1.VPN实验 L2LVPN高级特性-Work Blog

05c0
CCSP VPN 实验
作者：现任明教教 ℃
明教荣誉出品
0
现任朗教教主 VPN 实验
L2LVPNm.u5TLE
CCSPVPN 实验现任明教教主出品
L2LVPN 高级特性
· ISAKMP Profile
· ISAKMP Profile 运角。（高级）
· ISAKMP Profi oi 正认证管理（高级）
· ISAKMP 、 profile VRF 运用（高级）
· 动态地址 VPN 解决方案 $CCSPVPNN ISAKMP Profile ISAKMP Profile (1 ) The Internet Security Association and Key Management Protocol (ISAKMP) () profile offers configuration modularity for IKE phase 1 negotiations.\lt allows mapping of ISAKMP parameters to IPsec tunnels. Applications of the ISAKMP profile include MPLS VPN Configurations, router certificate management, and IPsec/QoS configurations. , ISAKMP VRF VPN, IPSec/QoSfidHo >$ CCSPVPNN
ISAKMP Profile
ISAKMP Profile (2)
ISAKMP profiles are commonly used when a device has
two or more IPsec tunnels requiring different phase I
parameters for different sites. The ISAKMP profile is also
commonly used with Easy VPN Remote configurations and
VRF-aware IPsec configurations.
<ISAKMP
ISAKMP Profile#jüdEEZVPN81VRF-ware IPSec VPNA:»
ISAKMP Profile
ISAKMP
ISAKMP Pronı.
ISAHMP p,ofilc 3
ccşPVPNN
SAKMP Prome 7
q-x'Ö. VPN 实验
ISAKMP Profile
CCSPVPN 实验现任明教教主出品
ISAKMP Profi | e 工作流程图 CCSPVPNN
ISAKMP Profile
ISAKMP (1)
hdYkeyring isakmp
crypto keyring L2Lkey
pre-shared-key address 61,3 28.1.1 key cisco
Hd%isakmp profile
crypto isakmp profile isaprof
keyring L2Lkey
match identity address 61.128.1.1 ISANMP QoSiäÅl
ISA MPProfile ISAKMP Profile QoSiZh4
1.1.1.0,'24
ite2 Traffic—.
ite3 Traffic—.
ite4 Traffic—.
202.100.1024
r
CCSPVPNN
.12.
.19
Action: Police
Action: Priority
Action:Shaping
2.2-2. CCSPVPNN
ISAKMP Profile QoSiZh4
ISAKMP Profile (1)
crypto keyring Site2.Key
pre-shared-key address 61.128.1.1 key
00
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile Site21ProfiIe
keyring Site2.Kev
match identity address 61.128.1.1 255.255.255.255
qos-group 2
ip access-list extended Site2.Traffic
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 CCSPVPNN
ISAKMP Profile QoSiZh4
ISAKMP Profile (2)
crypto ipsec transform-set cisco esp-des esp-Tld5-hmac
crypto map cisco 10 ipsec-isakmPi
set peer 61.128.1.1
set transform-set cisco
set isakmp-profile Site2.Profile
match address Site2.Traffic
interface FastEthemetO/O
ip address 202.100.1.1 255.255.255.0
crypto map cisco ISAKMP Profile QoSiZh4
1.1.1.0/24
ite
clæs-map match-an Site2. T
match qos-group 2
policy-map Mark
class Site2Traffic
set ip dscp 2
interface FastEthernetO/O
CCSPVPNN
QoS8ElJ&EH6
202.100 4.0/24
.10
•61.1
1.10
2.2.20/24
apG1atch-all SiteZ. Tramc
dscp 2
bel icy-map Oos
chss Site2.Trafic
police cir 8000
conform •action transmit
drop
ip address 202, 255.2552550
service-policy output Mark ISAKMP Profile QoSiZh4
crypto map cisco 10 ipsec-isakmp
CCSPVPNN
(2)
set peer 61.128.1.1
set transform-set cis
CO
40
match address Trafficl')lll. I .0/24 ÉIJ2.2.2.O/24iffiM )
crypto map cisco 20 ipsec-isakmp
set peer 61.128.1.1
set transform-set cisco
match address Trafficl (1.1.1.0/24 flJ3.3.3.O/24ifiM) VPN 实验
ISAKMP Profile 证二书认证管理
CCSPVPN 实验现任明教教主出品
ISAKMP profile
证认@管理（高级） VPNm
CCSPVPN"
ISAKMP Profile
ASAi11-tS
Status:
fertiticate
Certificate al
c,
host
i tel
cn•ȘiIg
start date:
CA
date:
Status:
Ceti ficat e G
RSR
cn•țR. iao.org
ou-•inqi
ou-.ing
Validitv date:
date;
end date: CCSPVPNN
ISAKMP Profile
Router ISAKMP Profileæm (1)
EH: cert maplGE#miE4$
crypto pki certificate map cert-control O
issuer-name eq cn = ca.mingjiao.org, ou = mingjiaobeijing
subject-narne eq hostname asa.mingjiao.org, cn = asa.mingjiao.org, o =
mingjiao, ou = mingjiaoasa>
crypto isakmp policy 10.
crypto isakmp identitydn
crypto isakmp profile isaprof
ca trust-point CA
certificate cert.control CCSPVPNN
ISAKMP Profile
Router ISAKMP (2)
ip access-list extended vpn
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.2
crypto ipsec transform-set ciscqesp-des esp-md5-hmac
crypto map cisco 10—-isakmÅ•
set peer 61.128.1.1
set transform-set cisa
set isakmp-profile isaprof
match address vpn
interface FastEthernetO/O
ip address 202.100.1.1 255.255.255.0
to ma cisco CCSPVPNN
ISAKMP Profile
ASA (1)
crypto ca certificate map DefaultCertificateMap I
issuer-name co ou = mingjiaobeijing
issuer-name co cn = ca.mingjiao.org
issuer-name co o *filingjiap
subject-name co o i"ngjiao
subject-name co ou = mingjiaositel
subject-name co cn = sitel.mingjiao.org
subject-name co hostname = sitel.mingjiao.org CCSPVPNN
ISAKMP Profile
ASA (2)
tunnel-group-map enable rules I ) )
( disable
no tunnel-group-map enable ou
"enable)
no tunnel-group-map enable Ik&id 3)
(ffÆike-idEMitunneI-group,
nuhenable)
no tunnel-group-map enable peer-ip
enable)
tunnel-group-map DefaultCertificateMap 10 202.100.1.1
( cert ) ISAKMP Profile
ASA
tunnel-group 202.100.1.1 type ipsec-121
tunnel-group 202.100.1.1 ipsec-attributes
trust-point CA
crypto isakmp enable Outside
crypto isakmp policy 10
authentication rsa-sig
encryption des
hash sha
group 1
lifetime 86400
CCSPVPNN
(3) CCSPVPNN
ISAKMP Profile
ASA (4)
access-list vpn extended permit ip 2.2.2.0.?55.255.255.0 1.1.1.0
255.255.255.0
crypto ipsec transform-set cisco esp-des esp-md5-hmac
crypto map cisco 10 match address vpn
crypto map cisco 10 set peer 202.100. I. I
crypto map cisco 10 set transform-set cisco
crypto map cisco 10 set trustpoint CA
crypto map cisco interface Outside ISAKMP vRFiå#I
ccspvpNg•
ISAKMPProfile VPN 实验
ISAKMP Profile VRF 运用
CCSPVPN 实验现任明教教主出品
实验拓扑
枥 00 ， 0 到 33 ， 3 冫，，冫．》 5 ， 0 CCSPVPNN
ISAKMP Profile VRFEÆ
ISAKMP Profile VRF (1)
crypto keyring Sitel
pre-shared-key address 202 100.1.3 kev@sa
crypto keyring Site2
pre-shared-key addresS202. .2 key cisco
crypto isakmp policy 10
authentication pre-share $VPN 实验念吧 VPN 决方案 CCSPVPN 实验现任明教教主出品动态地址 \/PN 解决方案方案一：动态 MAP VS ØSMAP 方案二：动态域解技术介绍完美解决方案方案三 0 EZVP N$ VPN 实验
z;/JöMAP VS YOMAP
CCSPVPN 实验现任明教教主出品
动态 MAP VS 静态 MAP
适用场合：
中心有固定丨 p 地址们疋分机构没有固
定 IP 地址的情 0 如果都是 CISCO 设备不
建议采用这个方案，建议使用 EZVPN 来解
决。如果不都是 CISCO 产品这是唯一的解
决办法，例如：中心是 CISCO 产品分支采
用的是 D-link VPN 产品，并且 D 丬 ink 没有固
定 IP 地址。 VS „,.MAP
1.1.1.0/24
hostname Center
r, nnaeo L ocpoacxo
202.1W1.0'24
.10
CCSPVPNN
a
2.220124
e
•i.128.1.
10
ipoddm-ss 1.1.1.1 255255
ip address n. 100.1.1 ass.asszsso
no
e route o.o.cooo.o.02021001.10
ip 202.100.1.10 255255.255.0
i' ütaco
aanss 61.128.1.'0 ass.2ss.2ss.o
dtrp VPN
netwoü 61 _ 12B.1.0
default-router 61.12B. I .10
Ettedece LogjbacLO
ip adWess 2.2.2.2 255.255.255.0
ip
no ShutdNt•. $VPN 实验 z;/JöMAP VS YOMAP CCSPVPN 实验现任明教教主出品 Center 端配置 crypto sakmp policy 10 authentication pre-share crypto Isakmp keyctsco addressO.OlO 000 ． 0 ； 0 。（由于远端地址为动态，所以只能使用丿 \ 个零的配置方式） crypto ipsec transform-set Cisco esp•des esp-md5-hmac crypto dynam ℃ -map d ap 10 settransform-set ℃ isco （由于不清楚对端地址，也不清楚感兴趣流，所以只配置转换集）（具体 peer 和感兴趣流协商决定） crypto map CISCO 1000 ipsec-lsakmp dynam ℃ dymap （动态 map 的 id 应该是最后一个，让明细 map 优先匹配） Interface FastEthemetO/O to ma cisco$ VS „,.MAP
CCSPVPNN
BranchjlYÆdY
crypto isakmp policy 10
authentication pre-share
crypto isakmpkey cisco address 202. 001.
ip access-list extended vpn
permit ip 2.2-2.0 0.0. -25
crypto ipsectransfo -setoscoesp-des esp-md5-hmac
crypto map ciscoäo ipsec-isakmp
set peer202.100.1.1
set transform-set Cisco
match address vpn
interface FastEthemet110 VPN 实验
z;/JöMAP VS YOMAP
CCSPVPN 实验现任明教教主出品
动态 MAP 技术问题分析
1 ℃ enter 不能主动向 Branch 发起连接，必须
要等 Branch 主动发起建立 VPN 以后，
C 。 nt 。 r 端网络 0 能防问 B 。。。 h 端网络。
2 ℃ enter*flBranch 间没有虚拟隧道接口，不
能够运行动态路由协议，所以动态 MAP 技
术只适用于网络环境比较简单的场合。 VPNæ 验
CCSPVPNN 埂任明教教主出品
以着 " 本介绍
动态鼕锉术
0 ，《级、部分） VPN 实验
态名仅木介绍
CCSPVPN 实验现任明教教主出品
动态域名解析技术介绍
为了解决动态 MAP 中心不能主动发起
的问题，我们可以采用动态域名 (DDNS)
技术。为每一个 Branch 端申请一个动态域
名，中心《把 peer 设置成为 Branch 的动
态域名来动发起连接。 VPNæ*
ip ddns update method nytest
CCSPVPNN
add http: //*PZ : d
dns&hos
interval maximum 28 0 0 0
00.
interface Dialerl
ip ddns update hostn
ip ddns update members. dyndns. org
CiscoBfi%DDNS":
http://www.cisco.com/en/US/docs/ios/12_3112_3y112_3ya8/gt_ddns. html VPNæ*
CCSPVPNN
IPSec
ip name-server 202.106.0.20
crypto isakmp key d cisco 61.149.0.0 255.255.0.0
crypto isakmp key cisco 222.129.0.0 255.255.0.0
crypto map cisco 5 ipsec-isakmp
set peer dynamic
set transform-set cisco
match address vpn VPN 实验
EZVPN 几夫力案
EZVPN?E
CCSPVPN 实验现任明教教主出品
。（ 0 级 ' 部分） VPN"
EZVPN
Tunnel Source 1.1.1.1
LOIOO:I.I.I
202.10i.G24
GREBE
:to.1.1.ot24
en
.10
CCSPVPN"
unnel Source 2.222
Lol 00:2.2.2.2/32
61.128.1.0124
DHCP ra
Loo:192.168.1
HIEZVPFUXII)IGRE Over IPSec VPN 实验
EZVPN 几夫力案
0 00 ，，，．，．， · ， 255 ． 255 ． 255 ． 255
俨 0m0n0
0 •d 衡 0 、、 202 ． O ， 0 55 ． 255 ． 255 到
巧》的 00 ℃ ℃ 00 ℃ ℃ 却 Zl 凹斗 10
CCSPVPN 实验现任明教教主出品
实验拓扑
跹 ' Fast 臼 ' 地崆 0
0 e 然） 2.1 》． 1 腼 25 ，冫 55 是 55
“ 山 0 ” 61 ， 12 & 1 ， 10 2 弱，冫《 5 550
山 v 以 >OIVP 、
《地和 1 ：咽． 1 ℃ 2 卜 5 25 卜 2 ，， 0
。地地凵@0家鲈 6 ， 0 湖， 1 ，， 0
0 《」 00 ，．到 0 ．， 255@255皇55囤
0 以 d00 2 冫 2 2 255 ． 255 ． 255 丿 55 CCSPVPNN
Centerji%EZVPNæn (1)
aaa new-model
aaa authentication login noacs line none.
line con O
login authentication noacS
line aux O
login authentication noack
aaa authentication login remote local
usemame ezvpnuser password O cisco
aaa authorization network remote local
ip access-list extended split-tunnel
permit ip host 1.1.1.1 any CCSPVPNN
Centerji%EZVPNæn (2)
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp clieryi configuration group ezvpngroup
key cisco
acl split-tunnel
save-password
crypto isakmp profile isaprof
match identity group ezvpngroup
client authentication list remote
isakmp authorization list remote
client configuration address respond CCSPVPNN
Centerji%EZVPNæn (3)
crypto ipsec transform-set cisco esp-des esp-md5-hmac
crypto dynamic-map dymap I
set transform-set cisco
crypto map cisco 1000 ipsec-isakmp dynamic dymap
interface FastEthernet0/O
ip address 202.100.1.1 255.255.255.0
crypto map cisco CCSPVPNN
Branchji%EZVPNæn
crypto ipsec client ezvpn cisco
connect auto
group ezvpngroup key cisco
mode network-extension
peer 202.100.1.1 2å$DDNS)
usemame ezvpnuser password cisco
interface FastEthernetI/O
ip address dhcp
crypto ipsec client ezvpn cisco
interface Loopbackl 00
ip address 2.2.2.2 255.255.255.255
crypto ipsec client ezvpn cisco inside CCSPVPNN
MIPSec VPNVUE
Branch#show crypto session
Crypto session current status
Interface: FastEthernetI/O
40
Session status: UP-ACTIVE
Peer: 202.100.1.1 port 500
IKE SA: local 61.128, 1.2/500 remote 202.100.1.1/500 Active
IPSEC FLOW: permit ip host 2.2.2.2 host 1.1.1.1
Active SAS: 2, origin: crypto map CCSPVPNN
GRE
Center*GRE TunnelEft:
interface TunnelO
ip address 123.1.1.1 255.25525"
tunnel source 1.1.1.1
tunnel destination .2.2.?Y
Branch*GRE
interface TunnelO
ip address 123.1.1.2 255.255.255.0
tunnel source 2.2.2.2
tunnel destination 1.1.1.1 CCSPVPNN
router ospf 1
network 10.1.1.0 0.0.0.255 area O
network 123.1.1.0 0.0.0.255 area O
Center#show ip route ospf
192.168.1.0/32 is subnetted, subnets
router ospf 1
network 123.1.1.0 0.0.0.255 area O
network 192.168.1.0 0.0.0255 area O
Branch#show ip route ospf
10.0.0.0/32 is subnetted, 1 subnets VPNæ*
CCSPVPNN
1.1.1.0'24
ip accesS-bsi extended PA
permit VI :1.1 98.00255 any
ip
rce list PAT interface FastEthernetO/O overload
interface FastEthernetOtO
ip address 202.100.1.1 255255255.0
ip nat Outside
LOOPbackO
iP address 1.1.1.1 255.255255.0
ip nat inside VPNæ*
ID Interface
E.wa
IPsec DfS.0S
IKE
Siter•øing 2.2.2.2 so 1.1.1.1
escape Se.•enCe to
Sending S. IWbvte ICW 2 Z.
ort.
sent •ith a
S.«cess rate is tier-cent
Sitel"
1 (1.1.1.1) host
10 Interface I
1 vae,'0
IPsec
IKE
CCSPVPNN
202 101.1
?02.100.1.1
e 282.101.1
is 2 seconds:
e rcv
le rcv from
202
202_100.1.1
.10
ic:o 1.1;6
1,1.1T6
2.2.2.2:6 VPNæ*
CCSPVPNN
NAT Order of O eration
• - CET
PSE
• check
• TCP
• NAT
•
• TCP VPN 实验
NATÅ'JVPNtT•JW*!
1 · 1 · 1.0124
CCSPVPN 实验现任明教教主出品
解决方案
access-list
n 疒 PI ， 1 ， 1 ． 00 ． 0 ． 0 ． 2 60 0 ． 2 弱（ Deny 掉感兴流，让感兴流不转換）
permit 巾 1 1.00 甲 any
list PAT interface FastEthemetO/O OV 《 oad
吡 t 地 e
"IMace FastEthernetO/O
巾 address 202 · 1 ． 1 ． 1 255 ． 255 ． 255 · 0
巾 nat Outside
“ f “ eL 闐凶 a 0
巾 address 1.1 ． 1 ． 1 25 & 25 2 ． 0
巾 nat tnside VPNæ*
CCSPVPNN
Additionally, multiple Cisco IOS software features can be
configured directly on the tunnel interface and on the
physical egress interface of the tunnel interface. This direct
configuration allows users to have solid control on the
application of the features in the pre- or post-encryption path.
"Cisco $C:\678AEA65\5A642C47-E758-4EA6-B7BF-CDE1D9027492.files\image069.png$ VPNæ*
CCSPVPNN
Sitel SVTlæn (1)
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 61 1281k. I
crypto ipsec transform-set cisco esp-des esp-md5-hmac
crypto ipsec profile ipsecprof
set transform-set cisco VPNæ*
CCSPVPNN
Sitel SVTlæn (2)
interface TunnelO
ip address 172.16.12.1 255.255.2550
tunnel source 202.100.1.1
tunnel destination 61.128.4."
CO
tunnel mode ipsedipva (81GRE over IPSec$JßE
tunnel protection ipsee profile ipsecprof
router ospf I
network 1.1.1.0 0.0.0.255 area O
network 172.16.12.0 0.0.0.255 area O
—X}IJ) VPN 实验
SVT 》坟小丌
CCSPVPN 实验现任明教教主出品
SV 刊配置示意图
貊@，鬢01 驴 0 种》
气@貊以 ' 性炖 0 满《 0 ， 02 过．，
、 0 ，，， ℃ 000 丿 0000
艹， 0 和是 0 0 丿、、地然， 0
《， 0 过，，：就 1 0
n 00 》 22 ℃ 00 0 冫、 5 0 0 0
' 在 0 枞， 72 020000 冫 0 》 0