热门：华为支持参数分辨率解决方法控制属性启动升级错误平台推荐步骤模式查询运行空间文件夹鼠标图标重启激活联想检查状态应用程序

GRE over IPSEC路由配置

2023-03-21 21:52:17

GRE over IPSEC路由配置
GRE over IPSEC路由配置 r1(0/0)---r2--(1/1)r3 GRE over IPSEC先ipsec在gre解决了ipsec无法传递多播流量问题，即可以在ipsec中跑路由协议，而且协议是通过加密的！！R1:crypto isakmp policy 10 hash md5 authentication pre-sharecrypto isakmp key zaq address 2.3.0.1!!crypto ipsec transform-set vpn esp-des !crypto map vpn 10 ipsec-isakmp  set peer 2.3.0.1 set transform-set vpn  match address 101!!!!interface Tunnel0 ip address 1.3.0.1 255.255.255.0 tunnel source FastEthernet0/0 tunnel destination 2.3.0.1!interface Loopback0 ip address 1.1.1.1 255.255.255.255!interface Loopback1 ip address 10.0.0.1 255.255.255.0!interface FastEthernet0/0 ip address 1.2.0.1 255.255.255.0 duplex full crypto map vpn!router ospf 1 log-adjacency-changes!ip route 0.0.0.0 0.0.0.0 1.2.0.2!!access-list 101 permit gre host 1.2.0.1 host 2.3.0.1 R2:interface FastEthernet0/0 ip address 1.2.0.2 255.255.255.0 duplex full!         interface FastEthernet1/1 ip address 2.3.0.2 255.255.255.0 duplex full speed auto R3:crypto isakmp policy 10 hash md5 authentication pre-sharecrypto isakmp key zaq address 1.2.0.1!crypto ipsec transform-set vpn esp-des !crypto map vpn 10 ipsec-isakmp  set peer 1.2.0.1 set transform-set vpn  match address 101!interface Tunnel0 ip address 1.3.0.2 255.255.255.0 tunnel source FastEthernet1/1 tunnel destination 1.2.0.1!interface Loopback0 ip address 3.3.3.3 255.255.255.255!interface Loopback1 ip address 30.0.0.1 255.255.255.0!interface FastEthernet1/1 ip address 2.3.0.1 255.255.255.0 duplex full speed auto crypto map vpn!ip route 0.0.0.0 0.0.0.0 2.3.0.2!access-list 101 permit gre host 2.3.0.1 host 1.2.0.1 Router#show crypto engine connections active  ID Interface            IP-Address      State  Algorithm           Encrypt  Decrypt   1 FastEthernet1/1      2.3.0.1         set    HMAC_MD5+DES_56_CB        0        02001 FastEthernet1/1      2.3.0.1         set    DES                       0       272002 FastEthernet1/1      2.3.0.1         set    DES                      27        0Router#show crypto isakmp sadst             src             state          conn-id slot status1.2.0.1         2.3.0.1         QM_IDLE              1    0 ACTIVERouter#show crypto isakmp peers    Peer: 1.2.0.1 Port: 500 Local: 2.3.0.1 Phase1 id: 1.2.0.1Router#show crypto ipsec sainterface: FastEthernet1/1    Crypto map tag: vpn, local addr 2.3.0.1   protected vrf: (none)   local  ident (addr/mask/prot/port): (2.3.0.1/255.255.255.255/47/0)   remote ident (addr/mask/prot/port): (1.2.0.1/255.255.255.255/47/0)   current_peer 1.2.0.1 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 44, #pkts encrypt: 44, #pkts digest: 44    #pkts decaps: 44, #pkts decrypt: 44, #pkts verify: 44    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 1, #recv errors 0     local crypto endpt.: 2.3.0.1, remote crypto endpt.: 1.2.0.1     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/1     current outbound spi: 0xEAA8551D(3936900381)     inbound esp sas:      spi: 0x323BE771(842786673)        transform: esp-des ,        in use settings ={Tunnel, }        conn id: 2001, flow_id: 1, crypto map: vpn        sa timing: remaining key lifetime (k/sec): (4493451/2885)        IV size: 8 bytes        replay detection support: N        Status: ACTIVE     inbound ah sas:     inbound pcp sas:     outbound esp sas:      spi: 0xEAA8551D(3936900381)        transform: esp-des ,        in use settings ={Tunnel, }        conn id: 2002, flow_id: 2, crypto map: vpn        sa timing: remaining key lifetime (k/sec): (4493451/2884)        IV size: 8 bytes        replay detection support: N        Status: ACTIVE     outbound ah sas:     outbound pcp sas: 还有一种是ipsec over gre 个人认为没有意义，因为虽然解决了多播问题，但是多播是明文传输，所以ipsec就没有意义了，还不如直接用gre就好了！！ 
路由配置协议加密流量

推荐阅读