"Mert a csomagok sosem hazudnak."

iWAN – IPSec

Következzen az IPSec konfiguráció.

MPLS VRF routerek:

crypto keyring KEYRING vrf MPLS
 pre-shared-key address 0.0.0.0 0.0.0.0 key KEY
crypto isakmp policy 10
 encr 3des
 authentication pre-share
crypto isakmp profile ISAKMP-PROFILE
 keyring KEYRING
 match identity address 0.0.0.0 MPLS
 local-address XXXXXX
crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac
 mode tunnel
crypto ipsec profile IPSEC-PROFILE
 set transform-set esp-3des-sha
 set isakmp-profile ISAKMP-PROFILE
!
!
interface Tunnel1
 tunnel protection ipsec profile IPSEC-PROFILE

INET VRF routerek:

crypto keyring INETKEYRING vrf INET
 pre-shared-key address 0.0.0.0 0.0.0.0 key INETKEY
crypto isakmp policy 20
 encr 3des
 authentication pre-share
crypto isakmp profile INET-ISAKMP-PROFILE
 keyring INETKEYRING
 match identity address 0.0.0.0 INET
 local-address xxxx
crypto ipsec transform-set INET-TS esp-3des esp-sha-hmac
 mode tunnel
crypto ipsec profile IPSEC-PROFILE-INET
 set transform-set INET-TS
 set isakmp-profile INET-ISAKMP-PROFILE
int tu2
tunnel prot ipsec prof IPSEC-PROFILE-INET

EIGRP neighborshipek megvannak:

R2#sh ip eigrp ne | i Tunnel
4 192.168.200.2 Tu1 14 4d22h 5 100 0 38
3 192.168.200.3 Tu1 13 4d22h 4 100 0 29
R3#sh ip eigrp ne | i Tunnel
3 192.168.201.3 Tu2 10 00:02:47 13 100 0 33
4 192.168.201.2 Tu2 12 00:04:03 24 144 0 40
R3#

IKE ellenőrzés:

R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
172.18.200.1 172.18.202.1 QM_IDLE 1011 ACTIVE
172.18.200.1 172.18.204.1 QM_IDLE 1012 ACTIVE
IPv6 Crypto ISAKMP SA
R2#

IPSec ellenőrzése (encrypt-decrypt nem 0)

R2#sh crypto ipsec sa
interface: Tunnel1
 Crypto map tag: Tunnel1-head-0, local addr 172.18.200.1
protected vrf: (none)
 local ident (addr/mask/prot/port): (172.18.200.1/255.255.255.255/47/0)
 remote ident (addr/mask/prot/port): (172.18.202.1/255.255.255.255/47/0)
 current_peer 172.18.202.1 port 500
 PERMIT, flags={origin_is_acl,}
 #pkts encaps: 92125, #pkts encrypt: 92125, #pkts digest: 92125
 #pkts decaps: 92149, #pkts decrypt: 92149, #pkts verify: 92149

A következő részben már a PfRv3 konfig jön. 🙂

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.