GRE over IPSEC路由配置

GRE over IPSEC路由配置
GRE over IPSEC路由配置 r1(0/0)---r2--(1/1)r3 GRE over IPSEC先ipsec在gre解决了ipsec无法传递多播流量问题，即可以在ipsec中跑路由协议，而且协议是通过加密的！！R1:crypto isakmp policy 10 hash md5 authentication pre-sharecrypto isakmp key zaq address 2.3.0.1!!crypto ipsec transform-set vpn esp-des !crypto map vpn 10 ipsec-isakmp  set peer 2.3.0.1 set transform-set vpn  match address 101!!!!interface Tunnel0 ip address 1.3.0.1 255.255.255.0 tunnel source FastEthernet0/0 tunnel destination 2.3.0.1!interface Loopback0 ip address 1.1.1.1 255.255.255.255!interface Loopback1 ip address 10.0.0.1 255.255.255.0!interface FastEthernet0/0 ip address 1.2.0.1 255.255.255.0 duplex full crypto map vpn!router ospf 1 log-adjacency-changes!ip route 0.0.0.0 0.0.0.0 1.2.0.2!!access-list 101 permit gre host 1.2.0.1 host 2.3.0.1 R2:interface FastEthernet0/0 ip address 1.2.0.2 255.255.255.0 duplex full!         interface FastEthernet1/1 ip address 2.3.0.2 255.255.255.0 duplex full speed auto R3:crypto isakmp policy 10 hash md5 authentication pre-sharecrypto isakmp key zaq address 1.2.0.1!crypto ipsec transform-set vpn esp-des !crypto map vpn 10 ipsec-isakmp  set peer 1.2.0.1 set transform-set vpn  match address 101!interface Tunnel0 ip address 1.3.0.2 255.255.255.0 tunnel source FastEthernet1/1 tunnel destination 1.2.0.1!interface Loopback0 ip address 3.3.3.3 255.255.255.255!interface Loopback1 ip address 30.0.0.1 255.255.255.0!interface FastEthernet1/1 ip address 2.3.0.1 255.255.255.0 duplex full speed auto crypto map vpn!ip route 0.0.0.0 0.0.0.0 2.3.0.2!access-list 101 permit gre host 2.3.0.1 host 1.2.0.1 Router#show crypto engine connections active  ID Interface            IP-Address      State  Algorithm           Encrypt  Decrypt   1 FastEthernet1/1      2.3.0.1         set    HMAC_MD5+DES_56_CB        0        02001 FastEthernet1/1      2.3.0.1         set    DES                       0       272002 FastEthernet1/1      2.3.0.1         set    DES                      27        0Router#show crypto isakmp sadst             src             state          conn-id slot status1.2.0.1         2.3.0.1         QM_IDLE              1    0 ACTIVERouter#show crypto isakmp peers    Peer: 1.2.0.1 Port: 500 Local: 2.3.0.1 Phase1 id: 1.2.0.1Router#show crypto ipsec sainterface: FastEthernet1/1    Crypto map tag: vpn, local addr 2.3.0.1   protected vrf: (none)   local  ident (addr/mask/prot/port): (2.3.0.1/255.255.255.255/47/0)   remote ident (addr/mask/prot/port): (1.2.0.1/255.255.255.255/47/0)   current_peer 1.2.0.1 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 44, #pkts encrypt: 44, #pkts digest: 44    #pkts decaps: 44, #pkts decrypt: 44, #pkts verify: 44    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 1, #recv errors 0     local crypto endpt.: 2.3.0.1, remote crypto endpt.: 1.2.0.1     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/1     current outbound spi: 0xEAA8551D(3936900381)     inbound esp sas:      spi: 0x323BE771(842786673)        transform: esp-des ,        in use settings ={Tunnel, }        conn id: 2001, flow_id: 1, crypto map: vpn        sa timing: remaining key lifetime (k/sec): (4493451/2885)        IV size: 8 bytes        replay detection support: N        Status: ACTIVE     inbound ah sas:     inbound pcp sas:     outbound esp sas:      spi: 0xEAA8551D(3936900381)        transform: esp-des ,        in use settings ={Tunnel, }        conn id: 2002, flow_id: 2, crypto map: vpn        sa timing: remaining key lifetime (k/sec): (4493451/2884)        IV size: 8 bytes        replay detection support: N        Status: ACTIVE     outbound ah sas:     outbound pcp sas: 还有一种是ipsec over gre 个人认为没有意义，因为虽然解决了多播问题，但是多播是明文传输，所以ipsec就没有意义了，还不如直接用gre就好了！！ 

相关内容