附：
協(xié)議與模式分類(lèi)
esp 和 ah 的分類(lèi)：
- 數(shù)據(jù)的安全性：ESP有機(jī)密性；AH無(wú)機(jī)密性
- 場(chǎng)景：ESP適合公網(wǎng)場(chǎng)景；AH適合內(nèi)網(wǎng) / 私網(wǎng)場(chǎng)景
（數(shù)據(jù)的安全性主要依賴(lài)于傳輸端之間需要做認(rèn)證）
傳輸模式和隧道模式的分類(lèi)：
- 傳輸端的可達(dá)性：傳輸模式有可達(dá)性；隧道模式無(wú)可達(dá)性
- 場(chǎng)景：傳輸模式（私網(wǎng)數(shù)據(jù)通過(guò)公網(wǎng)傳輸；異種網(wǎng)絡(luò)之間通過(guò)其他網(wǎng)絡(luò)傳輸）；隧道模式（專(zhuān)線(xiàn)，隧道已做，本身路由可達(dá)）
ipsec配置（路由器）
靜態(tài)路由協(xié)議下的IPSec
保證基礎(chǔ)網(wǎng)絡(luò)可達(dá)
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 100.1.1.1 24
[r1]ip route-static 0.0.0.0 0 100.1.1.2
[ISP]int g0/0/0
[ISP-GigabitEthernet0/0/0]ip add 100.1.1.2 24
[ISP]int g0/0/1
[ISP-GigabitEthernet0/0/1]ip ad 100.1.2.1 24
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip add 100.1.2.2 24
[r2]ip route-static 0.0.0.0 0 100.1.2.1
[r1]int LoopBack 0
[r1-LoopBack0]ip add 172.16.10.1 24
[r2]int LoopBack 0
[r2-LoopBack0]ip add 172.16.1.1 24
（1）配置 IKE SA
<1> 安全提議
[r1]ike proposal 1 // 安全提議編號(hào)
[r1-ike-proposal-1]encryption-algorithm 3des-cbc // 加密算法（3des）
[r1-ike-proposal-1]authentication-algorithm sha1 // 認(rèn)證算法（sha1）
[r1-ike-proposal-1]authentication-method pre-share // 認(rèn)證模式（預(yù)共享：pre）
[r1-ike-proposal-1]dh group2 // 非對(duì)稱(chēng)加密算法強(qiáng)度
[r1]dis ike proposal --- 查看未顯示以及默認(rèn)配置
Number of IKE Proposals: 2
-------------------------------------------
IKE Proposal: 1
Authentication method : pre-shared
Authentication algorithm : SHA1
Encryption algorithm : 3DES-CBC
DH group : MODP-1024
SA duration : 3600
PRF : PRF-HMAC-SHA
-------------------------------------------
-------------------------------------------
IKE Proposal: Default
Authentication method : pre-shared
Authentication algorithm : SHA1
Encryption algorithm : DES-CBC
DH group : MODP-768
SA duration : 86400
PRF : PRF-HMAC-SHA
-------------------------------------------
[r2]ike proposal 1
[r2-ike-proposal-1]encryption-algorithm 3des-cbc
[r2-ike-proposal-1]dh group2
[r2-ike-proposal-1]sa duration 3600PRF：完美向前法。
<2> 安全認(rèn)證
[r1]ike peer 12 v1 // ike認(rèn)證名稱(chēng)和版本
[r1-ike-peer-12]exchange-mode main // 模式選擇（默認(rèn)主模式）
[r1-ike-peer-12]pre-shared-key cipher 234 // 編譯預(yù)共享密鑰
[r1-ike-peer-12]ike-proposal 1 // 調(diào)用安全提議
[r1-ike-peer-12]remote-address 100.1.2.2 // 調(diào)用遠(yuǎn)端地址
[r2]ike peer 12 v1
[r2-ike-peer-12]ike-proposal 1
[r2-ike-peer-12]pre-shared-key cipher 234
[r2-ike-peer-12]remote-address 100.1.1.1
[r2-ike-peer-12]exchange-mode main（2）配置IPSec? SA 安全提議信息
[r1]ipsec proposal 1 // ipsec提議
[r1-ipsec-proposal-1]transform esp // 選擇傳輸協(xié)議
[r1-ipsec-proposal-1]esp authentication-algorithm sha2-512 // 認(rèn)證算法
[r1-ipsec-proposal-1]esp encryption-algorithm aes-128 // 加密算法
[r1-ipsec-proposal-1]encapsulation-mode tunnel // 封裝模式（隧道模式）
[r1]dis ipsec proposal --- 查看
Number of proposals: 1
IPSec proposal name: 1
Encapsulation mode: Tunnel
Transform : esp-new
ESP protocol : Authentication SHA2-HMAC-512
Encryption AES-128
[r2]ipsec proposal 1
[r2-ipsec-proposal-1]transform esp
[r2-ipsec-proposal-1]encapsulation-mode tunnel
[r2-ipsec-proposal-1]esp authentication-algorithm sha2-512
[r2-ipsec-proposal-1]esp encryption-algorithm aes-128（3）定義加密流量（感興趣流）
[r1]acl 3000
[r1-acl-adv-3000]rule 5 permit ip source 172.16.10.1 0.0.0.0 destination 172.16.1.1 0.0.0.0
[r2]acl 3000
[r2-acl-adv-3000]rule 5 permit ip source 172.16.1.1 0.0.0.0 destination 172.16.10.1 0.0.0.0（4）配置安全策略集
[r1]ipsec policy k 10 isakmp --- 定義名為k，序列號(hào)為10，運(yùn)用isakmp（IKE）進(jìn)行協(xié)商
[r1-ipsec-policy-isakmp-k-10]ike-peer 12 // 關(guān)聯(lián)ike-peer
[r1-ipsec-policy-isakmp-k-10]security acl 3000 // 關(guān)聯(lián)感興趣流
[r1-ipsec-policy-isakmp-k-10]pfs dh-group2 // pfs：完美向前法
[r2]ipsec policy k 10 isakmp
[r2-ipsec-policy-isakmp-k-10]ike-peer 12
[r2-ipsec-policy-isakmp-k-10]proposal 1
[r2-ipsec-policy-isakmp-k-10]security acl 3000
[r2-ipsec-policy-isakmp-k-10]pfs dh-group2（5）接口調(diào)用安全策略集
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ipsec policy k
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ipsec policy k進(jìn)行觸發(fā)：
（6）查看安全聯(lián)盟建立情況
<r1>dis ike sa
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
2 100.1.2.2 0 RD|ST 2
1 100.1.2.2 0 RD|ST 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
<r1>dis ipsec sa
[Outbound ESP SAs]
SPI: 1407390962 (0x53e314f2)
Proposal: ESP-ENCRYPT-AES-128 SHA2-512-256
SA remaining key duration (bytes/sec): 1887329280/2740
Max sent sequence-number: 5
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 3197321182 (0xbe933fde)
Proposal: ESP-ENCRYPT-AES-128 SHA2-512-256
SA remaining key duration (bytes/sec): 1887436380/2740
Max received sequence-number: 5
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
動(dòng)態(tài)路由協(xié)議下的IPSec
新建環(huán)回
[r1]int LoopBack 0
[r1-LoopBack1]ip ad 1.1.1.1 24
gre下的隧道配置
[r1]int t0/0/0
[r1-Tunnel0/0/0]tunnel-protocol gre
[r1-Tunnel0/0/0]source g0/0/0
[r1-Tunnel0/0/0]destination 100.1.2.2
[r1-Tunnel0/0/0]ip add 10.1.1.1 24
[r2]int lo 1
[r2-LoopBack1]ip add 2.2.2.2 24
[r2]int t0/0/0
[r2-Tunnel0/0/0]tunnel-protocol gre
[r2-Tunnel0/0/0]source g0/0/0
[r2-Tunnel0/0/0]destination 100.1.1.1
[r2-Tunnel0/0/0]ip add 10.1.1.2 24
ospf配置
[r1]ospf 1
[r1-ospf-1]a 0
[r1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[r1-ospf-1-area-0.0.0.0]network 10.1.1.1 0.0.0.0
[r2]ospf 1
[r2-ospf-1]a 0
[r2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[r2-ospf-1-area-0.0.0.0]network 10.1.1.2 0.0.0.0
查看鄰居建立情況
[r1]dis ospf peer brief
OSPF Process 1 with Router ID 100.1.1.1
Peer Statistic Information
----------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 Tunnel0/0/0 100.1.2.2 Full
----------------------------------------------------------------------------（1）配置 IKE SA?
<1> 安全提議
[r1]ike proposal 10
[r1-ike-proposal-10]encryption-algorithm 3des-cbc
[r1-ike-proposal-10]authentication-algorithm sha1
[r1-ike-proposal-10]authentication-method pre-share
[r1-ike-proposal-10]dh group2
[r2]ike proposal 10
[r2-ike-proposal-10]encryption-algorithm 3des-cbc
[r2-ike-proposal-10]authentication-algorithm sha1
[r2-ike-proposal-10]authentication-method pre-share
[r2-ike-proposal-10]dh group2<2> 安全認(rèn)證
[r1]ike peer gre v1
[r1-ike-peer-gre]pre-shared-key simple aaa // 設(shè)置預(yù)共享密鑰（simple：本地不加密）
[r1-ike-peer-gre]exchange-mode aggressive // 采用野蠻模式
[r1-ike-peer-gre]local-id-type name // 采用name定義
[r1-ike-peer-gre]remote-name a1 // 遠(yuǎn)端name為a1
[r1-ike-peer-gre]remote-address 100.1.2.2 // 遠(yuǎn)端IP
[r1-ike-peer-gre]ike-proposal 10 // 引用ike
[r1]ike local-name a1 // 全局定義本地name
[r2]ike peer gre v1
[r2-ike-peer-gre]ike-proposal 10
[r2-ike-peer-gre]pre-shared-key simple aaa
[r2-ike-peer-gre]remote-address 100.1.1.1
[r2-ike-peer-gre]exchange-mode aggressive
[r2-ike-peer-gre]local-id-type name
[r2-ike-peer-gre]remote-name a1（2）配置ipsec sa 的安全提議信息
[r1]ipsec proposal gre
[r1-ipsec-proposal-gre]encapsulation-mode transport
[r2]ipsec proposal gre
[r2-ipsec-proposal-gre]encapsulation-mode transport
（3）定義加密流量（感興趣流）
[r1]acl 3001
[r1-acl-adv-3001]rule 10 permit gre source 100.1.1.1 0 destination 100.1.2.2 0
[r2]acl 3001
[r2-acl-adv-3001]rule 10 permit gre source 100.1.2.2 0 destination 100.1.1.1 0
（4）配置安全策略集
[r1]ipsec policy gre 10 isakmp
[r1-ipsec-policy-isakmp-gre-10]ike-peer gre
[r1-ipsec-policy-isakmp-gre-10]proposal gre
[r1-ipsec-policy-isakmp-gre-10]security acl 3001
[r2]ipsec policy gre 10 isakmp
[r2-ipsec-policy-isakmp-gre-10]security acl 3001
[r2-ipsec-policy-isakmp-gre-10]proposal gre
[r2-ipsec-policy-isakmp-gre-10]ike-peer gre（5）接口調(diào)用安全策略集
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ipsec policy gre
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ipsec policy greping進(jìn)行觸發(fā)：
流量已加密文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-479144.html
（6）分析
文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-479144.html
到了這里，關(guān)于安全防御 --- IPSec理論（02）的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
