使用VPN客戶端的IOS IPSec NAT透明配置示例

下載選項

PDF (315.7 KB)
在多種裝置上使用 Adobe Reader 檢視
ePub (97.7 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
Mobi (Kindle) (120.0 KB)
在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視

已更新: 2006 年 12 月 7 日

文件 ID:29760

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本文檔是支援IPsec網路地址轉換(NAT)透明功能的Cisco IOS®配置示例。它通過解決NAT和IPsec之間的許多已知不相容問題，引入了對IPsec流量在網路中通過NAT或點地址轉換(PAT)的支援。

必要條件

需求

本文件沒有特定需求。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

Cisco 2621 Router 12.2.13.7T1及更高版本
Cisco VPN客戶端3.6.3（未顯示配置）

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路正在作用，請確保您已瞭解任何指令可能造成的影響。

慣例

如需文件慣例的詳細資訊，請參閱思科技術提示慣例。

設定

本節提供用於設定本文件中所述功能的資訊。

註：使用Command Lookup Tool(僅限註冊客戶)查詢有關本文檔中使用的命令的更多資訊。

網路圖表

本檔案會使用以下網路設定：

路由器配置

請完成以下步驟：

發出show version命令，以顯示交換器執行的軟體版本。

2621#show version
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-IK9O3S3-M), Version 12.2(13.7)T1,  
MAINTENANCE INTERIM SOFTWARE
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sat 21-Dec-02 14:10 by ccai
Image text-base: 0x80008098, data-base: 0x818B6330

ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
ROM: C2600 Software (C2600-IK9O3S3-M), Version 12.2(13.7)T1,  
MAINTENANCE INTERIM SOFTWARE

2621 uptime is 33 minutes
System returned to ROM by reload
System image file is "flash:c2600-ik9o3s3-mz.122-13.7.T1"

cisco 2621 (MPC860) processor (revision 0x102) with 60416K/5120K bytes of memory.
Processor board ID JAB0407020V (2751454139)
M860 processor: part number 0, mask 49
Bridging software.
X.25 software, Version 3.0.0.
Primary Rate ISDN software, Version 1.1.
2 FastEthernet/IEEE 802.3 interface(s)
2 Channelized T1/PRI port(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)

Configuration register is 0x2102

發出show run命令。

2621#show run
Building configuration...

Current configuration : 2899 bytes
!
version 12.2
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
no service password-encryption
!
hostname 2621
!
boot system flash
logging queue-limit 100
enable secret 5 $1$dGFC$VA28yOWzxlCKyj1dq8SkE/
!
username cisco password 0 cisco123
username client password 0 testclient
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network foo local
aaa session-id common
ip subnet-zero
ip cef
!
!
no ip domain lookup
ip domain name cisco.com
!
!
!
!
crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp keepalive 40 5

!--- Allows an IPsec node to send NAT keepalive !--- packets every 20 seconds.

crypto isakmp nat keepalive 20
!
crypto isakmp client configuration group cisco
 key test1234
 pool test
 acl 120
!
!

!--- Transform set "test" which uses Triple DES !--- encryptions and MD5 (HMAC variant) !--- for data packet authentication: 

crypto ipsec transform-set test esp-3des esp-md5-hmac
crypto ipsec transform-set foo esp-3des esp-sha-hmac
!
crypto ipsec profile greprotect
!
!

!--- Dynamic crypto map.

crypto dynamic-map dynmap 1
 set transform-set foo
 match address 199
!
!
crypto map test client authentication list userauthen
crypto map test isakmp authorization list foo
crypto map test client configuration address respond

!--- Adds a dynamic crypto map set to a static crypto map set.
 
crypto map test 20 ipsec-isakmp dynamic dynmap
!
!
!
voice call carrier capacity active
!
!
!
!
!
!
!
no voice hpi capture buffer
no voice hpi capture destination
!
!
mta receive maximum-recipients 0
!
!
controller T1 0/0
 framing sf
 linecode ami
!
controller T1 0/1
 framing sf
 linecode ami
!
!
!
interface Loopback0
 ip address 10.100.100.1 255.255.255.0
 ip nat inside
!
interface FastEthernet0/0
 ip address 172.16.142.191 255.255.255.0
 ip nat outside
 no ip route-cache
 no ip mroute-cache
 duplex auto
 speed auto
 
!--- Applies a crypto map set to an interface. 

 crypto map test
!
interface FastEthernet0/1
 ip address 10.130.13.13 255.255.0.0
 duplex auto
 speed auto
!
ip local pool test 192.168.1.1 192.168.1.250
ip nat inside source route-map nonat interface FastEthernet0/0 overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.142.1
!
ip pim bidir-enable
!
!
access-list 101 permit ip any any
access-list 101 permit esp any any
access-list 101 permit udp any any eq isakmp
access-list 101 permit ip 192.168.0.0 0.0.255.255 10.100.100.0 0.0.0.255
access-list 111 permit ip 10.100.100.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 112 deny   ip 10.100.100.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 112 deny   ip 10.100.100.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 112 permit ip 10.100.100.0 0.0.0.255 any
access-list 120 permit ip 10.100.100.0 0.0.0.255 192.168.1.0 0.0.0.255

!--- IPsec access list defines which traffic to protect.

access-list 199 permit ip 10.100.100.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 199 permit ip host 172.16.142.191 192.168.1.0 0.0.0.255
!
route-map nonat permit 10
 match ip address 112
!
radius-server authorization permit missing Service-Type
call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
!
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
 password cisco
!
!
end

2621#

驗證

使用本節內容，確認您的組態是否正常運作。

輸出直譯器工具(僅供已註冊客戶使用)(OIT)支援某些show命令。使用OIT檢視show命令輸出的分析。

show crypto isakmp sa — 顯示對等體上的所有當前網際網路金鑰交換(IKE)安全關聯(SA)。

2621#show crypto isakmp sa 
  f_vrf/i_vrf   dst            src             state       conn-id slot
       /        172.16.142.191  171.69.89.82    QM_IDLE      4       0

show crypto ipsec sa — 顯示當前SA使用的設定。

2621#show crypto ipsec sa

interface: FastEthernet0/0
    Crypto map tag: test, local addr. 172.16.142.191

   protected vrf:
   local  ident (addr/mask/prot/port): (10.100.100.0/255.255.255.0/0/0) 

!--- Subnet behind local VPN router.

   remote ident (addr/mask/prot/port): (192.168.1.3/255.255.255.255/0/0)  

!--- Subnet behind remote VPN router.

   current_peer: 171.69.89.82:4500
     PERMIT, flags={}
    #pkts encaps: 11, #pkts encrypt: 11, #pkts digest 11
    #pkts decaps: 11, #pkts decrypt: 11, #pkts verify 11
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.142.191, remote crypto endpt.: 171.69.89.82  

!--- IP address of Encapsulating Security Payload (ESP) endpoints.

     path mtu 1500, media mtu 1500
     current outbound spi: 9A12903F

     inbound esp sas:
      spi: 0xD44C2AFE(3561761534)		

!--- SPI inbound (ESP tunnel).

        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        slot: 0, conn id: 2002, flow_id: 3, crypto map: test
        sa timing: remaining key lifetime (k/sec): (4513510/3476)
        IV size: 8 bytes
        replay detection support: Y

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x9A12903F(2584907839)				

!--- Security parameter index (SPI) outbound (ESP tunnel).

        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        slot: 0, conn id: 2003, flow_id: 4, crypto map: test
        sa timing: remaining key lifetime (k/sec): (4513511/3476)
        IV size: 8 bytes
        replay detection support: Y

     outbound ah sas:

     outbound pcp sas:

   protected vrf:
   local  ident (addr/mask/prot/port): (172.16.142.191/255.255.255.255/0/0)				

!--- Next tunnel.

   remote ident (addr/mask/prot/port): (192.168.1.3/255.255.255.255/0/0)
   current_peer: 171.69.89.82:4500
     PERMIT, flags={}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.16.142.191, remote crypto endpt.: 171.69.89.82
     path mtu 1500, media mtu 1500
     current outbound spi: 1CD14C06

     inbound esp sas:
      spi: 0x1EAC399E(514603422)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        slot: 0, conn id: 2000, flow_id: 1, crypto map: test
        sa timing: remaining key lifetime (k/sec): (4434590/3471)
        IV size: 8 bytes
        replay detection support: Y

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x1CD14C06(483478534)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        slot: 0, conn id: 2001, flow_id: 2, crypto map: test
        sa timing: remaining key lifetime (k/sec): (4434590/3469)
        IV size: 8 bytes
        replay detection support: Y

     outbound ah sas:

     outbound pcp sas:

show cryptio engine connection active — 顯示加密引擎統計資訊。顯示資料包計數。

2621#show crypyo engine connection active

  ID Interface       IP-Address      State  Algorithm           Encrypt  Decrypt
   4 FastEthernet0/0 172.16.142.191  set    HMAC_MD5+3DES_56_C        0        0
2000 FastEthernet0/0 172.16.142.191  set    HMAC_SHA+3DES_56_C        0        0
2001 FastEthernet0/0 172.16.142.191  set    HMAC_SHA+3DES_56_C        0        0
2002 FastEthernet0/0 172.16.142.191  set    HMAC_SHA+3DES_56_C        0       11
2003 FastEthernet0/0 172.16.142.191  set    HMAC_SHA+3DES_56_C       11        0

show crypto engine [brief |configuration] — 顯示加密引擎的配置資訊摘要。在特權EXEC模式下使用此命令。此命令顯示所有加密引擎並顯示AIM-VPN產品名稱。

2621#show crypto engine configuration

        crypto engine name:  unknown		

!--- Name of the crypto engine as assigned with the !--- key-name argument in the crypto key generate dss command.

        crypto engine type:  software		

!--- If "software" is listed, the crypto engine resides in either !--- the Route Switch Processor (RSP) (the Cisco IOS crypto engine) or !--- in a second-generation Versatile Interface Processor (VIP2). 


             serial number:  A3FFDBBB
		
       crypto engine state:  installed		

!--- The state "installed" indicates that a crypto engine is located !--- in the given slot, but is not configured for encryption. 

     crypto engine in slot:  N/A
                  platform:  Cisco Software Crypto Engine

   Encryption Process Info:
          input queue size:  500
           input queue top:  34
           input queue bot:  34
         input queue count:  0

   Crypto Adjacency Counts:
                Lock Count:  0
              Unlock Count:  0
        crypto lib version:  14.0.0
         ipsec lib version:  2.0.0

show crypto isakmp sa detail nat — 顯示ISAKMP SA NAT詳細資訊。

2621#show crypto isakmp sa detail nat
Codes: C - IKE configuration mode, D - Dead Peer Detection
       K - Keepalives, N - NAT-traversal
       X - IKE Extended Authentication
       psk - Preshared key, rsig - RSA signature
       renc - RSA encryption

  f_vrf/i_vrf  Conn id   Local        Remote        Encr Hash Auth DH Lifetime Capabilities
       /        4     172.16.142.191  171.69.89.82  3des md5       2  23:56:43 CDXN
        NAT keepalive(sec) 20
        In local 172.16.142.191:4500 remote cisco:4500

f_vrf/i_vrf - IKE SA的前門虛擬路由和轉送(F_VRF)和內部VRF(I_VRF)。如果FVRF是全域性的，則輸出將f_vrf顯示為空欄位。

疑難排解

使用本節內容，對組態進行疑難排解。

疑難排解指令

輸出直譯器工具(僅供已註冊客戶使用)(OIT)支援某些show命令。使用OIT檢視show命令輸出的分析。

請參閱IP安全性疑難排解 — 瞭解和使用debug命令以瞭解其他疑難排解資訊。

附註：使用 debug 指令之前，請先參閱有關 Debug 指令的重要資訊。

此配置按配置每20秒接收NAT Keepalive。

debug crypto ipsec — 顯示第2階段的IPsec協商。
debug crypto isakmp — 顯示第1階段的ISAKMP協商。

debug crypto engine — 顯示加密的流量。

2621#
2621#
*Mar  1 00:32:03.171: ISAKMP (0:4): received packet from 171.69.89.82 
                                    dport 4500 sport 4500 Global (R) QM_IDLE
*Mar  1 00:32:03.171: ISAKMP: set new node 1489874950 to QM_IDLE
*Mar  1 00:32:03.175: ISAKMP (0:4): processing HASH payload. message 
                                    ID = 1489874950
*Mar  1 00:32:03.175: ISAKMP (0:4): processing NOTIFY unknown protocol 1
        spi 0, message ID = 1489874950, sa = 82443410
*Mar  1 00:32:03.175: ISAKMP (0:4): deleting node 1489874950 error FALSE 
                                    reason "informational (in) state 1"
*Mar  1 00:32:03.175: ISAKMP (0:4): Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Mar  1 00:32:03.175: ISAKMP (0:4): Old State = IKE_P1_COMPLETE  
                                    New State = IKE_P1_COMPLETE

*Mar  1 00:32:13.115: ISAKMP (0:4): purging node 428915319
*Mar  1 00:32:23.199: ISAKMP (0:4): received packet from 171.69.89.82 
                                    dport 4500 sport 4500 Global (R) QM_IDLE
*Mar  1 00:32:23.199: ISAKMP: set new node -1483946735 to QM_IDLE
*Mar  1 00:32:23.203: ISAKMP (0:4): processing HASH payload. message ID = -1483946735
*Mar  1 00:32:23.203: ISAKMP (0:4): processing NOTIFY unknown protocol 1
        spi 0, message ID = -1483946735, sa = 82443410
*Mar  1 00:32:23.203: ISAKMP (0:4): deleting node -1483946735 error 
                                    FALSE reason "informational (in) state 1"
*Mar  1 00:32:23.203: ISAKMP (0:4): Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Mar  1 00:32:23.203: ISAKMP (0:4): Old State = IKE_P1_COMPLETE  
                                    New State = IKE_P1_COMPLETE

*Mar  1 00:32:33.147: ISAKMP (0:4): purging node -1677054470

debug ip packet [detail] — 顯示常規IP調試資訊和IP安全選項(IPSO)安全事務。

debug ip icmp — 顯示有關內部控制消息協定(ICMP)事務的資訊。

Generic IP:
  ICMP packet debugging is on
  IP packet debugging is on (detailed)

*Mar  1 00:38:43.735: IP: s=171.69.89.82 (FastEthernet0/0), d=172.16.142.191 
                      (FastEthernet0/0), len 108, rcvd 3
*Mar  1 00:38:43.735:     UDP src=4500, dst=4500
*Mar  1 00:38:48.863: IP: s=192.168.1.3 (FastEthernet0/0), d=10.100.100.1, 
                      len 60, rcvd 4
*Mar  1 00:38:48.863:     ICMP type=8, code=0
*Mar  1 00:38:48.863: ICMP: echo reply sent, src 10.100.100.1, dst 192.168.1.3
*Mar  1 00:38:48.867: IP: s=10.100.100.1 (local), d=192.168.1.3 (FastEthernet0/0), 
                      len 60, sending
*Mar  1 00:38:48.867:     ICMP type=0, code=0
*Mar  1 00:38:49.863: IP: s=192.168.1.3 (FastEthernet0/0), d=10.100.100.1, 
                      len 60, rcvd 4
*Mar  1 00:38:49.863:     ICMP type=8, code=0
*Mar  1 00:38:49.863: ICMP: echo reply sent, src 10.100.100.1, dst 192.168.1.3
*Mar  1 00:38:49.863: IP: s=10.100.100.1 (local), d=192.168.1.3 (FastEthernet0/0), 
                      len 60, sending
*Mar  1 00:38:49.867:     ICMP type=0, code=0
*Mar  1 00:38:50.863: IP: s=192.168.1.3 (FastEthernet0/0), d=10.100.100.1, 
                      len 60, rcvd 4
*Mar  1 00:38:50.867:     ICMP type=8, code=0
*Mar  1 00:38:50.867: ICMP: echo reply sent, src 10.100.100.1, dst 192.168.1.3
*Mar  1 00:38:50.867: IP: s=10.100.100.1 (local), d=192.168.1.3 (FastEthernet0/0), 
                      len 60, sending
*Mar  1 00:38:50.867:     ICMP type=0, code=0
*Mar  1 00:38:51.867: IP: s=192.168.1.3 (FastEthernet0/0), d=10.100.100.1, 
                      len 60, rcvd 4
*Mar  1 00:38:51.867:     ICMP type=8, code=0
*Mar  1 00:38:51.867: ICMP: echo reply sent, src 10.100.100.1, dst 192.168.1.3

debug crypto ipsec — 顯示第2階段的IPsec協商。
debug crypto isakmp — 顯示第1階段的ISAKMP協商。