GRE over IPSEC分支地址重叠经验案例

关键词:
问题现象

   R1是总部路由器(V5平台),R2R3为分支路由器(V7平台)。分支都要能够通过ipsec访问总部,并且需要通过ospf学习到总部路由。分支之间不需要互访。但是两个分支的内网网段地址重叠,都是192.168.1.0网段,会有地址冲突的情况。

IP地址规划如下:

设备

外网口IP

内网口IP

TunnelIP

R1

1.1.1.1/24

100.0.0.1

TUN1:12.0.0.1/24

TUN2:13.0.0.1/24

R2

1.1.1.2/24

192.168.1.1/24

12.0.0.2/24

R3

1.1.1.3/24

192.168.1.1/24

13.0.0.3/24

告警信息

不涉及

原因分析

由于客户需要分支通过ospf学习到总部路由,因此可考虑使用gre over ipsec的方案。但是由于分支端ip地址重叠,所以不能直接将分支端的网段通过ospf发给总部。解决的方法就是,在gre tunnel口上做一次nat,将分支的内网ip转换成tunnel口的ip来解决地址重叠的问题。

解决办法

1.  总部R1配置:

1)  配置GRE tunnel,源是本端外网口IP,目的是对端外网口IP

#

interface Tunnel1

 ip address 12.0.0.1 255.255.255.0

 source 1.1.1.1

 destination 1.1.1.2

#

interface Tunnel2

 ip address 13.0.0.1 255.255.255.0

 source 1.1.1.1

 destination 1.1.1.3

#

2)  配置感兴趣流

#

acl number 3000

 rule 0 permit ip source 1.1.1.1 0 destination 1.1.1.2 0

acl number 3001

 rule 0 permit ip source 1.1.1.1 0 destination 1.1.1.3 0

#

gre over ipsec的情况下,数据先进行gre封装,再进行ipsec加密。因此ipsec感兴趣流的源和目的IP是经过gre封装后的IP,也就是gre tunnelsourcedestination

 

3)  配置ike peer

#

ike peer r2

 pre-shared-key cipher $c$3$UYUBC/5zGBw77ZgZDLniBXst6B7ejQ==

 remote-address 1.1.1.2

#

ike peer r3

 pre-shared-key cipher $c$3$cUNdODztbuXP26+JFs3boP5G07NwMA==

 remote-address 1.1.1.3

#

4)  配置ipsec transform-set

#

ipsec transform-set 1

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

 esp encryption-algorithm 3des

#

5)  配置 ipsec policy

#

ipsec policy 1 10 isakmp

 security acl 3000

 ike-peer r2

 transform-set 1

#              

ipsec policy 1 20 isakmp

 security acl 3001

 ike-peer r3

 transform-set 1

#

6)  物理接口下调用ipsec policy

#

interface Ethernet0/0

 port link-mode route

 ip address 1.1.1.1 255.255.255.0

 ipsec policy 1

#

7)  配置ospf,把内网口和tunnel口宣告进ospf

#

ospf 1

 area 0.0.0.0

  network 100.0.0.1 0.0.0.0

  network 12.0.0.1 0.0.0.0

  network 13.0.0.1 0.0.0.0

#

2.  分支R2配置:

1)  配置GRE tunnel

#

interface Tunnel0 mode gre

 ip address 12.0.0.2 255.255.255.0

 source 1.1.1.2

 destination 1.1.1.1

 nat outbound

#

Tunnel口上配置nat outbound,数据包经过tunnel口时,会先将源地址转换为tunnel口的地址,再进行gre封装。

2)  配置感兴趣流

#

acl advanced 3000

 rule 0 permit ip source 1.1.1.2 0 destination 1.1.1.1 0

#

3)  配置ipsec策略

#            

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy 1 10 isakmp

 transform-set 1

 security acl 3000

 remote-address 1.1.1.1

 ike-profile 1

#

ike profile 1

 keychain 1

 match remote identity address 1.1.1.1 255.255.255.255

#

ike keychain 1

 pre-shared-key address 1.1.1.1 255.255.255.255 key cipher $c$3$Zjh8lqvsPg27z8WHRa4jIDOoxCmrjQ==

#

4)  物理接口下调用ipsec policy

#

interface GigabitEthernet0/0

 port link-mode route

 ip address 1.1.1.2 255.255.255.0

 ipsec apply policy 1

#

5)  配置ospf,把内网口和tunnel口宣告进ospf

#

ospf 1

 area 0.0.0.0

  network 12.0.0.2 0.0.0.0

#

注意不要把内网口宣告进ospf

3.  分支R3配置:

1)  配置GRE tunnel

#

interface Tunnel0 mode gre

 ip address 13.0.0.3 255.255.255.0

 source 1.1.1.3

 destination 1.1.1.1

 nat outbound

#

Tunnel口上配置nat outbound,数据包经过tunnel口时,会先将源地址转换为tunnel口的地址,再进行gre封装。

2)  配置感兴趣流

#

acl advanced 3000

 rule 0 permit ip source 1.1.1.3 0 destination 1.1.1.1 0

#

3)  配置ipsec策略

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy 1 10 isakmp

 transform-set 1

 security acl 3000

 remote-address 1.1.1.1

 ike-profile 1

#

ike profile 1

 keychain 1

 match remote identity address 1.1.1.1 255.255.255.255

#

ike keychain 1

 pre-shared-key address 1.1.1.1 255.255.255.255 key cipher $c$3$Zjh8lqvsPg27z8WHRa4jIDOoxCmrjQ==

#

4)  物理接口上调用ipsec策略

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.1.1.3 255.255.255.0

 ipsec apply policy 1

#

5)  配置ospf,把tunnel口宣告进ospf

#

ospf 1

 area 0.0.0.0

  network 13.0.0.3 0.0.0.0

#

注意不要把内网口宣告进ospf

4.  在总部端检查配置结果

1)  检查ike sa

<R1>display ike sa

    total phase-1 SAs:  2

    connection-id  peer                    flag        phase   doi

  ----------------------------------------------------------------

     142           1.1.1.3                 RD          1       IPSEC

     380           1.1.1.2                 RD|ST       1       IPSEC

     358           1.1.1.3                 RD          2       IPSEC

     381           1.1.1.2                 RD|ST       2       IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK—REKEY

 

两个分支端的ipsec saike sa都协商起来。

2)  检查ipsec sa

<R1>display ipsec sa

===============================

Interface: Ethernet0/0

    path MTU: 1500

===============================

 

  -----------------------------

  IPsec policy name: "1"

  sequence number: 10

  acl version: ACL4

  mode: isakmp

  -----------------------------

    PFS: N, DH group: none

    tunnel:

        local  address: 1.1.1.1

        remote address: 1.1.1.2

    flow:

        sour addr: 1.1.1.1/255.255.255.255  port: 0  protocol: IP

        dest addr: 1.1.1.2/255.255.255.255  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 0x3356AE14(861318676)

      transform: ESP-ENCRYPT-3DES ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 101

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843180/2950

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 0x4054B36C(1079292780)

      transform: ESP-ENCRYPT-3DES ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 102

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843180/2950

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

===============================

Interface: Ethernet0/0

    path MTU: 1500

===============================

 

  -----------------------------

  IPsec policy name: "1"

  sequence number: 20

  acl version: ACL4

  mode: isakmp

  -----------------------------

    PFS: N, DH group: none

    tunnel:

        local  address: 1.1.1.1

        remote address: 1.1.1.3

    flow:

        sour addr: 1.1.1.1/255.255.255.255  port: 0  protocol: IP

        dest addr: 1.1.1.3/255.255.255.255  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 0x891907CB(2300118987)

      transform: ESP-ENCRYPT-3DES ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 99

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843158/758

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 0x8FE5123C(2414154300)

      transform: ESP-ENCRYPT-3DES ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 100

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843159/758

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

 

两个sa的保护流,是gre封装后的源和目的ip

 

3)  检查ospf 邻居

<R1>display ospf peer

 

                  OSPF Process 1 with Router ID 100.0.0.1

                        Neighbor Brief Information

 

 Area: 0.0.0.0

 Router ID   Address         Pri  Dead-Time  Interface       State

 1.1.1.2      12.0.0.2        1    32         Tun1            Full/ -

 192.168.1.1  13.0.0.3        1    37         Tun2            Full/ -

 

与两个分支tunnel口的邻居都是full状态。邻居地址是tunnelip地址。

 

5.  分支端进行测试,从两个分支,用各自的内网地址telnet总部的内网地址

<R2>telnet 100.0.0.1 source ip 192.168.1.1

<R3>telnet 100.0.0.1 source 192.168.1.1

能同时telnet到总部路由器上

6.  总部端查看telnet用户在线状态

<R1>display users

The user application information of the user interface(s):

  Idx UI      Delay    Type Userlevel

  82  VTY 0   00:00:46 TEL  3

+ 83  VTY 1   00:00:00 TEL  3

  84  VTY 2   00:00:19 TEL  3

 

Following are more details.

VTY 0   :

        Location: 12.0.0.2

VTY 1   :

        Location: 1.1.1.4

VTY 2   :

        Location: 13.0.0.3

 +    : Current operation user.

 F    : Current operation user work in async mode.

 

2个分支端用户可以同时在线,源ip是各分支tunnel口的ip

建议与总结

1、本配置是GRE OVER IPSEC,因此IPSEC感兴趣流acl要匹配GRE封装后的数据包的地址,并且要互为镜像。

2、GRE OVER IPSEC中,IPSec应用在物理口上。

 

3、Tunnel口上配置nat outbound,数据包经过tunnel口时,会先将源地址转换为tunnel口的地址,再进行gre封装

案例信息

案例类型:经验案例
案例号:201601280019
创建时间:2016年1月28日
更新时间:2016年1月28日
发布时间:2016/1/28 17:54:25
文章密级:游客可见
有效期:长期有效
发布者:江浩 [j10978]
点击次数:3258
评论平均得分:0
关键词:ipsec
产品线:中低端路由器
产品系列:MSR36系列
产品版本:
故障类型:

常用操作
收藏