一、【组网和实验环境】
按如上的接口ip先作配置，再作ipsec的相关配置，配置文本见文章最后
本文实验采用的交换机是H3C模拟器，下载地址如下：http://forum.h3c.com/forum.php?mod=viewthread&tid=109740&highlight=H3C%E6%A8%A1%E6%8B%9F%E5%99%A8 有兴趣的朋
友可以在论坛上去下载。
二、【ipsec sa 建立分析】
配置完成后作如下的的debugging 分析
[R1]dis ipsec sa
===============================
Interface: Serial0/6/0
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "map1"
sequence number: 10
mode: isakmp
-----------------------------
connection id: 3
encapsulation mode: tunnel
perfect forward secrecy: None
tunnel:
local address: 2.2.2.1
remote address: 2.2.3.1
Flow :
sour addr: 10.1.1.1/255.255.255.255 port: 0 protocol: IP
dest addr: 10.1.2.1/255.255.255.255 port: 0 protocol: IP
[inbound ESP SAs]
spi: 3180831459 (0xbd97a2e3)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1
sa remaining key duration (bytes/sec): 1887436464/3582 安全联盟剩余的存活时间
max received sequence-number: 4
udp encapsulation used for nat traversal: N
[outbound ESP SAs]
spi: 3790725279 (0xe1f1e09f)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1
sa remaining key duration (bytes/sec): 1887436464/3582
max sent sequence-number: 5
udp encapsulation used for nat traversal: N
[R1] dis ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
2 2.2.3.1 RD 2 IPSEC
1 2.2.3.1 RD 1 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
[R2]dis ipsec sa
===============================
Interface: Serial0/6/0
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "use1"
sequence number: 10
mode: isakmp
-----------------------------
connection id: 3
encapsulation mode: tunnel
perfect forward secrecy: None
tunnel:
local address: 2.2.3.1
remote address: 2.2.2.1
Flow :
sour addr: 10.1.2.1/255.255.255.255 port: 0 protocol: IP
dest addr: 10.1.1.1/255.255.255.255 port: 0 protocol: IP
[inbound ESP SAs]
spi: 3790725279 (0xe1f1e09f)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1
sa remaining key duration (bytes/sec): 1887436464/3506
max received sequence-number: 4
udp encapsulation used for nat traversal: N
[outbound ESP SAs]
spi: 3180831459 (0xbd97a2e3)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1
sa remaining key duration (bytes/sec): 1887436464/3506
max sent sequence-number: 5
udp encapsulation used for nat traversal: N
[R2]
[R2]dis ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
3 2.2.2.1 RD|ST 2 IPSEC
2 2.2.2.1 RD|ST 1 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
2、debugging ipsec packet 查看包的收发情况
<R2>ping -a 10.1.2.1 10.1.1.1
PING 10.1.1.1: 56 data bytes, press CTRL_C to break
Request time out
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=4 ms
Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=10 ms
Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=26 ms
Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=20 ms
--- 10.1.1.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 4/15/26 ms
<R1>
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:--- Receive IPSec(ESP) packet ---收到数据包
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Src:2.2.3.1 Dst:2.2.2.1 SPI:1875259957(0x6fc63235) 发现源和目的
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:New ESP(RFC2406) Enc Alg:DES Auth Alg:HMAC-SHA1-96 安全协议、算法
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Replay Checking Enabled! SN:1 重放检测启用！ 序号1
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:ESP new input: Authentication succeed! 验证通过
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:IPSEC Task: Decryption succeed! 解密成功
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Tunnel mode. Org Src:10.1.2.1 Org Dst:10.1.1.1 发现内部加密码包的源和目的
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Now send it to IP input process...
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:--- Send IPSec packet --- 发回包
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Tunnel mode. Adding outer IP header succeed! 加IP封装
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Src:2.2.2.1 Dst:2.2.3.1 SPI:848486168(0x3292df18) 源和目的
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:New ESP(RFC2406) Enc Alg:DES Auth Alg:HMAC-SHA1-96 安全协议、算法
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Encryption finished! New ESP(RFC2406) SN:1 加密完成
*Feb 17 14:11:25:953 2013 R1 IPSEC/7/DBG:Now send it to IP output process...
发回包
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:--- Receive IPSec(ESP) packet ---
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Src:2.2.3.1 Dst:2.2.2.1 SPI:1875259957(0x6fc63235)
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:New ESP(RFC2406) Enc Alg:DES Auth Alg:HMAC-SHA1-96
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Replay Checking Enabled! SN:2
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:ESP new input: Authentication succeed!
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:IPSEC Task: Decryption succeed!
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Tunnel mode. Org Src:10.1.2.1 Org Dst:10.1.1.1
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Now send it to IP input process...
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:--- Send IPSec packet ---
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Tunnel mode. Adding outer IP header succeed!
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Src:2.2.2.1 Dst:2.2.3.1 SPI:848486168(0x3292df18)
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:New ESP(RFC2406) Enc Alg:DES Auth Alg:HMAC-SHA1-96
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Encryption finished! New ESP(RFC2406) SN:2
*Feb 17 14:11:26:156 2013 R1 IPSEC/7/DBG:Now send it to IP output process...
3、
ike propsal没有作任何的配置，但有一个default的IKE proposal
<R1> dis ike proposal
priority authentication authentication encryption Diffie-Hellman duration
method algorithm algorithm group (seconds)
---------------------------------------------------------------------------
default PRE_SHARED SHA DES_CBC MODP_768 86400
[R2]dis ike pro
priority authentication authentication encryption Diffie-Hellman duration
method algorithm algorithm group (seconds)
---------------------------------------------------------------------------
default PRE_SHARED SHA DES_CBC MODP_768 86400
三、【配置文本】
<R1>dis cu
#
version 5.20, Alpha 1011
#
sysname R1
#
password-control login-attempt 3 exceed lock-time 120
#
undo voice vlan mac-address 00e0-bb00-0000
#
ipsec cpu-backup enable
#
undo cryptoengine enable
#
domain default enable system
#
vlan 1
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
ike peer peer
pre-shared-key cipher PMEfbsX04vk=
remote-address 2.2.3.1
#
ipsec proposal tran1
esp authentication-algorithm sha1
#
ipsec policy map1 10 isakmp
security acl 3101
ike-peer peer
proposal tran1
#
acl number 3101
rule 0 permit ip source 10.1.1.1 0 destination 10.1.2.1 0
#
interface Serial0/6/0
link-protocol ppp
ip address 2.2.2.1 255.255.255.0
ipsec policy map1
#
interface Serial0/6/1
link-protocol ppp
#
interface Serial0/6/2
link-protocol ppp
#
interface Serial0/6/3
link-protocol ppp
#
interface NULL0
#
interface LoopBack0
ip address 10.1.1.1 255.255.255.255
#
interface Ethernet0/4/0
port link-mode bridge
#
interface Ethernet0/4/1
port link-mode bridge
#
interface Ethernet0/4/2
port link-mode bridge
#
interface Ethernet0/4/3
port link-mode bridge
#
interface Ethernet0/4/4
port link-mode bridge
#
interface Ethernet0/4/5
port link-mode bridge
#
interface Ethernet0/4/6
port link-mode bridge
#
interface Ethernet0/4/7
port link-mode bridge
#
ip route-static 0.0.0.0 0.0.0.0 Serial0/6/0
#
load xml-configuration
#
user-interface con 0
user-interface vty 0 4
#
return
<R2>dis cu
#
version 5.20, Alpha 1011
#
sysname R2
#
password-control login-attempt 3 exceed lock-time 120
#
undo voice vlan mac-address 00e0-bb00-0000
#
ipsec cpu-backup enable
#
undo cryptoengine enable
#
domain default enable system
#
vlan 1
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
ike peer peer
pre-shared-key cipher PMEfbsX04vk=
remote-address 2.2.2.1
#
ipsec proposal tran1
esp authentication-algorithm sha1
#
ipsec policy use1 10 isakmp
security acl 3101
ike-peer peer
proposal tran1
#
acl number 3101
rule 0 permit ip source 10.1.2.1 0 destination 10.1.1.1 0
#
interface Serial0/6/0
link-protocol ppp
ip address 2.2.3.1 255.255.255.0
ipsec policy use1
#
interface Serial0/6/1
link-protocol ppp
#
interface Serial0/6/2
link-protocol ppp
#
interface Serial0/6/3
link-protocol ppp
#
interface NULL0
#
interface LoopBack0
ip address 10.1.2.1 255.255.255.255
#
interface Ethernet0/4/0
port link-mode bridge
#
interface Ethernet0/4/1
port link-mode bridge
#
interface Ethernet0/4/2
port link-mode bridge
#
interface Ethernet0/4/3
port link-mode bridge
#
interface Ethernet0/4/4
port link-mode bridge
#
interface Ethernet0/4/5
port link-mode bridge
#
interface Ethernet0/4/6
port link-mode bridge
#
interface Ethernet0/4/7
port link-mode bridge
#
ip route-static 0.0.0.0 0.0.0.0 Serial0/6/0
#
load xml-configuration
#
user-interface con 0
user-interface vty 0 4
#
return
