IPSecVTI例
をテンプレートにして作成
[
トップ
] [
新規
|
一覧
|
検索
|
最終更新
|
ヘルプ
|
ログイン
]
開始行:
[[CISCO入門]]
#setlinebreak(on)
バージョン： &Version; &br;
オンラインユーザー数： &online;
閲覧数表示 本日/トータル： &counter(today); / &counter(to...
最終更新：&lastmod();&br;
*IPSEC VTI設定例 [#ybb82e1e]
**Rotuer1 [#kdd1ac7f]
R1#show running-config
Building configuration...
Current configuration : 1333 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.1.1.0 255.255.255.0
!
!
crypto ipsec transform-set VTI-IPSEC esp-3des esp-md5...
!
crypto ipsec profile MYPROFILE
set transform-set VTI-IPSEC
!
!
!
!
interface Loopback0
ip address 172.16.16.1 255.255.255.0
!
interface Loopback1
ip address 192.168.200.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.111.1 255.255.255.0
tunnel source FastEthernet0
tunnel destination 10.1.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile MYPROFILE
!
interface Ethernet0
no ip address
shutdown
half-duplex
!
interface FastEthernet0
ip address 10.1.1.1 255.255.255.0
speed auto
!
interface Serial0
no ip address
shutdown
!
router eigrp 20
network 172.16.16.0 0.0.0.255
network 192.168.111.0
network 192.168.200.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
password cisco
logging synchronous
login
line aux 0
line vty 0 4
!
end
-VTIのソース側はFEのIPアドレスでも可能
R1(conf-if)#tunnel source 10.1.1.1
**Rotuer2 [#fc79a468]
2#show running-config
Building configuration...
Current configuration : 1304 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.1.1.0 255.255.255.0
!
!
crypto ipsec transform-set VTI-IPSEC esp-3des esp-md5...
!
crypto ipsec profile MYPROFILE
set transform-set VTI-IPSEC
!
!
!
!
interface Loopback0
ip address 172.16.16.2 255.255.255.0
!
interface Loopback1
ip address 192.168.201.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.111.2 255.255.255.0
tunnel source FastEthernet0
tunnel destination 10.1.1.1
tunnel mode ipsec ipv4
tunnel protection ipsec profile MYPROFILE
!
interface Ethernet0
no ip address
shutdown
half-duplex
!
interface FastEthernet0
ip address 10.1.1.2 255.255.255.0
speed auto
!
interface Serial0
no ip address
shutdown
no fair-queue
!
router eigrp 20
network 172.16.16.0 0.0.0.255
network 192.168.111.0
network 192.168.201.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
end
**showコマンド確認 [#ed55cbec]
R2#show crypto isakmp sa
dst src state conn-i...
10.1.1.1 10.1.1.2 QM_IDLE ...
R2#
R2#show crypto ipsec sa
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 10.1.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0...
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0...
current_peer 10.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 160, #pkts encrypt: 160, #pkts dige...
#pkts decaps: 165, #pkts decrypt: 165, #pkts veri...
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress faile...
#send errors 0, #recv errors 0
local crypto endpt.: 10.1.1.2, remote crypto end...
path mtu 1500, ip mtu 1500, ip mtu idb FastEther...
current outbound spi: 0x369D5142(916279618)
inbound esp sas:
spi: 0x540338C6(1409497286)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: 1, crypto map: Tunnel...
sa timing: remaining key lifetime (k/sec): (4...
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x369D5142(916279618)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: 2, crypto map: Tunnel...
sa timing: remaining key lifetime (k/sec): (4...
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R2#
R2#show ip route eigrp 20
D 192.168.200.0/24 [90/297372416] via 192.168.111....
R2#show ip eigrp neighbors
IP-EIGRP neighbors for process 20
H Address Interface Hold Upti...
(sec) ...
0 192.168.111.1 Tu0 14 00:1...
R2#
終了行:
[[CISCO入門]]
#setlinebreak(on)
バージョン： &Version; &br;
オンラインユーザー数： &online;
閲覧数表示 本日/トータル： &counter(today); / &counter(to...
最終更新：&lastmod();&br;
*IPSEC VTI設定例 [#ybb82e1e]
**Rotuer1 [#kdd1ac7f]
R1#show running-config
Building configuration...
Current configuration : 1333 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.1.1.0 255.255.255.0
!
!
crypto ipsec transform-set VTI-IPSEC esp-3des esp-md5...
!
crypto ipsec profile MYPROFILE
set transform-set VTI-IPSEC
!
!
!
!
interface Loopback0
ip address 172.16.16.1 255.255.255.0
!
interface Loopback1
ip address 192.168.200.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.111.1 255.255.255.0
tunnel source FastEthernet0
tunnel destination 10.1.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile MYPROFILE
!
interface Ethernet0
no ip address
shutdown
half-duplex
!
interface FastEthernet0
ip address 10.1.1.1 255.255.255.0
speed auto
!
interface Serial0
no ip address
shutdown
!
router eigrp 20
network 172.16.16.0 0.0.0.255
network 192.168.111.0
network 192.168.200.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
password cisco
logging synchronous
login
line aux 0
line vty 0 4
!
end
-VTIのソース側はFEのIPアドレスでも可能
R1(conf-if)#tunnel source 10.1.1.1
**Rotuer2 [#fc79a468]
2#show running-config
Building configuration...
Current configuration : 1304 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.1.1.0 255.255.255.0
!
!
crypto ipsec transform-set VTI-IPSEC esp-3des esp-md5...
!
crypto ipsec profile MYPROFILE
set transform-set VTI-IPSEC
!
!
!
!
interface Loopback0
ip address 172.16.16.2 255.255.255.0
!
interface Loopback1
ip address 192.168.201.1 255.255.255.0
!
interface Tunnel0
ip address 192.168.111.2 255.255.255.0
tunnel source FastEthernet0
tunnel destination 10.1.1.1
tunnel mode ipsec ipv4
tunnel protection ipsec profile MYPROFILE
!
interface Ethernet0
no ip address
shutdown
half-duplex
!
interface FastEthernet0
ip address 10.1.1.2 255.255.255.0
speed auto
!
interface Serial0
no ip address
shutdown
no fair-queue
!
router eigrp 20
network 172.16.16.0 0.0.0.255
network 192.168.111.0
network 192.168.201.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
end
**showコマンド確認 [#ed55cbec]
R2#show crypto isakmp sa
dst src state conn-i...
10.1.1.1 10.1.1.2 QM_IDLE ...
R2#
R2#show crypto ipsec sa
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 10.1.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0...
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0...
current_peer 10.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 160, #pkts encrypt: 160, #pkts dige...
#pkts decaps: 165, #pkts decrypt: 165, #pkts veri...
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress faile...
#send errors 0, #recv errors 0
local crypto endpt.: 10.1.1.2, remote crypto end...
path mtu 1500, ip mtu 1500, ip mtu idb FastEther...
current outbound spi: 0x369D5142(916279618)
inbound esp sas:
spi: 0x540338C6(1409497286)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: 1, crypto map: Tunnel...
sa timing: remaining key lifetime (k/sec): (4...
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x369D5142(916279618)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: 2, crypto map: Tunnel...
sa timing: remaining key lifetime (k/sec): (4...
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R2#
R2#show ip route eigrp 20
D 192.168.200.0/24 [90/297372416] via 192.168.111....
R2#show ip eigrp neighbors
IP-EIGRP neighbors for process 20
H Address Interface Hold Upti...
(sec) ...
0 192.168.111.1 Tu0 14 00:1...
R2#
ページ名:
![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
