0x0

GRE over IPSEC配置实验

GRE over IPSEC企业异地组网搭配OSPF方案

简化的拓扑结构

      1. 配置链路基础互联。PC1/PC2配置静态IP，网关指向R1/R3的g0/0/2接口IP。
      #R1
sysname R1
int g0/0/0
 ip addr 12.0.0.1 24
int g0/0/2
 ip addr 192.168.1.254 24
ip route-static 23.0.0.0 24 12.0.0.2

#R2
int g0/0/0
 ip addr 12.0.0.2 24
int g0/0/1
 ip addr 23.0.0.2 24

#R3
int g0/0/1
 ip addr 23.0.0.3 24
int g0/0/2
 ip addr 192.168.2.254 24
ip route-static 12.0.0.0 24 23.0.0.2
      2. 配置R1-R3的GRE隧道
      #R1
int tun0/0/0
 ip addr 192.168.13.1 24
 tunnel-protocol gre
 source 12.0.0.1
 destination 23.0.0.3

#R3
interface Tunnel0/0/0
 ip addr 192.168.13.3 24
 tunnel-protocol gre
 source 23.0.0.3
 destination 12.0.0.1
      3. 配置IPSec相关
      #R1
#配置IPSec安全提议
ipsec proposal p1
 encapsulation-mode transport
 esp authentication-algorithm sha2-512
 esp encryption-algorithm aes-256

#配置IKE提议
ike proposal 1
 encryption-algorithm aes-cbc-256
 dh group14
 authentication-algorithm aes-xcbc-mac-96

#配置IKE对等体，调用IKE提议1
ike peer R3 v2
 pre-shared-key cipher huawei
 ike-proposal 1

#配置IPSec配置模板，调用上面的IKE对等体和IPSec安全提议
ipsec profile s1
 ike-peer R3
 proposal p1

#接口调用IPSec的配置模板
int tun0/0/0
ipsec profile s1

#R3,配置相同，对等体名称为了区别使用R1
      4. 配置OSPF并发布内网和虚拟隧道网段
      #R1
ospf 1 router-id 1.1.1.1
 area 0.0.0.0
  network 192.168.1.0 0.0.0.255
  network 192.168.13.1 0.0.0.0

#R3
ospf 1 router-id 3.3.3.3
 area 0.0.0.0
  network 192.168.2.0 0.0.0.255
  network 192.168.13.3 0.0.0.0

      测试结果正常

      More Posts