 255.255.255.255

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.0.0.1 255.255.255.0

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 192.168.1.1 255.255.255.0

#

interface Tunnel0

 ip address 192.168.0.2 255.255.255.252

 source GigabitEthernet0/0

 destination 1.0.0.254

 ipsec policy center

#

ospf 1

 area 0.0.0.0

  network 192.168.255.1 0.0.0.0

  network 192.168.0.0 0.0.0.3

  network 192.168.1.0 0.0.0.255

#

Branch2配置

#

 router id 192.168.255.2

#

ike peer center

 pre-shared-key h3c-msr

 remote-address 192.168.0.5

 local-address 192.168.0.6

#

ipsec proposal default

#

ipsec policy center 1 isakmp

 security acl 3000

 ike-peer center

 proposal default

#

acl number 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.255.255.255

#

interface LoopBack0

 ip address 192.168.255.2 255.255.255.255

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.0.0.2 255.255.255.0

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 192.168.2.1 255.255.255.0

#

interface Tunnel0

 ip address 192.168.0.6 255.255.255.252

 source GigabitEthernet0/0

 destination 1.0.0.254

 ipsec policy center

#

ospf 1

 area 0.0.0.0

  network 192.168.255.2 0.0.0.0

  network 192.168.0.4 0.0.0.3

  network 192.168.2.0 0.0.0.255

#

四、配置关键点

1) 总部ACL配置是对特殊的内网流量;

2) 分支的ACL需要与总部ACl互为镜像;

3) IPSce Over GRE的专门配置可以参考典型配置;

4) 总部的IPSec策略要创建多个,且信誉赌场游戏官网提议必须使用隧道模式;

5) 所有的IPSec策略都绑定在对应的GRE接口上;

6) 所有的出接口G0/0都不使能OSPF,且必须保证总部和分支出接口能互通;

7) ACL一定不要最后添加一条deny ip的规则,该配置会导致不需要加密的流量被丢弃。

 


 

设为首页 | 加入收藏 | 邮箱登陆    南京咚吆网络科技有限公司版权所有 Copyright © 2008-2014  ICP备案号:苏ICP备15018674号

地址: 江苏省南京市珠江路435号华海大厦709室   邮编: 210018   电话: 0771-2029366   传真: (86)25-83156290   邮箱: master@junovation.com