ADSL与IPsecIKE相结合的组网应用广泛应用.docVIP

ADSL与IPsec/IKE相结合的组网应用 1. 组网需求 本例将IPsec和ADSL相结合，是目前实际中广泛应用的典型案例。 ?????????????? Router B通过ADSL卡直接连接公网的DSLAM接入端，作为PPPoE的client端。RouterB从ISP动态获得的IP地址为私网地址，故Router A、Router B都需要配置NAT穿越。 ?????????????? 总公司局域网通过Router A接入到ATM网络。 ?????????????? 为了保证信息安全采用IPsec/IKE方式创建安全隧道。 2. 组网图 图2-5 ADSLIPsec/IKE相结合的组网应用 ? 3. 配置步骤 (1)??????? 配置Router A # 配置本端安全网关设备名称。 RouterA system-view [RouterA] ike local-name routera # 配置ACL。 [RouterA] acl number 3101 [RouterA-acl-adv-3101] rule 0 permit ip source 172.16.0.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 [RouterA-acl-adv-3101] quit # 配置IKE安全提议。 [RouterA] ike proposal 1 [RouterA-ike-proposal-1] authentication-algorithm sha [RouterA-ike-proposal-1] authentication-method pre-share [RouterA-ike-proposal-1] encryption-algorithm 3des-cbc [RouterA-ike-proposal-1] dh group2 # 配置IKE对等体peer。 [RouterA] ike peer peer [RouterA-ike-peer-peer] exchange-mode aggressive [RouterA-ike-peer-peer] pre-shared-key abc [RouterA-ike-peer-peer] id-type name [RouterA-ike-peer-peer] remote-name routerb [RouterA-ike-peer-peer] nat traversal [RouterA-ike-peer-peer] quit # 创建IPsec安全提议prop。 [RouterA] ipsec proposal prop [RouterA-ipsec-proposal-prop] encapsulation-mode tunnel [RouterA-ipsec-proposal-prop] transform esp [RouterA-ipsec-proposal-prop] esp encryption-algorithm 3des [RouterA-ipsec-proposal-prop] esp authentication-algorithm sha1 [RouterA-ipsec-proposal-prop] quit # 创建安全策略policy并指定通过IKE协商建立SA。 [RouterA] ipsec policy policy 10 isakmp # 配置安全策略policy引用IKE对等体peer。 [RouterA-ipsec-policy-isakmp-policy-10] ike-peer peer # 配置安全策略policy引用访问控制列表3101。 [RouterA-ipsec-policy-isakmp-policy-10] security acl 3101 # 配置安全策略policy引用IPsec安全提议prop。 [RouterA-ipsec-policy-isakmp-policy-10] proposal prop [RouterA-ipsec-policy-isakmp-policy-10] quit # 配置IP地址。 [RouterA] interface serial 2/0/1 [RouterA-Serial2/0/1] ip address 100.1.1.1 255.255.255.0 [RouterA-Serial2/0/1] ipsec policy policy [RouterA-Serial2/0/1] quit # 配置以太网口。 [RouterA] interface gigabitethernet 1/0/1 [RouterA-Gigabit