关键词：MSR;GRE;IPSec;IKE;OSPF;VPN;多分支
一、组网需求：
其中一台MSR作为总部网络的出口路由器，对2个分支提供GRE的接入，另外两台MSR分别是2个企业分支网络的出口路由器，通过GRE方式接入到总部。总部与各个分支在GRE隧道上启动OSPF路由协议，传送总部和分支的各个路由，总部和分支在GRE隧道上使用IPSec策略，对特定的流量进行加密，该应用相比于GRE Over IPSec + OSPF配置上的不同体现在IPSec配置上；在转发流量上的不同，只对部分流量加密，而不是所有
设备清单：MSR系列路由器3台
二、组网图：
三、配置步骤： 设备和版本：MSR系列、Version 5.20, Beta 1202。
|
Center的配置 |
|
# router id 192.168.255.255 # ike peer branch1 pre-shared-key h3c-msr remote-address 192.168.0.2 local-address 192.168.0.1 # ike peer branch2 pre-shared-key h3c-msr remote-address 192.168.0.6 local-address 192.168.0.5 # ipsec proposal default # ipsec policy branch1 1 isakmp security acl 3000 ike-peer branch1 proposal default # ipsec policy branch2 1 isakmp security acl 3001 ike-peer branch2 proposal default # acl number 3000 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.1.0 0.0.0.255 acl number 3001 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.2.0 0.0.0.255 # interface LoopBack0 ip address 192.168.255.255 255.255.255.255 # interface GigabitEthernet0/0 port link-mode route combo enable copper ip address 1.0.0.254 255.255.255.0 # interface GigabitEthernet0/1 port link-mode route combo enable copper ip address 10.0.0.1 255.255.255.0 # interface Tunnel0 ip address 192.168.0.1 255.255.255.252 source GigabitEthernet0/0 destination 1.0.0.1 ipsec policy branch1 # interface Tunnel1 ip address 192.168.0.5 255.255.255.252 source GigabitEthernet0/0 destination 1.0.0.2 ipsec policy branch2 # ospf 1 area 0.0.0.0 network 10.0.0.0 0.0.0.255 network 192.168.255.255 0.0.0.0 network 192.168.0.0 0.0.0.3 network 192.168.0.4 0.0.0.3 # |
|
Branch1配置 |
|
# router id 192.168.255.1 # ike peer center pre-shared-key h3c-msr remote-address 192.168.0.1 local-address 192.168.0.2 # ipsec proposal default # ipsec policy center 1 isakmp security acl 3000 ike-peer center proposal default # acl number 3000 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 # interface LoopBack0 ip address 192.168.255.1 255.255.255.255 # interface GigabitEthernet0/0 port link-mode route combo enable copper ip address 1.0.0.1 255.255.255.0 # interface GigabitEthernet0/1 port link-mode route combo enable copper ip address 192.168.1.1 255.255.255.0 # interface Tunnel0 ip address 192.168.0.2 255.255.255.252 source GigabitEthernet0/0 destination 1.0.0.254 ipsec policy center # ospf 1 area 0.0.0.0 network 192.168.255.1 0.0.0.0 network 192.168.0.0 0.0.0.3 network 192.168.1.0 0.0.0.255 # |
|
Branch2配置 |
|
# router id 192.168.255.2 # ike peer center pre-shared-key h3c-msr remote-address 192.168.0.5 local-address 192.168.0.6 # ipsec proposal default # ipsec policy center 1 isakmp security acl 3000 ike-peer center proposal default # acl number 3000 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.255.255.255 # interface LoopBack0 ip address 192.168.255.2 255.255.255.255 # interface GigabitEthernet0/0 port link-mode route combo enable copper ip address 1.0.0.2 255.255.255.0 # interface GigabitEthernet0/1 port link-mode route combo enable copper ip address 192.168.2.1 255.255.255.0 # interface Tunnel0 ip address 192.168.0.6 255.255.255.252 source GigabitEthernet0/0 destination 1.0.0.254 ipsec policy center # ospf 1 network 192.168.255.2 0.0.0.0 network 192.168.0.4 0.0.0.3 network 192.168.2.0 0.0.0.255 # |
四、配置关键点：
1) 总部ACL配置是对特殊的内网流量；
2) 分支的ACL需要与总部ACl互为镜像；
3) IPSce Over GRE的专门配置可以参考典型配置；
4) 总部的IPSec策略要创建多个，且安全提议必须使用隧道模式；
5) 所有的IPSec策略都绑定在对应的GRE接口上；
6) 所有的出接口G0/0都不使能OSPF，且必须保证总部和分支出接口能互通；
7) ACL一定不要最后添加一条deny ip的规则，该配置会导致不需要加密的流量被丢弃。
设为首页 | 加入收藏 | 邮箱登陆 南京君诺鑫成网络科技有限公司版权所有 Copyright © 2008-2014 ICP备案号:苏ICP备10109038号
地址： 江苏省南京市珠江路435号华海大厦709室 邮编： 210018 电话： (86)25-83156292(10线) 传真： (86)25-83156290 邮箱： master@junovation.com