在Cisco路由器上配置VRF-aware IPsec VPN详解

首先是建立ISAKMP 策略:,crypto isakmp policy 10,authentication pre-share,group 2,!,在配置过程中,我们可以在八个VRF中使用相同的元素,因此只需要建立一个ISAKMP 策略。接下来建立crypto ACL 以及一个 IPsec transform set。,ip access-list extended VPN,permit ip 10.0.100.0 0.0.0.255 10.0.1.0 0.0.0.255,crypto ipsec transform-set VPN-TRANS esp-aes esp-sha-hmac.,接下来是建立 pre-shared key。在本例中我曾经使用过一个keyring 作为 预共享 key,因此我直接将其绑定到 VRF即可。,crypto keyring POD1keys vrf POD1,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD2keys vrf POD2,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD3keys vrf POD3,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD4keys vrf POD4,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD5keys vrf POD5,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD6keys vrf POD6,pre-shared-key address 192.168.1.2 key cisco123,crypto keyring POD7keys vrf POD7,pre-shared-key address 192.168.1.2 key cisco123,pre-shared-key address 192.168.1.2 key cisco123,!,接下来建立 crypto-maps.,!,crypto map pod1 10 ipsec-isakmp,set peer 192.168.1.2,set transform-set VPN-TRANS,set pfs group2,match address VPN,!,crypto map pod2 10 ipsec-isakmp,set peer 192.168.1.2,set transform-set VPN-TRANS,set pfs group2,match address VPN,!,crypto map pod3 10 ipsec-isakmp,set peer 192.168.1.2,set transform-set VPN-TRANS,

之前通过场景实例向大家展示了用Virtual Routing and Forwarding (VRF,虚拟路由转发)将一个路由器分割成八个虚拟路由器的方法。当时我向大家演示了如何配置VRF,在本文中我们继续使用这个场景,并通过IPsec配置,将完全一致的拓扑结构和地址复制到八个实验环境。整个环境能够顺利进行,首先需要带有ASA的虚拟路由与Cisco 路由器建立VPN。这需要 VRF参与的IPsec。因此我需要一种方法能够实现完全一致的 isakmp 策略,一致的pre-shared keys, 一致的 crypto ACL, 也就是每个 VRF上的参数一致。实际的配置过程可能比我们想像的简单一些。下面我就来举例说明整个过程。

本文引用地址:http://www.eepw.com.cn/article/154891.htm

首先是建立ISAKMP 策略:

!

crypto isakmp policy 10

encr aes 256

authentication pre-share

group 2

!

在配置过程中,我们可以在八个VRF中使用相同的元素,因此只需要建立一个ISAKMP 策略。接下来建立crypto ACL 以及一个 IPsec transform set。

ip access-list extended VPN

permit ip 10.0.100.0 0.0.0.255 10.0.1.0 0.0.0.255

crypto ipsec transform-set VPN-TRANS esp-aes esp-sha-hmac.

接下来是建立 pre-shared key。在本例中我曾经使用过一个keyring 作为 预共享 key,因此我直接将其绑定到 VRF即可。

crypto keyring POD1keys vrf POD1

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD2keys vrf POD2

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD3keys vrf POD3

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD4keys vrf POD4

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD5keys vrf POD5

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD6keys vrf POD6

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD7keys vrf POD7

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD8keys vrf POD7

pre-shared-key address 192.168.1.2 key cisco123

!

接下来建立 crypto-maps.

!

crypto map pod1 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod2 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod3 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod4 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod5 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod6 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod7 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

set isakmp-profile pod7

match address VPN

!

crypto map pod8 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

一旦 crypto-maps 被合并到一起,就可以应用到接口上了。

interface FastEthernet0/0.1

crypto map pod1

!

interface FastEthernet0/0.2

crypto map pod2

!

interface FastEthernet0/0.3

crypto map pod3

!

interface FastEthernet0/0.4

crypto map pod4

!

interface FastEthernet0/0.5

crypto map pod5

!

interface FastEthernet0/0.6

crypto map pod6

!

interface FastEthernet0/0.7

crypto map pod7

!

interface FastEthernet0/0.8

crypto map pod8

!

,set pfs group2,match address VPN,!

原创文章,如若转载,请注明出处:http://www.shwuzhen.com/gou/377.html

联系我们

13810578059

在线咨询:点击这里给我发消息

邮件:88628738@qq.com

合作方式:网站转让、SEO优化、网站跳转