VPN Series 5: detailed configuration of multipoint Gre Over Ipsec

VPN Series 5: detailed configuration of multipoint Gre Over Ipsec

 

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2543P0-0.jpg "/>

 

Routerios version:

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254H47-1.jpg "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254I04-2.jpg "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2543557-3.jpg "/>

The command results are slightly different because of different versions, but the vpn deployment effect is the same.

The first way

1. Configure the network

Shanghai ------- internet ------ nanjing

|

Wuxi

1) connect routes and configure Default routes

Ip route 0.0.0.0 0.0.0.0 200.0.10.1

Ip route 0.0.0.0 0.0.0.0 200.0.20.1

Ip roue 0.0.0.0 0.0.0.0 200.0.30.1

200.0.10.1, 200.0.20.1, and 200.0.30.1 are the wan interface addresses of the simulated internet, that is, the default gateway addresses.

2) After the routes are interconnected, the tunnel configuration can be up. Otherwise, even the dynamic routing protocol configured later cannot be the uptunnel port, which is very important.

 

2. Configure interface tunnel

Two tunnels are created and connected to the peer end respectively. This is one of the major differences from a single gre.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544020-4.jpg "/>

3. Configure crypto isakmp policy

The configuration here mainly involves encryption parameters. Each peer must be consistent. Otherwise, a vpn negotiation failure will occur.

The main parameters are:

Hash

Authentication

Group

Encryption

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254D96-5.jpg "/>

4. Configure crypto isakmp key

The pre-shared keys of each peer must be consistent among each peer. Otherwise, authentication errors may occur; because multiple sites are connected, the peer address is configured as 0.0.0.0 0.0.0.0, which indicates any address.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544Z5-6.jpg "/>

5. Configure crypto ipsec transform-set

Configure the ipsec conversion set, which is mainly used to encrypt data and must be consistent among peers;

There are two encryption methods in ipsec: a, AH (authentication header) B, ESP encapsulation)

Here we use the esp method, and the encryption format is des;

There are three symmetric encryption technologies in vpn: a, des B, 3des c, and aes.

There are two hash function technologies in vpn: a, md5 B, and sha.

Here we use the md5 function;

Ipsec has two transmission modes: a and transport. B. tunnel)

Because we have already used the gre technology, we only use the transport mode here.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541244-7.jpg "/>

6. Configure interesting traffic

Similar to a single gre ipsec vpn, it creates a stream of interest and encrypts the traffic.

Here, two ACLs are created, matching tunnel0 and tunnel1 respectively, which both encrypt traffic from shanghai to nanjing and from shanghai to wuxi.

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541545-8.jpg "/>

7. Configure crypto map

Here, an encryption ING Group is created, which contains two clauses matching nanjing and wuxi. Except for the conversion set, the other parameters are different. This is also very important and cannot be set with an error, you can set the name to be easily identified to facilitate distinction and troubleshooting.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541362-9.jpg "/>

8. show result

After the configuration is completed, you can see that the routes between sites are interconnected and the adjacent links are established.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25430H-10.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2543093-11.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2542051-12.jpg "/>

You can view the route table at the hub site to view the route. Therefore, GRE is successfully configured.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544c2-13.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25452N-14.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2542649-15.jpg "/>

Here, we will check the vpn encryption in the first phase. vpn tunnels have been established for each site.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254D43-16.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254I55-17.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2545Y5-18.jpg "/>

View the encryption and decryption data packets on the hub. We can see that two vpn connections have been established, and the encryption and decryption data packets are normal.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2545G3-19.jpg "/>

It is normal for two branch sites to encrypt and decrypt data

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544216-20.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25453N-21.jpg "/>

Check the vpn tunnel creation status. The status is up-active, so it is successful.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2542018-22.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254ED-23.jpg "/>

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2542322-24.jpg "/>

 

--------------------------------------------------------------------------

--------------------------------------------------------------------------

The secondary way

1. Configure the network

Omitted

2. Configure interface tunnel

Create a tunnel port and set the key between the tunnel interfaces to 123 tunnel key as the optional parameter, depending on your situation). However, the tunnel key must be consistent among sites; otherwise, tunnel fails.

Configuration optimization parameters, such as the ip address mtu and delay, are generally done after the complete configuration.

Ip mtu: The maximum transmission unit of ip data packets, which is generally set to 1400.

Delay: latency, depending on the application

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2546394-25.png "/>

3. Configure crypto isakmp policy

Configure an isakmp Policy

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25422b-26.png "/>

4. Configure crypto keyring

Configure a key ring

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25411T-27.png "/>

5. Configure crypto isakmp profile

Associate the key ring with peer. Because multiple sites are connected, 0.0.0.0 0.0.0.0 is used to represent any site.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541406-28.png "/>

6. Configure crypto ipsec transform-set

Configure the conversion set. Because the gre tunnel is created, the mode is also selected as the transmission mode.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254E09-29.png "/>

7. Configure crypto ipsec profile

Configure the ipsec profile associated with the conversion set and isakmp-profile.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2543404-30.png "/>

8. Configure ip nhrp and mgre

The two key parameters here are the configuration commands that are quite different from those of the first way and the most important commands.

Mgre multi-point gre) and nhrp Next Hop Resolution Protocol)

Mgre supports one hub site) connecting multiple spoken branch sites at the same time), establishing a vpn tunnel, and supporting hub center sites) as static ip addresses, each spoken branch site) can use dynamic ip addresses.

Nhrp is mainly used for Address Mapping (Address image) and Resolution (Address Resolution) to help the Hub understand the real Address and Dynamic Address of Tunnel Destination between Layer 2/3 and Spoke.

Main commands:

Ip nhrp authentication // configure the nhrp authentication Key

Ip nhrp network-id // configure the nhrp network number

Ip nhrp map // configure nhrp ing, mainly for the ing between the tunnel ip address of the central site and the Internet port ip address of the central site

Ip nhrp, which needs to be configured on the website of the ISP, and is mapped to the tunnel ip address of the site.

9. tunnel protection ipsec profile

This command is mainly used to enable ipsec on the tunnel port, which is similar to crypto map.

10. show result

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2545J1-31.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254D25-32.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J254I50-33.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25454R-34.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541B4-35.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2546062-36.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2545142-37.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541c8-38.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2542510-39.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25461a-40.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544948-41.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2544234-42.png "/>

View the vpn status between sites, all of which are up-active. The vpn is successfully deployed.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2545495-43.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2541B8-44.png "/>

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J2546141-45.png "/>

Packet Capture analysis: the data between sites has been encrypted by esp, so vpn implementation is successful.

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0J25454A-46.png "/>

 

Bytes ---------------------------------------------------------------------------------------------

Bytes ---------------------------------------------------------------------------------------------

Conclusion:

 

The differences between the two configurations are as follows:

 

1) The first way is a VPN in a policy mode. encryption is performed only when the desired stream is met, while the second way is a VPN in a routing mode, add traffic to the tunnel to encrypt the traffic.

2) The first way needs to configure the encryption ing crypto map on the physical interface that passes through the GRE tunnel), while the second way does not need encryption ing. The ing of method 2 is learned by yourself, this reduces the number of configuration entries in the command line.

3) The first way will establish SA only when there is traffic to be protected, and the second way will establish SA even if there is no traffic.

4) the GRE survival mechanism keepalive can be configured on the first way interface. The second way does not support the GRE survival mechanism.

 

This article is from the "server & security" blog, please be sure to keep this source http://ciscoart.blog.51cto.com/1066670/854400