ipsec over gre原理及配置.docx

ipsec over gre步骤：创建tunnel口，配置ip,source, destination默认路由指向出口下一跳使用路由协议，把路由ping通（环回口，要加密的数据的ip）建立vpn，并在tunnel口上绑定map废话不多说，直接上配置：R1配置：hostname R1!crypto isakmp policy 10 hash md5 authentication pre-share group 2crypto isakmp key zhang address !!crypto ipsec transform-set mytrans esp-3des esp-md5-hmac !crypto map mymap local-address Loopback0crypto map mymap 10 ipsec-isakmp set peer set transform-set mytrans match address VPN!interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination tunnel key 123 crypto map mymap!interface Loopback0 ip address !interface Loopback10 ip address !interface FastEthernet0/0 ip address duplex auto speed auto!router ospf 1 router-id log-adjacency-changes network 55 area 0 network 55 area 0 network 55 area 0 neighbor !no ip http serverno ip http secure-serverip route !ip access-list extended VPN permit ip 55 55!endR2配置：hostname R2interface FastEthernet0/0 ip address duplex auto speed auto!interface FastEthernet1/0 ip address duplex auto speed auto!endR3配置：hostname R3!crypto isakmp policy 10 hash md5 authentication pre-share group 2crypto isakmp key zhang address !crypto ipsec transform-set mytrans esp-3des esp-md5-hmac !crypto map mymap local-address Loopback0crypto map mymap 10 ipsec-isakmp set peer set transform-set mytrans match address VPN!interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination tunnel key 123 crypto map mymap!interface Loopback0 ip address !interface Loopback10 ip address !interface FastEthernet0/0 ip address duplex auto speed auto!router ospf 1 router-id log-adjacency-changes network 55 area 0 network 55 area 0 network 55 area 0 neighbor !ip route !ip access-list extended VPN permit ip 55 55!end实验效果：IPSec Over GRE 路由原理下图是R1的路由表当我们ping source loopback 10,其实就是从Ping 要从到 ，看到是通过ospf通过tunnel0学到的，因此路由发往tunnel0.由于tunnel0上存在mymap,mymap上有ip access-list，判断是否满足。很明显这是满足的，所以，他又要走IPSEC。加上ESP的报头既然走IPSEC那么下一跳又是根据什么定义的昵？根据map内面的set peers。可以看到，下一跳是，再查路由表，很明