lo1----Cisco sw---------|FW1|-------------|FW2|------lo2 cisco sw接口ip:119.3.149.150 FW2接口ip:10.37.240.129 lo1：172.100.109.144 lo2: 11.37.1.1 感兴趣流：11.37.1.0/24------172.100.109.144/28 使用思科三层交换机型号WS-C3650-24PD，版本16.3.7 思科配置野蛮模式fqdn主动协商
思科配置： !第一阶段isakmp配置，加密模式和对端保持一致 crypto isakmp policy 30 encr aes 256 hash sha256 authentication pre-share group 2 lifetime 28800 ！配置对端isakmp peer和fqdn crypto isakmp peer address 10.37.240.129 set aggressive-mode password test set aggressive-mode client-endpoint fqdn cisco crypto isakmp keepalive 10 periodic ! !第二阶段ipsec配置，加密模式和对端设备保持一致 crypto ipsec transform-set dms esp-aes 256 esp-sha256-hmac mode tunnel no crypto ipsec nat-transparency udp-encapsulation ! !配置感兴趣流 ip access-list extended dms permit ip 172.100.109.144 0.0.0.15 11.37.1.0 0.0.0.255 ! !配置map,然后在接口调用 crypto map huaweicloud 30 ipsec-isakmp set peer 10.37.240.129 set transform-set dms match address dms ！接口配置 interface GigabitEthernet1/0/20 no switchport ip address 119.3.149.150 255.255.255.0 crypto map huaweicloud ! interface Loopback2 ip address 172.100.109.144 255.255.255.255 !路由 ip route 10.37.240.0 255.255.255.0 119.3.149.200
发起ipsec vpn协商 ping 11.37.1.1 source lo2
思科调试方法 show crypto isakmp sa detail 查看isakmp sa协商 show crypto isakmp sa detail Codes: C - IKE configuration mode, D - Dead Peer Detection K - Keepalives, N - NAT-traversal T - cTCP encapsulation, X - IKE Extended Authentication psk - Preshared key, rsig - RSA signature renc - RSA encryption IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.
1024 119.3.149.150 10.37.240.129 ACTIVE aes sha256 psk 2 07:59:55 D Engine-id:Conn-id = SW:24
协商成功状态为ACTIVE 清除第一阶段协商 clear crypto isakmp 删除所有isamkp协商 clear crypto isakmp +id号 删除指定isamkp协商，如上所示id号为1024
Show crypto ipsec sa detail查看ipsec sa协商 show crypto ipsec sa detail
interface: GigabitEthernet1/0/20 Crypto map tag: huaweicloud, local addr 119.3.149.150
protected vrf: (none) local ident (addr/mask/prot/port): (172.100.109.144/255.255.255.240/0/0)#感兴趣流 remote ident (addr/mask/prot/port): (11.37.1.0/255.255.255.0/0/0) current_peer 10.37.240.129 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 72593599, #pkts encrypt: 72593599, #pkts digest: 72593599 #pkts decaps: 101008349, #pkts decrypt: 101008349, #pkts verify: 101008349 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #pkts no sa (send) 0, #pkts invalid sa (rcv) 0 #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0 #pkts invalid prot (recv) 0, #pkts verify failed: 0 #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0 #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0 ##pkts replay failed (rcv): 0 #pkts tagged (send): 0, #pkts untagged (rcv): 0 #pkts not tagged (send): 0, #pkts not untagged (rcv): 0 #pkts internal err (send): 0, #pkts internal err (recv) 0
local crypto endpt.: 119.3.149.150, remote crypto endpt.: 10.37.240.129 plaintext mtu 1726, path mtu 1800, ip mtu 1800, ip mtu idb GigabitEthernet1/0/20 current outbound spi: 0xE4FB3B66(3841669990) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x9A73B86D(2591275117) transform: esp-256-aes esp-sha256-hmac ,#加密方式 in use settings ={Tunnel, } conn id: 477, flow_id: 477, sibling_flags 80004040, crypto map: huaweicloud sa timing: remaining key lifetime (k/sec): (4336919/3442)#超时时间3442s IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) #状态成功 inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xE4FB3B66(3841669990) transform: esp-256-aes esp-sha256-hmac , in use settings ={Tunnel, } conn id: 478, flow_id: 478, sibling_flags 80004040, crypto map: huaweicloud sa timing: remaining key lifetime (k/sec): (4336919/3442) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas:show crypto map 查看配置map信息 show crypto map Interfaces using crypto map NiStTeSt1:
Crypto Map IPv4 “huaweicloud” 30 ipsec-isakmp Peer = 10.37.240.129 Extended IP access list dms access-list dms permit ip 172.100.109.144 0.0.0.15 11.37.1.0 0.0.0.255 #感兴趣流 Current peer: 10.37.240.129 Security association lifetime: 4608000 kilobytes/3600 seconds #两阶段超时时间 Responder-Only (Y/N): N #可以是发起者和响应者 PFS (Y/N): N Mixed-mode : Disabled Transform sets={ dms: { esp-256-aes esp-sha256-hmac } , } Interfaces using crypto map huaweicloud: GigabitEthernet1/0/20
show crypto session ipsec vpn状态 SWLEFT2059UP#show crypto session Crypto session current status
Interface: GigabitEthernet1/0/20 Session status: UP-ACTIVE Peer: 10.37.240.129 port 500 Session ID: 0 IKEv1 SA: local 119.3.149.150/500 remote 10.37.240.129/500 Active IPSEC FLOW: permit ip 172.100.109.144/255.255.255.240 11.37.1.0/255.255.255.0 Active SAs: 2, origin: crypto map
Interface: GigabitEthernet1/0/19 Session status: DOWN Peer: 58.251.77.200 port 500 IPSEC FLOW: permit ip 27.112.8.0/255.255.255.0 192.168.3.0/255.255.255.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 192.168.3.0/255.255.255.0 27.112.8.0/255.255.255.0 Active SAs: 0, origin: crypto map
