IPsec VPN detailed--Static address

a.Static Address SettingsVPN1.Networking Requirements

as shown in figure 1-2, establish a secure tunnel between Router a and Router B, on the subnet where host a resides (10.1.1.0/ Data Flow from the subnet (10.1.2.0/24) where host B resides

Security.

Security Protocol Adoption ESP protocol, the encryption algorithm uses DES, the authentication algorithm uses sha1-hmac-96.

2.Group Network Diagram

650) this.width=650; "src=" Https://s5.51cto.com/oss/201711/20/6aeba2b4e86736459cdbb1794fdac4fa.png "title=" Qq20171120201905.png "alt=" 6aeba2b4e86736459cdbb1794fdac4fa.png "/>

3.Configuration Steps

(1) configuration Router A

# Configure an Access control list that defines the traffic that subnets 10.1.1.0/24 to subnet 10.1.2.0/24 .

<routera>system-view Enter system operation mode

[Routera]acl number 3101 establishes ACL deletion with name 3101 need to add undo before command

[Routera-acl-adv-3101]rule Permit IP source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 establish allow 10.1.1.0 Data Flow to 10.1.2.0

[Routera-acl-adv-3101]rule deny IP source any destination any prohibits other network segments from

[Routera-acl-adv-3101]quit

# Configure static routes to Host B .

[Routera]ip route-static 10.1.2.0 255.255.255.0 serial 2/1(out of Port)

# Create A security proposal called Tran1.

[Routera]ipsec Proposal Tran1

# The message package is in the form of tunnel mode.

[Routera-ipsec-proposal-tran1]encapsulation-mode Tunnel

# The security protocol uses the ESP protocol.

[Routera-ipsec-proposal-tran1]transform ESP

# Select the algorithm.

[Routera-ipsec-proposal-tran1]esp encryption-algorithm des(encryption algorithm)

[Routera-ipsec-proposal-tran1]esp Authentication-algorithm SHA1 (verification algorithm)

[Routera-ipsec-proposal-tran1]quit

# Configure the IKE peer.

[Routera]ike Peer RA

[Routera-ike-peer-peer]pre-share-key ABCDE(password)

[Routera-ike-peer-peer]remote-address 2.2.3.1(opposing IP)

# Create a security policy, negotiated as ISAKMP.

[Routera]ipsec Policy Map1 ISAKMP

# cite security proposals.

[Routera-ipsec-policy-isakmp-map1-10]proposal Tran1

# Reference access control list.

[Routera-ipsec-policy-isakmp-map1-10]security ACL 3101

# References IKE peers.

[Routera-ipsec-policy-isakmp-map1-10]ike-peer RA

[Routera-ipsec-policy-isakmp-map1-10]quit

# Configure the IP address of the serial port .

[Port of Routera]interface serial 2/1 External network

[Routera-serial2/1]ip address 2.2.2.1 255.255.255.0 extranet IP

# Apply the Security Policy group on the serial port.

[Routera-serial2/1]ipsec Policy Map1

(2) configuration Router B

# Configure an Access control list that defines the traffic that subnets 10.1.2.0/24 to subnet 10.1.1.0/24 .

<routerb>system-view

[Routerb]acl number 3101 establishing 3101 ACL removal requires an undo before the command

[Routerb-acl-adv-3101]rule Permit IP source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 allow 10.1.1.0 Network segment Access

[Routerb-acl-adv-3101]rule deny IP source any destination any deny other access

[Routerb-acl-adv-3101]quit

# Configure static routes to Host a .

[Routerb]ip route-static 10.1.1.0 255.255.255.0 serial 2/2 external network Port

# Create A security proposal called Tran1.

[Routerb]ipsec Proposal Tran1

# The message package is in the form of tunnel mode.

[Routerb-ipsec-proposal-tran1]encapsulation-mode Tunnel

# The security protocol uses the ESP protocol.

[Routerb-ipsec-proposal-tran1]transform ESP

# Select the algorithm.

[Routerb-ipsec-proposal-tran1]esp encryption-algorithm des validation algorithm

[Routerb-ipsec-proposal-tran1]esp authentication-algorithm SHA1 encryption algorithm

[Routerb-ipsec-proposal-tran1]quit

# Configure the IKE peer.

[Routerb]ike Peer Peer

[Routerb-ike-peer-peer] Pre-share-key ABCDE// Configure a preshared key that must be consistent with the peer

[Routerb-ike-peer-peer] remote-address2.2.2.1 // Configure peer-to-peer IP address, this address has been determined, do not modify

# Create a security policy, negotiated as ISAKMP.

[Routerb]ipsec Policy Use1 ISAKMP

# Reference access control list.

[Routerb-ipsec-policy-isakmp-use1-10]security ACL 3101

# cite security proposals.

[Routerb-ipsec-policy-isakmp-use1-10]proposal Tran1

# References IKE peers.

[Routerb-ipsec-policy-isakmp-use1-10]ike-peer Peer

[Routerb-ipsec-policy-isakmp-use1-10]quit

# Configure the IP address of the serial port .

[Routerb]interface serial 2/2 external network Port

[Routerb-serial2/2]ip address 2.2.3.1 255.255.255.0 extranet IP

# Apply the Security Policy group on the serial port.

[Routerb-serial2/2]ipsec Policy Use1

This article is from the "Garrett" blog, make sure to keep this source http://garrett.blog.51cto.com/11611549/1983593

IPsec VPN detailed--Static address