IPSec VPN承载组播业务的配置

关键词:
功能需求

IPSec VPN承载组播业务的配置

 

一、  组网需求:

传统IPSec安全策略不支持组播业务,以前通常是使用IPSec over GRE解决,不仅配置复杂,而且经过层层封装,开销比较大,使用IPSec虚拟隧道接口可以完美地满足该需求。IPsec虚拟隧道接口是一种支持路由的三层逻辑接口,它可以支持动态路由协议,所有路由到IPsec虚拟隧道接口的报文都将进行IPsec保护。

二、  组网图:

PC1PC2互传组播数据,网关设备对组播业务提供IPSec加密传输服务。两台PC之间组播数据的发送与接收使用“超限组播测试工具2.0”。

三、  配置步骤:

F100-S-G配置:

#

ike peer 1

 pre-shared-key cipher $c$3$tC9CH63BPBhvDmICydooawpYXp0hnPm7GQ==

 remote-address 192.168.2.2

 local-address 192.168.2.1

#

ipsec transform-set 1

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

 esp encryption-algorithm des

#

ipsec profile 1   //必须使用IPSec安全框架

 ike-peer 1

 transform-set 1

#

#

interface GigabitEthernet0/1

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

 igmp enable

 pim dm

#

interface GigabitEthernet0/2

 port link-mode route

 ip address 192.168.2.1 255.255.255.0

#

#

interface Tunnel0

 ip address 10.1.1.1 255.255.255.0

 tunnel-protocol ipsec ipv4   //封装协议改为IPSec

 source 192.168.2.1

 destination 192.168.2.2

 ipsec profile 1 

 pim dm

#

#

 ip route-static 0.0.0.0 0.0.0.0 Tunnel0

#

F1000-E的配置与之类似。

 

四、  结果查看:

查看F100-S-G的接口统计信息:

[H3C]dis interface g0/1

GigabitEthernet0/1 current state: UP

Line protocol current state: UP

Description: GigabitEthernet0/1 Interface

The Maximum Transmit Unit is 1500

Internet Address is 192.168.1.1/24 Primary

IP Packet Frame Type: PKTFMT_ETHNT_2,  Hardware Address: 3ce5-a613-fa1b

IPv6 Packet Frame Type: PKTFMT_ETHNT_2,  Hardware Address: 3ce5-a613-fa1b

Media type is twisted pair, loopback not set, promiscuous mode not set

1000Mb/s, Full-duplex, link type is autonegotiation

Output flow-control is disabled, input flow-control is disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

Last clearing of counters: Never

    Peak value of input: 87287 bytes/sec, at 2013-8-26 6:41:40

    Peak value of output: 142470 bytes/sec, at 2013-8-26 6:24:5

    Last 300 seconds input rate 68733 bytes/sec, 549864 bits/sec, 72 packets/sec

    Last 300 seconds output rate 304 bytes/sec, 2432 bits/sec, 2 packets/sec

    Input: 88624 packets, 0 jumboes, 77021075 bytes, 88624 buffers

           1134 broadcasts, 70735 multicasts, 0 pauses

           0 errors, 0 runts, 0 giants

           0 crc, 0 align errors, 0 overruns

           0 dribbles, 0 drops, 0 no buffers

    Output:16947 packets, 14151157 bytes, 16947 buffers

           2 broadcasts, 11911 multicasts, 0 pauses

           0 errors, 0 underruns, 0 collisions

           0 deferred, 0 drops, 0 lost carriers

 

[H3C]dis interface g0/2

GigabitEthernet0/2 current state: UP

Line protocol current state: UP

Description: GigabitEthernet0/2 Interface

The Maximum Transmit Unit is 1500

Internet Address is 192.168.2.1/24 Primary

IP Packet Frame Type: PKTFMT_ETHNT_2,  Hardware Address: 3ce5-a613-fa1c

IPv6 Packet Frame Type: PKTFMT_ETHNT_2,  Hardware Address: 3ce5-a613-fa1c

Media type is twisted pair, loopback not set, promiscuous mode not set

1000Mb/s, Full-duplex, link type is autonegotiation

Output flow-control is disabled, input flow-control is disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

Last clearing of counters: Never

    Peak value of input: 152635 bytes/sec, at 2013-8-26 6:24:5

    Peak value of output: 94470 bytes/sec, at 2013-8-26 6:41:40

    Last 300 seconds input rate 10 bytes/sec, 80 bits/sec, 0 packets/sec

    Last 300 seconds output rate 71859 bytes/sec, 574872 bits/sec, 70 packets/sec

    Input: 14008 packets, 0 jumboes, 14852600 bytes, 14008 buffers

           5 broadcasts, 0 multicasts, 0 pauses

           0 errors, 0 runts, 0 giants

           0 crc, 0 align errors, 0 overruns

           0 dribbles, 0 drops, 0 no buffers

    Output:66790 packets, 63479074 bytes, 66790 buffers

           12 broadcasts, 0 multicasts, 0 pauses

           0 errors, 0 underruns, 0 collisions

           0 deferred, 0 drops, 0 lost carriers

    由于对组播流量进行了IPSec封装,所以设备接口统计信息中,只有和PC1相连的接口G0/1能看到组播报文的统计,而在G0/2看到的都是IPSec加密封装后的单播报文。这样,中间设备不需要支持组播协议,也可以实现了组播报文的传输。

案例信息

案例类型:典型配置
案例号:KMS - 23715
创建时间:2013年8月29日
更新时间:2014年8月25日
发布时间:2014/8/25 3:33:45
文章密级:游客可见
有效期:长期有效
发布者:丘岳维 [q09448]
点击次数:655
评论平均得分:0
关键词:
产品线:
产品系列:
产品版本:
技术分类:安全产品技术 GRE

常用操作
收藏