这是我×××书中的GET×××的第一部分,现在还处于草稿阶段,可能还会有些问题,希望大家多多提出意见,我会陆续发布我书中的重要部分,希望大家对我新书的关注与支持。谢谢!
enable
configure terminal
!
hostname KS1
!
interface Loopback0
!
interface FastEthernet0/0
!
router ospf 1
network 10.1.101.0 0.0.0.255 area 0
!
end
|
enable
configure terminal
!
hostname KS2
!
interface FastEthernet0/0
!
router ospf 1
network 172.16.1.0 0.0.0.255 area 0
!
end
|
enable
configure terminal
!
hostname GM1
!
interface Loopback0
!
interface FastEthernet0/0
!
router ospf 1
network 10.1.1.0 0.0.0.255 area 0
!
end
|
enable
configure terminal
!
hostname GM2
!
interface Loopback0
!
interface FastEthernet0/0
!
router ospf 1
network 10.1.2.0 0.0.0.255 area 0
!
end
|
KS1(config)#ip domain name yeslab.net
<为了产生密钥,配置域名>
!
KS1(config)#crypto key generate rsa modulus 1024 label getvpnkey exportable
<产生一个名字为“getvpnkey”,长度为1024位,可导出的RSA密钥对。>
!
KS1(config)#crypto key export rsa getvpnkey pem terminal 3des yeslabccies
<导出名字为“getvpnkey”的RSA密钥对,使用3DES加密算法来加密导出后的私钥,加密的密码为“yeslabccies”>
% Key name: getvpnkey
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUA
4ZEJNsRRqZ/42m50OLafgZJX/bdJhsTXScc/YTmJcKi7ZjWurILaEg4UKbBU
7svVSQ/TUV4DNFk4M8ScWsqa8N8nhNc
YvjNIRJVT9GH9UKy1QIDAQAB
-----END PUBLIC KEY-----
<上面是明文的公钥>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,CD0C48C098608AC0
TD5Eu0LSixQzf4GlZTVyOQSk
4orXLdhcL1QrlUo4WhvIZ/t+bew5XKpuwyI4d/3wdQYGNY8zlHuXpOkeGTHn5w
0RyqY1sDY6xQEvobowc8Aztm
lDi9aoHuVzYsPNs4WlVVZSMu
izOpUkcJCcUA8tAiLuPVzxnE
ANTRzCtkHmjAHZfUrJ+KNqYQ8j54zD1ADuuKV9DN6ZL
RnfBiBDERvKwEw+tAfD8u6mGMnyxrWziSCvIFgD
0l3mlkkIWzf9RfyrVgGlEcbj
lARBQicfEhCteZ3q6wq9XJkU
zEtJ526AukU6nf4HrASkldvp
x0cL/PHA0n2FTmYtclbMUaVTgeuG5
KPotVfWj175e4Tjh37fnT3Y7
W7gWAR9AlGU1khF9yxUWFUmd
-----END RSA PRIVATE KEY-----
<上面为使用3DES加密后的私钥>
|
KS2(config)#crypto key import rsa getvpnkey terminal yeslabccies
<导入名字为“getvpnkey”的RSA密钥对,解密密码为“yeslabccies”>
% Enter PEM-formatted public General Purpose key or certificate.
% End with a blank line or "quit" on a line by itself.
<下面是KS1导出公钥的拷贝>
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUA
4ZEJNsRRqZ/42m50OLafgZJX/bdJhsTXScc/YTmJcKi7ZjWurILaEg4UKbBU
7svVSQ/TUV4DNFk4M8ScWsqa8N8nhNc
YvjNIRJVT9GH9UKy1QIDAQAB
-----END PUBLIC KEY-----
<回车>
% Enter PEM-formatted encrypted private General Purpose key.
% End with "quit" on a line by itself.
<下面是KS1导出私钥的拷贝>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,CD0C48C098608AC0
TD5Eu0LSixQzf4GlZTVyOQSk
4orXLdhcL1QrlUo4WhvIZ/t+bew5XKpuwyI4d/3wdQYGNY8zlHuXpOkeGTHn5w
0RyqY1sDY6xQEvobowc8Aztm
lDi9aoHuVzYsPNs4WlVVZSMu
izOpUkcJCcUA8tAiLuPVzxnE
ANTRzCtkHmjAHZfUrJ+KNqYQ8j54zD1ADuuKV9DN6ZL
RnfBiBDERvKwEw+tAfD8u6mGMnyxrWziSCvIFgD
0l3mlkkIWzf9RfyrVgGlEcbj
lARBQicfEhCteZ3q6wq9XJkU
zEtJ526AukU6nf4HrASkldvp
x0cL/PHA0n2FTmYtclbMUaVTgeuG5
KPotVfWj175e4Tjh37fnT3Y7
W7gWAR9AlGU1khF9yxUWFUmd
-----END RSA PRIVATE KEY-----
quit
% Key pair import succeeded.
|
KS1(config)#crypto isakmp policy 10
KS1(config-isakmp)#authentication pre-share
!
KS1(config)#crypto isakmp key 0 cisco address 172.16.1.1
KS1(config)#crypto isakmp key 0 cisco address 172.16.1.2
KS1(config)#crypto isakmp key 0 cisco address 172.16.1.102
<注意:密钥服务器间也使用ISAKMP第一阶段进行认证>
|
KS1(config)#ip access-list extended getvpntraffic
KS1(config-ext-nacl)#permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
<本实验企业网内部需要被保护的网络可以被汇总为10.0.0.0/8>
|
KS1(config)#crypto ipsec transform-set getvpn-set esp-des esp-md5-hmac
<使用此转换集来加密感兴趣流>
KS1(config)#crypto ipsec profile getvpn-profile
KS1(ipsec-profile)#set transform-set getvpn-set
|
KS1(config)#crypto gdoi group mygroup
<配置GET×××组的组名为“mygroup”>
KS1(config-gdoi-group)#identity number 88888
<配置GET×××组ID为“88888”,所有成员都需要使用相同的ID>
KS1(config-gdoi-group)#server local
<配置本地路由器KS1为密钥服务器>
KS1(gdoi-local-server)#address ipv4 172.16.1.101
<配置服务器地址>
|
KS1(gdoi-local-server)#rekey transport unicast
<配置GET×××使用单播传输密钥更新信息,注意默认为组播>
KS1(gdoi-local-server)#rekey authentication mypubkey rsa getvpnkey
<配置对密钥更新信息作签名的RSA密钥对为“getvpnkey”>
KS1(gdoi-local-server)#rekey algorithm aes 256
<此配置为选项,配置密钥更新信息的加密算法>
|
KS1(gdoi-local-server)#rekey authentication mypubkey rsa getvpnkey
<配置对密钥更新信息作签名的RSA密钥对为“getvpnkey”>
KS1(gdoi-local-server)#rekey algorithm aes 256
<此配置为选项,配置密钥更新信息的加密算法>
KS1(gdoi-local-server)#rekey address ipv4 106
<定义组播密钥更新流量>
注意需要提前在全局配置模式配置访问控制列表106
KS1(config)#access-list 106 permit udp host 172.16.1.101 eq 848 host 239.0.1.2 eq 848
<密钥更新信息的组播地址为239.0.1.2,这个地址可以按需配置。>
|
KS1(gdoi-local-server)#sa ipsec 1
<配置第一个IPSec安全关联>
KS1(gdoi-sa-ipsec)#match address ipv4 getvpntraffic
<匹配上感兴趣流>
KS1(gdoi-sa-ipsec)#profile getvpn-profile
<对感兴趣流使用此Profile进行保护>
KS1(gdoi-sa-ipsec)#replay time window-size 2
<此配置为选项,启用基于时间的防重放,窗口大小为2秒>
|
GM1(config)#crypto isakmp policy 10
GM1(config-isakmp)#authentication pre-share
!
GM1(config)#crypto isakmp key 0 cisco address 172.16.1.101
GM1(config)#crypto isakmp key 0 cisco address 172.16.1.102
<需要配置与首要和次要密钥服务器进行认证的预共享密钥>
|
GM1(config)#crypto gdoi group mygroup
GM1(config-gdoi-group)#identity number 88888
<需要和密钥服务器配置相同的组ID>
GM1(config-gdoi-group)#server address ipv4 172.16.1.101
<GM1首先向172.16.1.101密钥服务器发起注册>
GM1(config-gdoi-group)#server address ipv4 172.16.1.102
<GM1如果注册172.16.1.101失败,再向172.16.1.102这个密钥服务器发起注册>
|
GM1(config)#crypto map cisco 10 gdoi
<使用GDOI协议为crypto map提供密钥资源(TEK)>
GM1(config-crypto-map)#set group mygroup
!
GM1(config)#interface fa0/0
GM1(config-if)#crypto map cisco
|
GM2(config)#crypto isakmp policy 10
GM2(config-isakmp)#authentication pre-share
!
GM2(config)#crypto isakmp key 0 cisco address 172.16.1.101
GM2(config)#crypto isakmp key 0 cisco address 172.16.1.102
|
GM2(config)#crypto gdoi group mygroup
GM2(config-gdoi-group)#identity number 88888
GM2(config-gdoi-group)#server address ipv4 172.16.1.101
GM2(config-gdoi-group)#server address ipv4 172.16.1.102
|
GM2(config)#crypto map cisco 10 gdoi
GM2(config-crypto-map)#set group mygroup
!
GM2(config)#interface fa0/0
GM2(config-if)#crypto map cisco
|
KS1#show crypto gdoi group mygroup
Group Name
<GDOI的组名为“mygroup”,密钥更新方式为单播>
Group Identity
Group Members
<已经注册的组成员有2个>
|
KS1#show crypto gdoi ks members
Group Member Information :
Number of rekeys sent for group mygroup : 0
Group Member ID
Group ID
Group Name
Key Server ID
Rekeys sent
Rekeys retries
Rekey Acks Rcvd
Rekey Acks missed : 0
Sent seq num :
Rcvd seq num :
Group Member ID
Group ID
Group Name
Key Server ID
Rekeys sent
Rekeys retries
Rekey Acks Rcvd
Rekey Acks missed : 0
Sent seq num :
Rcvd seq num :
|
GM1#show crypto gdoi group mygroup
TEK POLICY:
|
GM1#show crypto engine connections active
Crypto Engine Connections
|
GM1#ping 10.1.2.1 source 10.1.1.1 repeat 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 10.1.2.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 32/179/432 ms
|
G GM1#show crypto engine connections active
Crypto Engine Connections
|
KS1(config)#cry gdoi group mygroup
KS1(config-gdoi-group)#server local
KS1(gdoi-local-server)#redundancy
<进入密钥服务器的冗余配置模式>
KS1(gdoi-coop-ks-config)#local priority 100
<配置本地密钥服务器的优先级,KS1为首要服务器,所以值应该比KS2高>
KS1(gdoi-coop-ks-config)#peer address ipv4 172.16.1.102
<指定其它密钥服务器的地址>
|
KS2#config t
KS2(config)#crypto isakmp policy 10
KS2(config-isakmp)# authentication pre-share
KS2(config)# crypto isakmp key cisco address 172.16.1.1
KS2(config)#crypto isakmp key cisco address 172.16.1.2
KS2(config)#crypto isakmp key cisco address 172.16.1.101
KS2(config)#ip access-list extended getvpntraffic
KS2(config-ext-nacl)# permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
KS2(config)# crypto ipsec transform-set getvpn-set esp-des esp-md5-hmac
KS2(config)# crypto ipsec profile getvpn-profile
KS2(ipsec-profile)# set transform-set getvpn-set
KS2(config)# crypto gdoi group mygroup
KS2(config-gdoi-group)# identity number 88888
KS2(config-gdoi-group)# server local
KS2(gdoi-local-server)# rekey algorithm aes 256
KS2(gdoi-local-server)# rekey authentication mypubkey rsa getvpnkey
KS2(gdoi-local-server)# rekey transport unicast
KS2(gdoi-local-server)# sa ipsec 1
KS2(gdoi-sa-ipsec)# profile getvpn-profile
KS2(gdoi-sa-ipsec)# match address ipv4 getvpntraffic
KS2(gdoi-sa-ipsec)# replay time window-size 2
KS2(gdoi-sa-ipsec)#address ipv4 172.16.1.102
KS2(gdoi-local-server)#redundancy
KS2(gdoi-coop-ks-config)# local priority 75
KS2(gdoi-coop-ks-config)# peer address ipv4 172.16.1.101
|
KS1#show crypto gdoi ks coop
Crypto Gdoi Group Name :mygroup
|
GM1#ping 10.1.101.1 source 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.101.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
.....
Success rate is 0 percent (0/5)
|
GM1(config)#ip access-list extended bypass
GM1(config-ext-nacl)#deny ip 10.1.1.0 0.0.0.255 10.1.101.0 0.0.0.255
GM1(config)#crypto map cisco 10
GM1(config-crypto-map)#match address bypass
|
GM1#ping 10.1.101.1 source 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.101.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/120/156 ms
|