GRE over IPSEC ×××

由于IPSEC ×××不能支持组播和广播,因此不能运行动态路由协议,由于我们需要把一条×××链路作为一条专线使用,还必须建立GRE tunnel隧道,以支持动态路由协议.
实验拓扑:

基本配置步骤如下:
1:配置基本路由和需保护流量的感兴趣访问列表(注意这里感兴趣流量设为GRE隧道流量)
2:配置GRE Tunnel隧道.
3:配置IPSEC ×××.
4 :配置动态路由协议.
配置如下 :
R1#sho run
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 202.1.1.2
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 1 ipsec-isakmp
set peer 202.1.1.2
set transform-set mytrans
match address 101
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.1.1 255.255.255.0
tunnel source Ethernet0/0
tunnel destination 202.1.1.2
!
interface Ethernet0/0
ip address 201.1.1.1 255.255.255.0
crypto map mymap
router ospf 1
log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
ip route 0.0.0.0 0.0.0.0 Ethernet0/0

access-list 101 permit gre host 201.1.1.1 host 202.1.1.2
//注意访问列表所定义的IPSEC所保护的感兴趣流量为GRE流量.

R2#
interface Ethernet0/0
ip address 201.1.1.2 255.255.255.0
!
interface Ethernet2/0
ip address 202.1.1.1 255.255.255.0

R3#
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 201.1.1.1
!
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 10 ipsec-isakmp
set peer 201.1.1.1
set transform-set mytrans
match address 101
!
interface Loopback0
ip address 172.16.1.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.1.2 255.255.255.0
tunnel source Ethernet2/0
tunnel destination 201.1.1.1
!
interface Ethernet2/0
ip address 202.1.1.2 255.255.255.0
half-duplex
crypto map mymap
!
router ospf 1
log-adjacency-changes
network 172.16.1.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
ip route 0.0.0.0 0.0.0.0 Ethernet2/0
!
access-list 101 permit gre host 202.1.1.2 host 201.1.1.1

测试:
R1#show ip os nei

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.1.1        0   FULL/ -        00:00:37    192.168.1.2     Tunnel0
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

C    201.1.1.0/24 is directly connected, Ethernet0/0
     172.16.0.0/32 is subnetted, 1 subnets
O       172.16.1.1 [110/11112] via 192.168.1.2, 00:41:22, Tunnel0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, Tunnel0
S*   0.0.0.0/0 is directly connected, Ethernet0/0
R1#show crypto isakmp sa
dst             src             state          conn-id slot
202.1.1.2       201.1.1.1       QM_IDLE              8    0

R1#traceroute 172.16.1.1

Type escape sequence to abort.
Tracing the route to 172.16.1.1

转载于:https://blog.51cto.com/myelf/170766

GRE over IPSEC ×××相关推荐

FD.io/VPP — GRE over IPSec
3# 目录文章目录 GRE over IPSec VPP Responder(被动) 配置接口配置 IPSec IKEv2 配置 GRE 隧道 VPP Initiator(主动) 配置接口配置 ...
GRE OVER IPSEC
实验五.GRE over IPSec 一.实验拓朴: 二.实验目的: 1. 所有流量通过GRE封装 2. 所有流量被IPSec保护 3. 实现路由协议数据只被GRE封装,用户业务数据被IPSec ...
GRE over IPSec 隧道配置案例
我也想要一个美女老师教我学习网络. GRE over IPSec 配置案例要求拓扑配置基础配置 GRE VPN配置配置路由 IPSec配置 GRE over IPSec 技术背景工作流程 ...
H3C GRE over IPsec实验
GRE over IPsec VPN实验一.拓扑图二.组网需求三.配置步骤 1.配置各设备IP地址 2.配置默认路由 3.配置DHCP 4.配置 GRE over IPsec VPN (1)在 ...
HUAWEI篇 NGFW与AR网关建立GRE over IPSec隧道
组网需求如图1-1所示,企业希望总部和分支的内网可以安全互访,且分支和总部间要能够传送组播数据(例如企业内网部部署了动态路由,动态路由交互过程中存在组播报文交互).由于单纯的IPSec隧道不能传送组 ...
三十二、VPN技术概述——GRE、IPSec、MPLS vpn
文章目录 vpn 简介用途优缺一.GRE-VPN 1.基础配置步骤: 2.可选配置二.IPSEC-VPN 概述 1.IPSes 特性 2.IPSec 架构 3.IPSec 数据封装三.GRE ...
GRE over IPSec技术原理
GRE原理 GRE简介: General Routing Encapsulation,简称GRE,是一种三层VPN封装技术.GRE可以对某些网络层协议(如IPX.Apple Talk.IP等)的报文进 ...
华为路由器：IPSec加密GRE通道（GRE over IPsec）
IPSec加密GRE通道由于GRE隧道不提供安全性保障,使用ipsec加密gre隧道是现网中比较常用的VPN部署,它的加密方式分为两种: 可以使用IPsec来加密隧道进行传输,叫做IPsec ove ...
GRE over IPsec VPN配置
GRE over IPsec VPN配置 [实验目的] 理解GRE Tunnel的概念. 理解GRE over IPsec VPN的概念. 掌握GRE Tunnel的配置. 掌握GRE over IP ...
华三（H3C）GRE OVER IPsec实验
实验拓扑目录实验需求 1. 某企业北京总部.上海分支.武汉分支分别通过 R1,R3,R4 接入互联网,配置默认路由连通公网 2. 按照图示配置 IP 地址,R1,R3,R4 分别配置 Loopba ...

GRE over IPSEC ×××

GRE over IPSEC ×××相关推荐

最新文章

热门文章