全系列VPN技术集锦第一卷(Site-to-Site IPsec VPN)【DOC精选】.doc

全系列VPN技术集锦第一卷第2章(Site-to-Site IPsec VPN) 作者： 论坛整理 zdnet网络安全CNETN2008-01-19 13:29:21关键词： 安全防护 防火墙 VPN 实例研究 使用预共享密钥作为认证机制的路由器到路由器的IPsec 这是IPsec VPN中最基本最常用的类型.这种类型的VPN属于LAN-to-LAN.这里使用的认证方法是预共享密钥.以后的实例研究有更安全的认证方法的例子. 在实例中我们将给出发起者路由器和响应者路由器的配置,同时也给出了DEBUG输出以及相关的SHOU命令输出,以便我们共同研究. 例1 作为IPsec协商的发起者的路由器配置 hostname Initiator The ISAKMP policy defines the attributes which will be negotiated with peers for the IKE SA. crypto isakmp policy 1 The encryption method defined below is used for encrypting the IKE negotiation packets using SKEYID_e encr 3des The hash algorithm defined below is used to generate the hashes which are used for IKE authetnication purposes. hash sha The line below defines the authentication method as pre-shared key authentication authentication pre-share The line below defines the pre-shared key for the peer at the IP address 0. Please note that the initiator will search through its config for this key using the source IP address of the IKE negotiation packets it is receiving. crypto isakmp key jw4ep9846804ijl address 0 The following line defines the transform set for use with IPsec. This transform set !specifies the name of the transform set as myset. The encapsulation method defined !is ESP and the encryption algorithm to use is 3DES (triple DES). The last part of !this command specifies MD5 as the ESP integrity checking hash. crypto ipsec transform-set myset esp-3des esp-md5-hmac The following configuration is for the crypto map named vpn. Crypto maps essentially bind the entire IPsec configuration together. Various elements of IPsec defined in various places in the configuration are tied together using the crypto map. 10 is the instance number for the map here. Instance numbers are used to specify the order in which multiple crypto maps are parsed in a config. The key word ipsec-isakmp is used to specify that this particular crypto map is to be used for IPsec rather than CET. crypto map vpn 10 ipsec-isakmp The command line be