安全与 VPN : IPSec 协商/IKE 协议

ASA 9.x :使用OSPF的VPN/IPsec配置示例

2015 年 8 月 28 日 - 机器翻译
其他版本: PDFpdf | 英语 (2015 年 7 月 21 日) | 反馈

简介

本文为VPN/IPsec提供一配置示例开放最短路径优先(OSPF)在思科可适应安全工具(ASA)。ASA允许OSPF单播运行一现有VPN连接。您不再需要配置通用路由封装 (GRE) 隧道。

贡献用Dinkar夏尔马和Amandeep辛哈, Cisco TAC工程师。

先决条件

要求

思科建议您有一个IPsec站点到站点VPN隧道配置的基本的了解在ASA的。

使用的组件

本文档中的信息基于以下软件和硬件版本:

  • ASA 5500-x运行软件版本9.x和以后的安全工具

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您使用的是真实网络,请确保您已经了解所有命令的潜在影响。

配置

注意:使用命令查找工具仅限注册用户)可获取有关本部分所使用命令的详细信息。

网络图

命令行配置

本文列出与IKEv1和IKEv2的配置示例协议,但是IPSec隧道形成了与仅IKEv2。

本地ASA

ASA Version 9.1(5)
!
hostname LOCAL-ASA
!

!--- Configure the Inside and Outside interface.

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 203.0.113.1 255.255.255.0
ospf cost 10
ospf network point-to-point non-broadcast
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.16.20.1 255.255.255.0
!

!--- Configure a manual Network Address Translation (NAT) Rule so that traffic
!--- should not be translated.

object network NETWORK_OBJ_172.16.20.0_24
subnet 172.16.20.0 255.255.255.0
object network NETWORK_OBJ_172.16.30.0_24
subnet 172.16.30.0 255.255.255.0

nat (inside,outside) source static NETWORK_OBJ_172.16.20.0_24
NETWORK_OBJ_172.16.20.0_24 destination static NETWORK_OBJ_172.16.30.0_24
NETWORK_OBJ_172.16.30.0_24 no-proxy-arp route-lookup

!--- The traffic specified by this Access Control List (ACL) is traffic that is
!--- to be encrypted and sent across the VPN tunnel.


access-list outside_cryptomap extended permit ip 172.16.20.0 255.255.255.0
172.16.30.0 255.255.255.0
access-list outside_cryptomap extended permit ospf interface outside host 198.51.100.1

!---
Add this ARP entry in the ASA.


arp outside 198.51.100.1 c84c.7522.1a32

!--- Configure the OSPF router process.

router ospf 100
network 172.16.20.0 255.255.255.0 area 0
network 203.0.113.0 255.255.255.0 area 0
area 0 neighbor 198.51.100.1 interface outside
log-adj-changes
!
route outside 198.51.100.0 255.255.255.0 203.0.113.2 1


!--- PHASE 1 CONFIGURATION ---!
!--- This configuration uses ISAKMP policy 30 for IKEv1 and policy for IKEv2.
!--- The configuration commands here define the Phase 1 policy parameters that are used.

crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400

crypto ikev2 policy 1
encryption aes-256
integrity sha group 5 2
prf sha
lifetime seconds 86400

!--- In order to create and manage the database of connection-specific records for
!--- ipsec-l2l-IPsec (LAN-to-LAN) tunnels, use the command tunnel-group in global
!--- configuration mode. For L2L connections the name of the tunnel group MUST be the
!--- IP address of the IPsec peer.


tunnel-group 198.51.100.1 type ipsec-l2l

!--- Enter the preshared key in order to configure the authentication method.

tunnel-group 198.51.100.1 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****

!--- PHASE 2 CONFIGURATION ---!
!--- The encryption types for Phase 2 are defined here.
!--- Define the transform set for Phase 2.

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption 3des protocol esp
integrity sha-1 md5

!--- Define which traffic should be sent to the IPsec peer.

crypto map outside_map 1 match address outside_cryptomap

!--- Sets the IPsec peer.

crypto map outside_map 1 set peer 198.51.100.1

!--- Sets the IPsec transform set "ESP-AES-128-SHA" to be used with the crypto map
!--- entry "outside_map".

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA
crypto map outside_map 1 set ikev2 ipsec-proposal DES

!--- Specifies the interface to be used with the settings defined in this
!--- configuration.

crypto map outside_map interface outside

!--- Enable IKEv1/IKEv2 on the outside interface.

crypto ikev2 enable outside
crypto ikev1 enable outside

远程ASA

ASA Version 9.1(5)
!
hostname REMOTE-ASA
!

!--- Configure the Inside and Outside interface.


interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 198.51.100.1 255.255.255.0
ospf cost 10
ospf network point-to-point non-broadcast
!

interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.16.30.1 255.255.255.0
!

!--- Configure a manual NAT Rule so that traffic should not be translated.

object network NETWORK_OBJ_172.16.20.0_24
subnet 172.16.20.0 255.255.255.0
object network NETWORK_OBJ_172.16.30.0_24
subnet 172.16.30.0 255.255.255.0

nat (inside,outside) source static NETWORK_OBJ_172.16.30.0_24
NETWORK_OBJ_172.16.30.0_24 destination static NETWORK_OBJ_172.16.20.0_24
NETWORK_OBJ_172.16.20.0_24 no-proxy-arp route-lookup

!--- The traffic specified by this ACL is traffic that is to be encrypted and sent
!--- across the VPN tunnel.


access-list outside_cryptomap extended permit ip 172.16.30.0 255.255.255.0
172.16.20.0 255.255.255.0
access-list outside_cryptomap extended permit ospf interface outside host
203.0.113.1 log disable

!---
Add this ARP entry in ASA.


arp outside 203.0.113.1 c84c.7522.1a33

!--- Configure the OSPF router process.


router ospf 100
network 172.16.30.0 255.255.255.0 area 0
network 198.51.100.0 255.255.255.0 area 0
area 0 neighbor 203.0.113.1 interface outside
log-adj-changes !

route management 10.24.21.126 255.255.255.255 10.105.130.1 1
route outside 203.0.113.0 255.255.255.0 198.51.100.2 1

!--- PHASE 1 CONFIGURATION ---!
!--- This configuration uses isakmp policy 30 for IKEv1 and policy for IKEv2.
!--- The configuration commands here define the Phase 1 policy parameters that are used.



crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400

crypto ikev2 policy 1
encryption aes-256
integrity sha group 5 2
prf sha
lifetime seconds 86400

!--- In order to create and manage the database of connection-specific records for
!--- ipsec-l2l-IPsec (LAN-to-LAN) tunnels, use the command tunnel-group in global
!--- configuration mode. For L2L connections the name of the tunnel group MUST be the
!--- IP address of the IPsec peer.


tunnel-group 203.0.113.1 type ipsec-l2l

!--- Enter the preshared key in order to configure the authentication method.

tunnel-group 203.0.113.1 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key ***** !

!--- PHASE 2 CONFIGURATION ---!
!--- The encryption types for Phase 2 are defined here.
!--- Define the transform set for Phase 2.

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption 3des protocol esp
integrity sha-1 md5

!--- Define which traffic should be sent to the IPsec peer.

crypto map outside_map 1 match address outside_cryptomap

!--- Sets the IPsec peer.

crypto map outside_map 1 set peer 203.0.113.1

!--- Sets the IPsec transform set "TSET" to be used with the crypto map entry
!--- "outside_map".

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA
crypto map outside_map 1 set ikev2 ipsec-proposal DES

!--- Specifies the interface to be used with the settings defined in this
!--- configuration.

crypto map outside_map interface outside

!--- Enable IKEv1/IKEv2 on the outside interface.

crypto ikev2 enable outside
crypto ikev1 enable outside

注意:您应该绑定加密映射到接口,在您指定OSPF邻居为了保证前OSPF更新通过VPN通道通过。如果绑定加密映射对接口,在您指定OSPF邻居后,请输入清楚local-host命令为了清除OSPF连接,因此OSPF邻接可以在VPN通道设立。

ASA设备管理器配置

  1. 选择向导> VPN向导为了创建站点到站点VPN通道。在VPN向导窗口如显示此处,其次请单击为了开始VPN配置。

  2. 进入对端IP地址和接口从对等体可及的并且其次单击。

    注意:假设,对等设备从本地设备是可及的,即,对等体可达性的需要的路由已经存在。

  3. 输入之间您希望巩固通信并且其次单击的本地和远程子网在。

  4. 因为您构件与预共享密匙验证的一站点到站点VPN,请输入将使用的预共享密匙并且其次单击。

  5. 检查选项配置本地和远程子网的NAT免税和选择源接口,即,接口连接对本地子网。单击 Next

  6. 查看准确性的配置汇总然后单击芬通社。

  7. 您需要指定在加密ACL的OSPF流量,以便OSPF流量通过VPN通道加密并且发送。为了执行此,请选择Configuration>站点到站点VPN >Advanced > ACL Manager。选择您在步骤3配置的加密ACL并且选择Add>添加在上面的ACE。选择来源作为外部接口、目的地作为远端对等体IP地址和服务作为OSPF并且点击OK键。单击应用为了推送对ASA的更改。

  8. 为了配置OSPF,请选择Configuration>设备设置>路由> OSPF >设置。点击进程实例选项卡,启用OSPF程序,并且输入OSPF程序ID。

  9. 点击区域/网络选项卡并且单击添加为了配置区域ID (0在这种情况下)和添加您运行OSPF程序的网络。添加里面和外部子网然后点击OK键。

  10. 单击应用为了推送对ASA的配置更改。

  11. 配置外部接口,以便能形成与远端对等体的点到点结邻在VPN。选择Configuration>设备设置>路由> OSPF >接口。点击Properties选项并且选择外部接口。单击 Edit。在编辑框中,请非选定广播复选框并且点击OK键。单击应用为了推送更改。

  12. 指定远端对等体作为一个静态OSPF邻居。选择Configuration>设备设置>路由> OSPF >静态邻居并且单击添加。在添加OSPF邻居条目窗口,在步骤定义的OSPF程序ID的8,请指定远端对等体IP作为邻居接口作为外部。点击OK键然后单击应用

  13. 配置在本地ASA的一个静态地址解析服务(ARP)条目远端对等体IP地址的。对此的原因是此ASA通过OSPF将学习的路由将有对端IP地址198.51.100.1作为下一跳。为了到达198.51.100.1, ASA再将必须执行不是可能的路由查找,因为ASA不支持递归路由查找。为了转发远程目的地的数据包, ASA需要对应于对端IP地址的第2层地址。给静态ARP为了映射下一跳IP地址的MAC地址对VPN对等项IP地址。为了执行此,选择Configuration>设备管理>Advanced > ARP > ARP静态表和单击添加为了配置静态ARP如显示此处。您将必须给在远程终端的相似的静态ARP条目。

  14. 为了便于测试,在内部接口的enable (event)管理访问通过VPN通道。为了执行此,请选择Configuration>设备管理>管理访问>管理接口并且指定管理访问接口作为里面。

验证

使用本部分可确认配置能否正常运行。

命令输出解释程序工具仅限注册用户)支持某些 show 命令。请使用Output Interpreter Tool为了查看show命令输出分析。

show crypto isakmp sa -显示被构件在对等体之间的互联网安全协会和密钥管理协议(ISAKMP)安全关联(SA)。

LOCAL-ASA# show crypto isakmp sa

There are no IKEv1 SAs

IKEv2 SAs:

Session-id:6, Status:UP-ACTIVE, IKE count:1, CHILD count:1

Tunnel-id Local Remote Status Role
5924753 203.0.113.1/500 198.51.100.1/500 READY INITIATOR
Encr: AES-CBC, keysize: 256, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/7922 sec
Child sa: local selector 203.0.113.1/0 - 203.0.113.1/0
remote selector 198.51.100.1/0 - 198.51.100.1/0
ESP spi in/out: 0x28b5cd3d/0xb785cc6d


REMOTE-ASA# show crypto isakmp sa
There are no IKEv1 SAs
IKEv2 SAs:

Session-id:6, Status:UP-ACTIVE, IKE count:1, CHILD count:1

Tunnel-id Local Remote Status Role
1760437 198.51.100.1/500 203.0.113.1/500 READY RESPONDER
Encr: AES-CBC, keysize: 256, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/7934 sec
Child sa: local selector 198.51.100.1/0 - 198.51.100.1/0
remote selector 203.0.113.1/0 - 203.0.113.1/0
ESP spi in/out: 0xb785cc6d/0x28b5cd3d

show crypto ipsec sa -显示每第2阶段被构件的SA和发送的流量总量。

LOCAL-ASA# show crypto ipsec sa
interface: outside
Crypto map tag: outside_map, seq num: 1, local addr: 203.0.113.1

access-list outside_cryptomap extended permit ospf interface outside host
198.51.100.1 log disable
local ident (addr/mask/prot/port): (203.0.113.1/255.255.255.255/89/0)
remote ident (addr/mask/prot/port): (198.51.100.1/255.255.255.255/89/0)
current_peer: 198.51.100.1


#pkts encaps: 828, #pkts encrypt: 828, #pkts digest: 828
#pkts decaps: 814, #pkts decrypt: 814, #pkts verify: 814
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 828, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 203.0.113.1/500, remote crypto endpt.: 198.51.100.1/500
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: B785CC6D
current inbound spi : 28B5CD3D

inbound esp sas:
spi: 0x28B5CD3D (683003197)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv2, }
slot: 0, conn_id: 126976, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4239306/20803)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xB785CC6D (3078999149)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv2, }
slot: 0, conn_id: 126976, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4193224/20803)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001


REMOTE-ASA# show crypto ipsec sa
interface: outside
Crypto map tag: outside_map, seq num: 1, local addr: 198.51.100.1

access-list outside_cryptomap extended permit ospf interface outside host
203.0.113.1 log disable
local ident (addr/mask/prot/port): (198.51.100.1/255.255.255.255/89/0)
remote ident (addr/mask/prot/port): (203.0.113.1/255.255.255.255/89/0)
current_peer: 203.0.113.1


#pkts encaps: 814, #pkts encrypt: 814, #pkts digest: 814
#pkts decaps: 829, #pkts decrypt: 829, #pkts verify: 829
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 814, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 198.51.100.1/500, remote crypto endpt.: 203.0.113.1/500
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 28B5CD3D
current inbound spi : B785CC6D

inbound esp sas:
spi: 0xB785CC6D (3078999149)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv2, }
slot: 0, conn_id: 61440, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4008904/20796)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x28B5CD3D (683003197)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv2, }
slot: 0, conn_id: 61440, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4054986/20796)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

show ospf neighbor -显示OSPF邻居关系状态。

LOCAL-ASA# show ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
198.51.100.1 1 FULL/ - 0:00:32 198.51.100.1 outside

REMOTE-ASA# show ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
203.0.113.1 1 FULL/ - 0:00:39 203.0.113.1 outside

show route -显示IP路由条目。

LOCAL-ASA# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

C 203.0.113.0 255.255.255.0 is directly connected, outside
O 172.16.30.0 255.255.255.0 [110/20] via 198.51.100.1, 1:45:52, outside
C 172.16.20.0 255.255.255.0 is directly connected, inside
S 198.51.100.0 255.255.255.0 [1/0] via 203.0.113.2, outside
S 10.24.21.126 255.255.255.255 [1/0] via 10.105.130.1, management
C 10.105.130.0 255.255.255.0 is directly connected, management


REMOTE-ASA# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

S 203.0.113.0 255.255.255.0 [1/0] via 198.51.100.2, outside
C 172.16.30.0 255.255.255.0 is directly connected, inside
O 172.16.20.0 255.255.255.0 [110/20] via 203.0.113.1, 1:45:57, outside
C 198.51.100.0 255.255.255.0 is directly connected, outside
S 10.24.21.126 255.255.255.255 [1/0] via 10.105.130.1, management
C 10.105.130.0 255.255.255.0 is directly connected, management

ping对等设备的内部接口从每个设备的为了验证连接。

LOCAL-ASA# ping inside 172.16.30.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.30.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms


REMOTE-ASA# ping inside 172.16.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

故障排除

目前没有针对此配置的故障排除信息。

相关信息


相关的思科支持社区讨论

思科支持社区是您提问、解答问题、分享建议以及与工作伙伴协作的论坛。


Document ID: 63882