GREトンネル例のバックアップ(No.2)

バックアップ一覧
差分を表示
現在との差分を表示
ソースを表示
GREトンネル例へ行く。
- 1 (2013-07-15 (月) 19:38:08)
- 2 (2013-07-15 (月) 21:07:28)

バージョン： 1.5.3

オンラインユーザー数： 17
閲覧数表示本日/トータル： 1 / 2052

最終更新：2014-12-04 (木) 01:18:07

GTEトンネル設定 †

R1 †

Router(config)#interface tunnel 0
Router(config-if)#ip address 10.0.0.1 255.255.255.0
Router(config-if)#tunnel source 1.1.1.1
Router(config-if)#tunnel destination 1.1.1.2
Router(config-if)#!

Router(config)#interface loopback 0
Router(config-if)#ip address 10.1.1.254 255.255.255.0
Router(config-if)#no shutdown

Router(config)#router ospf 1
Router(config-router)#network 10.1.1.0 0.0.0.255 area 0
Router(config-router)#network 10.0.0.0 0.0.0.255 area 0

Router(config)#interface FastEthernet1
Router(config-if)# ip address 1.1.1.1 255.255.255.0

↑

R2 †

Router(config)#interface tunnel 0
Router(config-if)#ip address 10.0.0.2 255.255.255.0
Router(config-if)#tunnel source 1.1.1.2
Router(config-if)#tunnel destination 1.1.1.1
Router(config-if)#!

Router(config-if)#router ospf 1
Router(config-router)#network 10.2.2.0 0.0.0.255 area 0
Router(config-router)#network 10.0.0.0 0.0.0.255 area 0

Router(config)#interface fastEthernet 1
Router(config-if)#ip address 1.1.1.2 255.255.255.0
Router(config-if)#no shutdown

Router(config)#interface loopback 0
Router(config-if)#ip address 10.2.2.254 255.255.255.0
Router(config-if)#no shutdown

↑

GREトンネル + IPSec †

R1(config)#crypto isakmp policy 10
R1(config-isakmp)#encryption 3des
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 2
R1(config-isakmp)#lifetime 300
R1(config)#crypto isakmp key ROUTE-GRE-IPSec address 1.1.1.2

R1(config)#crypto ipsec transform-set TEST-1 esp-3des esp-sha-hmac
R1(cfg-crypto-trans)#mode transport

R1(config)#crypto map MAP-1 10 ipsec-isakmp
R1(config-crypto-map)#set peer 1.1.1.2
R1(config-crypto-map)#set transform-set TEST-1
R1(config-crypto-map)#match address 100

R1(config)#interface loopback 1
R1(config-if)#ip address 10.10.10.1 255.255.255.0
R1(config-if)#ip nat inside
R1(config-if)#ip virtual-reassembly
R1(config-if)#exit

R1(config)#interface tunnel 0
R1(config-if)#ip address 10.0.0.1 255.255.255.0
R1(config-if)#tunnel source loopback 1
R1(config-if)#tunnel destination 10.20.20.2

R1(config)#interface fastEthernet 1
R1(config-if)#ip access-group 101 in
R1(config-if)#ip nat outside
R1(config-if)#crypto map MAP-1

!
R1(config)#interface Loopback0 (FE0の代わりLAN側Port)
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# ip nat inside

R1(config)#router eigrp 1
R1(config-router)#network 10.0.0.0 0.0.0.255
R1(config-router)#network 10.1.1.0 0.0.0.255
R1(config-router)#no auto-summary

R1(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.10 (架空？)

R1(config)#ip nat inside source list 102 interface fastEthernet 1 overload

R1(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
R1(config)#access-list 100 permit gre host 10.10.10.1 host 10.20.20.2

R1(config)#access-list 101 permit esp host 1.1.1.2 host 1.1.1.1
R1(config)#access-list 101 permit udp host 1.1.1.2 host 1.1.1.1 eq isakmp
R1(config)#access-list 101 permit tcp any any eq www
R1(config)#access-list 101 permit tcp any any eq ftp
R1(config)#access-list 101 permit tcp any any eq ftp-data
R1(config)#access-list 101 permit icmp any any

R1(config)#access-list 102 permit ip 10.1.1.0 0.0.0.255 any
R1(config)#access-list 102 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

↑

R2 †

R2(config)#crypto isakmp policy 10
R2(config-isakmp)#encryption 3des
R2(config-isakmp)#authentication pre-share
R2(config-isakmp)#group 2
R2(config-isakmp)#lifetime 300
R2(config-isakmp)#!

R2(config)#crypto isakmp key ROUTE-GRE-IPSec address 1.1.1.1
R2(config)#crypto ipsec transform-set TEST-1 esp-3des esp-sha-hmac
R2(cfg-crypto-trans)#mode transport
R2(cfg-crypto-trans)#!

R2(config)#crypto map MAP-1 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer

       and a valid access list have been configured.

R2(config-crypto-map)#set peer 1.1.1.21
R2(config-crypto-map)#set transform-set TEST-1
R2(config-crypto-map)#match address 100
R2(config-crypto-map)#!

R2(config)#interface loopback 2
R2(config-if)#ip nat inside
R2(config-if)#ip virtual-reassembly
R2(config-if)#exit

R2(config)#interface tunnel 0
R2(config-if)#ip address 10.0.0.2 255.255.255.0
R2(config-if)#tunnel source loopback 2
R2(config-if)#tunnel destination 10.10.10.1
R2(config-if)#!

R2(config)#interface fastEthernet 1
R2(config-if)#ip access-group 101 in
R2(config-if)#ip nat outside
R2(config-if)#crypto map MAP-1

R2(config)#interface Loopback0 (FE0の代わりLAN側Port)
R2(config-if)#ip address 10.2.2.2 255.255.255.0
R2(config-if)#ip nat inside

R2(config-if)#router eigrp 1
R2(config-router)#network 10.0.0.0 0.0.0.255
R2(config-router)#network 10.2.2.0 0.0.0.255
R2(config-router)#no auto-summary

R2(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.10　(1.1.1.2から出力させる？)

R2(config)#ip nat inside source list 102 interface fastEthernet 1 overload

R2(config)#access-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
R2(config)#access-list 100 permit gre host 10.20.20.2 host 10.10.10.1

R2(config)#access-list 101 permit esp host 1.1.1.1 host 1.1.1.2
R2(config)#access-list 101 permit udp host 1.1.1.1 host 1.1.1.2 eq isakmp
R2(config)#access-list 101 permit tcp any any eq www
R2(config)#access-list 101 permit tcp any any eq ftp
R2(config)#access-list 101 permit tcp any any eq ftp-data
R2(config)#access-list 101 permit icmp any any

R2(config)#access-list 102 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
R2(config)#access-list 102 permit ip 10.2.2.0 0.0.0.255 any

↑

確認 †

   R2#show crypto map
   Crypto Map IPv4 "MAP-1" 10 ipsec-isakmp
           Peer = 1.1.1.1
           Extended IP access list 100
               access-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
               access-list 100 permit gre host 10.20.20.2 host 10.10.10.1
           Current peer: 1.1.1.1
           Security association lifetime: 4608000 kilobytes/3600 seconds
           Responder-Only (Y/N): N
           PFS (Y/N): N
           Transform sets={
                   TEST-1:  { esp-3des esp-sha-hmac  } ,
           }
           Interfaces using crypto map MAP-1:
                   FastEthernet1

   R2#show crypto session detail
   Crypto session current status

   Code: C - IKE Configuration mode, D - Dead Peer Detection
   K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
   X - IKE Extended Authentication, F - IKE Fragmentation

   Interface: FastEthernet1
   Session status: UP-NO-IKE
   Peer: 1.1.1.1 port 500 fvrf: (none) ivrf: (none)
         Desc: (none)
         Phase1_id: (none)
     IPSEC FLOW: permit ip 10.2.2.0/255.255.255.0 10.1.1.0/255.255.255.0
           Active SAs: 0, origin: crypto map
           Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
           Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
     IPSEC FLOW: permit 47 host 10.20.20.2 host 10.10.10.1
           Active SAs: 2, origin: crypto map
           Inbound:  #pkts dec'ed 123 drop 0 life (KB/Sec) 4603548/3103
           Outbound: #pkts enc'ed 122 drop 1 life (KB/Sec) 4603548/3103

   R2#show ip eigrp neighbors
   EIGRP-IPv4 Neighbors for AS(1)
   H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                               (sec)         (ms)       Cnt Num
   0   10.0.0.1                Tu0               11 00:07:03    4  1434  0  3

   R2#show ip route

   Gateway of last resort is 1.1.1.10 to network 0.0.0.0

   S*    0.0.0.0/0 [1/0] via 1.1.1.10
         1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
   C        1.1.1.0/24 is directly connected, FastEthernet1
   L        1.1.1.2/32 is directly connected, FastEthernet1
         10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
   C        10.0.0.0/24 is directly connected, Tunnel0
   L        10.0.0.2/32 is directly connected, Tunnel0
   D        10.1.1.0/24 [90/27008000] via 10.0.0.1, 00:07:18, Tunnel0
   C        10.2.2.0/24 is directly connected, Loopback0
   L        10.2.2.2/32 is directly connected, Loopback0
   C        10.20.20.0/24 is directly connected, Loopback2
   L        10.20.20.2/32 is directly connected, Loopback2

   R2#traceroute 10.1.1.1 source 10.2.2.2
   Type escape sequence to abort.
   Tracing the route to 10.1.1.1
   VRF info: (vrf in name/id, vrf out name/id)
     1 10.0.0.1 0 msec *  0 msec
   R2#

GREトンネル例 のバックアップ(No.2)

GTEトンネル設定 †

R1 †

R2 †

GREトンネル + IPSec †

R2 †

確認 †

GREトンネル例のバックアップ(No.2)