在部署IPSec ×××时,经常会遇到内网地址重叠的现象,比如一家公司将另外一家收购之后,两家公司的内网地址都是同一网段,如果使用普通的方式实现IPSec ×××,那么工程师就需要将兼并公司的内网地址进行重新的规划,这样对于网络管理增加了难度,下面需要使用NAT技术与IPSec技术,在不改变内网地址结构的情况下,实现IPSec ×××。
本文档通过下面的实例来讲述其配置过程,具体网络结构如下拓扑图所示。
在这种网络环境下,需要互联相同地址段的内网,就需要在IPSec ×××隧道中采用NAT对地址做转换,对于总公司来说,需要将分公司的内网网段转换为10.1.1.0/24,对于分公司来说,需要将总公司的内网网段转换为10.2.2.0/24
通过在×××隧道中启用NAT,当总公司访问分公司的内网资源时,目的IP网段为10.1.1.0/24;当分公司访问总公司的内网资源时,目的IP网段为10.2.2.0/24。
通过在隧道内进行NAT地址转换实现地址重叠环境下的IPSec ×××互联,NAT转换只用在一台路由器上做设置。
ip nat inside source static network 192.168.1.0 10.2.2.0 /24
ip nat outside source static network 192.168.1.0 10.1.1.0 /24
将总公司的内网换成10.2.2.0/24,分公司的内网换成10.1.1.0/24,当总公司访问分公司时,源地址为192.168.1.0/24,目的地址为10.1.1.0/24;当分公司访问分公司时,源地址为192.168.1.0/24,目的地址为10.2.2.0/24。
具体如下所示:
RA#sh running-config
Building configuration...
Current configuration : 1365 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RA
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
ip cef
!
!
crypto isakmp policy 110
hash md5
authentication pre-share
crypto isakmp key 123 address 99.9.9.10
!
!
crypto ipsec transform-set vpn esp-des esp-md5-hmac
!
crypto map map1 10 ipsec-isakmp
set peer 99.9.9.10
set transform-set vpn
match address 110
!
!
interface FastEthernet0/0
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex half
!
interface Serial1/0
ip address 99.9.9.9 255.255.255.252
ip nat outside
ip virtual-reassembly
serial restart-delay 0
crypto map map1
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip route 10.1.1.0 255.255.255.0 Serial1/0
no ip http server
no ip http secure-server
!
!
ip nat inside source static network 172.16.1.0 10.2.2.0 /24
ip nat outside source static network 172.16.1.0 10.1.1.0 /24
!
logging alarm informational
access-list 110 permit ip 10.2.2.0 0.0.0.255 172.16.1.0 0.0.0.255
!
!
control-plane
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
RB#sh running-config
Building configuration...
Current configuration : 1166 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RB
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
ip cef
!
!
crypto isakmp policy 110
hash md5
authentication pre-share
crypto isakmp key 123 address 99.9.9.9
!
!
crypto ipsec transform-set vpn esp-des esp-md5-hmac
!
crypto map map1 10 ipsec-isakmp
set peer 99.9.9.9
set transform-set vpn
match address 110
!
!
interface FastEthernet0/0
ip address 172.16.1.1 255.255.255.0
duplex half
!
interface Serial1/0
ip address 99.9.9.10 255.255.255.252
serial restart-delay 0
crypto map map1
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip route 10.2.2.0 255.255.255.0 Serial1/0
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
access-list 110 permit ip 172.16.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!
!
!
control-plane
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
RA#ping 10.1.1.1 source 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 144/211/272 ms
RA#ping 10.1.1.1 source 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 112/181/308 ms
RA#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
99.9.9.10 99.9.9.9 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
RA#sh crypto ipsec sa
interface: Serial1/0
Crypto map tag: map1, local addr 99.9.9.9
protected vrf: (none)
local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
current_peer 99.9.9.10 port 500
PERMIT, flags={origin_is_acl,ipsec_sa_request_sent}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 99.9.9.9, remote crypto endpt.: 99.9.9.10
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
current outbound spi: 0x4E5895BC(1314428348)
inbound esp sas:
spi: 0x7110C730(1896924976)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, crypto map: map1
sa timing: remaining key lifetime (k/sec): (4424986/3587)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x4E5895BC(1314428348)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, crypto map: map1
sa timing: remaining key lifetime (k/sec): (4424986/3586)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
RB#ping 10.2.2.1 source 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 120/196/224 ms
RA#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
--- --- --- 10.1.1.1 172.16.1.1
--- --- --- 10.1.1.0 172.16.1.0
icmp 10.2.2.1:0 172.16.1.1:0 10.1.1.1:0 172.16.1.1:0
icmp 10.2.2.1:1 172.16.1.1:1 10.1.1.1:1 172.16.1.1:1
icmp 10.2.2.1:2 172.16.1.1:2 10.1.1.1:2 172.16.1.1:2
icmp 10.2.2.1:3 172.16.1.1:3 10.1.1.1:3 172.16.1.1:3
icmp 10.2.2.1:4 172.16.1.1:4 10.1.1.1:4 172.16.1.1:4
icmp 10.2.2.1:5 172.16.1.1:5 10.1.1.1:5 172.16.1.1:5
icmp 10.2.2.1:8 172.16.1.1:8 10.1.1.1:8 172.16.1.1:8
icmp 10.2.2.1:9 172.16.1.1:9 10.1.1.1:9 172.16.1.1:9
icmp10.2.2.1:10 172.16.1.1:10 10.1.1.1:10 172.16.1.1:10
--- 10.2.2.1 172.16.1.1 --- ---
--- 10.2.2.0 172.16.1.0 --- -