IPsec IKEv2 Site2Site VPN (FlexVPN): Cisco ASA, ASR, Router, PfSense, StrongSwan

В начало
Назад
1
Вперёд
В конец

TOLLIFi
Автор темы
Не в сети
Moderator
TOLLIFi Inc.

Больше

7 мес. 2 нед. назад - 7 мес. 2 нед. назад #251 от TOLLIFi

TOLLIFi создал эту тему: IPsec IKEv2 Site2Site VPN (FlexVPN): Cisco ASA, ASR, Router, PfSense, StrongSwan

Примеры конфигурации IPsec IKEv2 Site-to-Site VPN (Cisco VTI, Classic CryptoMap) с Pre-Shared Key.

--- КРАТКОЕ ОПИСАНИЕ IKEv2 >>>

ВНИМАНИЕ: Спойлер! [ Нажмите, чтобы развернуть ]

--- ПРИМЕР ДЛЯ ТРЁХ ПИРОВ: CISCO ROUTER, CISCO ASA и PFSENSE >>>

- ASR NAT-T (ConfigNet: Cisco VTI & CryptoMap) <-> Router (Foo: Cisco VTI)
- ASR NAT-T (ConfigNet: Cisco VTI & CryptoMap) <-> ASA (Bar: CryptoMap)
- ASR NAT-T (ConfigNet: Cisco VTI & CryptoMap) <-> PfSense (Baz: VTI) <в процессе написания...>

*** Сначала будет приведена конфигурация Confignet общая для всех пиров (Foo, Bar и Baz) ***

Настройки IPsec VPN Phase1 (IKE_SA_INIT):

- политика с алгоритмами IKEv2 первой фазы для всех пиров:

crypto ikev2 proposal ikev2-proposal-confignet
 encryption aes-gcm-256 aes-gcm-128
 prf sha512 sha384 sha256
 group 20 21 24
crypto ikev2 proposal ikev2-proposal-confignet2
 encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
 integrity sha512 sha384 sha256
 group 20 21 24
!
crypto ikev2 policy ikev2-policy-confignet
 proposal ikev2-proposal-confignet
 proposal ikev2-proposal-confignet2

Настройки IPsec VPN Phase2 (IKE_AUTH):

- ключи IKEv2 для всех пиров, объединенные в одну keyring-группу:

crypto ikev2 keyring ikev2-keyring-confignet
 peer foo
  description *** Foo IKEv2 Peer ***
  address 1.1.1.1
  pre-shared-key local fooPassword
  pre-shared-key remote confignetPassword
 !
 peer bar
  description *** Bar IKEv2 Peer ***
  address 2.2.2.2
  pre-shared-key local barPassword
  pre-shared-key remote confignetPassword
 !
 peer baz
  description *** Baz IKEv2 Peer ***
  address 3.3.3.3
  pre-shared-key symmetricBazConfignetPassword
 !

- профиль IKEv2 для всех пиров:

crypto ikev2 profile ikev2-profile-confignet
 match identity remote address 1.1.1.1 255.255.255.255
 match identity remote address 2.2.2.2 255.255.255.255
 match identity remote address 3.3.3.3 255.255.255.255
 identity local address 9.9.9.9
 authentication remote pre-share
 authentication local pre-share
 keyring local ikev2-keyring-confignet
 dpd 60 3 periodic

- алгоритмы IPsec:

crypto ipsec transform-set ipsec-ts-confignet esp-aes 256 esp-sha-hmac
 mode tunnel

*** Конфигурация Confignet для пиров Foo и Baz ***

Профиль IPsec:

crypto ipsec profile ipsec-profile-ikev2
 set transform-set ipsec-ts-confignet
 set ikev2-profile ikev2-profile-confignet

Пример интерфейса VTI Tunnel для пира Foo:

interface Tunnel901
 description *** IPsec-IKEv2-Foo (Router) ***
 ip address 10.5.9.93 255.255.255.252
 ip access-group ipsec-foo-in in
 ip access-group ipsec-foo-out out
 ip tcp adjust-mss 1400
 tunnel source 10.2.1.6
 tunnel mode ipsec ipv4
 tunnel destination 1.1.1.1
 tunnel protection ipsec profile ipsec-profile-ikev2

Пример интерфейса VTI Tunnel для пира Baz:

interface Tunnel902
 description *** IPsec-IKEv2-Baz (PfSense) ***
 ip address 10.5.9.97 255.255.255.252
 ip access-group ipsec-baz-in in
 ip access-group ipsec-baz-out out
 ip tcp adjust-mss 1400
 tunnel source 10.2.1.6
 tunnel mode ipsec ipv4
 tunnel destination 3.3.3.3
 tunnel protection ipsec profile ipsec-profile-ikev2

*** Конфигурация Confignet для пира Bar ***

ACL для шифрования трафика:

access-list 222 permit ip 10.9.9.0 0.0.0.255 10.2.2.0 0.0.0.255

Пример CryptoMap:

crypto map cmap-confignet 10 ipsec-isakmp
 description *** IPsec-IKEv2-Bar (ASA) ***
 set peer 2.2.2.2
 set ip access-group ipsec-bar-in in
 set ip access-group ipsec-bar-out out
 set transform-set ipsec-ts-confignet
 set pfs group20
 set ikev2-profile ikev2-profile-confignet
 match address 222

Вешаем CryptoMap на Source-интерфейс:

interface GigabitEthernet0/0
 description *** IPsec Source Interface ***
 ip address 10.2.1.6 255.255.255.248
 crypto map cmap-confignet

Указываем маршрут к удаленной подсети пира Bar через Default Gateway Nexthop IP:

ip route 10.2.2.0 255.255.255.0 10.2.1.1 name IPsec-Bar

--- МОНИТОРИНГ IKEv2 >>>

ВНИМАНИЕ: Спойлер! [ Нажмите, чтобы развернуть ]

Просмотр SA-информации IKEv2 Phase1:

ASR_Confignet#show crypto ikev2 sa detailed
 IPv4 Crypto IKEv2  SA 

Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         10.2.1.6/4500         1.1.1.1/4500  none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:20, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/2896 sec
      CE id: 0, Session-id: 3780
      Status Description: Negotiation done
      Local spi: A07DC5FE4583D79E       Remote spi: 1FE7473ED0D45E87
      Local id: 9.9.9.9
      Remote id: 1.1.1.1
      Local req msg id:  48             Remote req msg id:  289
      Local next msg id: 48             Remote next msg id: 289
      Local req queued:  48             Remote req queued:  289
      Local window:      5              Remote window:      1
      DPD configured for 60 seconds, retry 3
      Fragmentation not  configured.
      Extended Authentication not configured.
      NAT-T is detected inside
      Cisco Trust Security SGT is disabled
      Initiator of SA : No

Tunnel-id Local                 Remote                fvrf/ivrf            Status
2         10.2.1.6/4500         2.2.2.2/4500    none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:20, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/81096 sec
      CE id: 87823, Session-id: 3778
      Status Description: Negotiation done
      Local spi: E19AC6A41B0C304F       Remote spi: 9300C30CA60E864B
      Local id: 9.9.9.9
      Remote id: 2.2.2.2
      Local req msg id:  3585           Remote req msg id:  65028
      Local next msg id: 3585           Remote next msg id: 65028
      Local req queued:  3585           Remote req queued:  65028
      Local window:      5              Remote window:      1
      DPD configured for 60 seconds, retry 3
      Fragmentation not  configured.
      Extended Authentication not configured.
      NAT-T is detected inside
      Cisco Trust Security SGT is disabled
      Initiator of SA : No

 IPv6 Crypto IKEv2  SA

Просмотр сессий IKEv2 Phase1 & Child_SA (IPsec_SA) Phase2:

ASR_Confignet#show crypto ikev2 session detailed
 IPv4 Crypto IKEv2 Session 

Session-id:3792, Status:UP-ACTIVE, IKE count:1, CHILD count:2

Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         10.2.1.6/4500         1.1.1.1/4500    none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:20, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3432 sec
      CE id: 87869, Session-id: 3792
      Status Description: Negotiation done
      Local spi: AE7A0B386E5BDB88       Remote spi: F627C8E135DB4470
      Local id: 9.9.9.9
      Remote id: 1.1.1.1
      Local req msg id:  189            Remote req msg id:  2
      Local next msg id: 189            Remote next msg id: 2
      Local req queued:  189            Remote req queued:  2
      Local window:      5              Remote window:      1
      DPD configured for 0 seconds, retry 0
      Fragmentation not  configured.
      Extended Authentication not configured.
      NAT-T is detected inside
      Cisco Trust Security SGT is disabled
      Initiator of SA : No
Child sa: local selector  10.9.9.100/0 - 10.9.9.100/65535
          remote selector 10.5.9.94/0 - 10.5.9.94/65535
          ESP spi in/out: 0x13B6685/0xC608D114
          AH spi in/out: 0x0/0x0
          CPI in/out: 0x0/0x0
          Encr: AES-CBC, keysize: 256, esp_hmac: SHA96
          ah_hmac: None, comp: IPCOMP_NONE, mode tunnel
Child sa: local selector  10.9.9.100/0 - 10.9.9.100/65535
          remote selector 10.5.9.94/0 - 10.5.9.94/65535
          ESP spi in/out: 0xF481B432/0xCA39E26C
          AH spi in/out: 0x0/0x0
          CPI in/out: 0x0/0x0
          Encr: AES-CBC, keysize: 256, esp_hmac: SHA96
          ah_hmac: None, comp: IPCOMP_NONE, mode tunnel


Session-id:3790, Status:UP-ACTIVE, IKE count:1, CHILD count:1 

Tunnel-id Local                 Remote                fvrf/ivrf            Status
2         10.2.1.6/4500         2.2.2.2/4500  none/none            READY
      Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:20, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/732 sec
      CE id: 0, Session-id: 3790
      Status Description: Negotiation done
      Local spi: C62AE2B78D2BFF11       Remote spi: 475F3701578CEC3A
      Local id: 9.9.9.9
      Remote id: 2.2.2.2
      Local req msg id:  0              Remote req msg id:  73
      Local next msg id: 0              Remote next msg id: 73
      Local req queued:  0              Remote req queued:  73
      Local window:      5              Remote window:      1
      DPD configured for 0 seconds, retry 0
      Fragmentation not  configured.
      Extended Authentication not configured.
      NAT-T is detected inside
      Cisco Trust Security SGT is disabled
      Initiator of SA : No
Child sa: local selector  10.9.9.0/0 - 10.9.9.255/65535
          remote selector 10.2.2.0/0 - 10.2.2.255/65535
          ESP spi in/out: 0x77BDDC93/0x54DB6050
          AH spi in/out: 0x0/0x0
          CPI in/out: 0x0/0x0
          Encr: AES-CBC, keysize: 256, esp_hmac: SHA96
          ah_hmac: None, comp: IPCOMP_NONE, mode tunnel

 IPv6 Crypto IKEv2 Session

Просмотр SA-информации IPsec Phase2:

ASR_Confignet#show crypto ipsec sa peer 1.1.1.1 detail

interface: Tunnel901
    Crypto map tag: Tunnel901-head-0, local addr 10.2.1.6

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.9.9.100/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (10.5.9.94/255.255.255.255/0/0)
   current_peer 1.1.1.1 port 4500
     PERMIT, flags={}
    #pkts encaps: 6, #pkts encrypt: 6, #pkts digest: 6
    #pkts decaps: 6, #pkts decrypt: 6, #pkts verify: 6
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #pkts no sa (send) 0, #pkts invalid sa (rcv) 0
    #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
    #pkts invalid prot (recv) 0, #pkts verify failed: 0
    #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
    #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
    ##pkts replay failed (rcv): 0
    #pkts tagged (send): 0, #pkts untagged (rcv): 0
    #pkts not tagged (send): 0, #pkts not untagged (rcv): 0
    #pkts internal err (send): 0, #pkts internal err (recv) 0

     local crypto endpt.: 10.2.1.6, remote crypto endpt.: 1.1.1.1
     plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
     current outbound spi: 0xC635F7A1(3325425569)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x3F80FA81(1065417345)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 7206, flow_id: HW:5206, sibling_flags 80000048, crypto map: Tunnel901-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/37)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0xCE6FD643(3463435843)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 7208, flow_id: HW:5208, sibling_flags 80000048, crypto map: Tunnel901-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/67)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
     
     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xC545FFA5(3309698981)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 7205, flow_id: HW:5205, sibling_flags 80000048, crypto map: Tunnel901-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/37)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0xCDE5584F(3454359631)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 7207, flow_id: HW:5207, sibling_flags 80000048, crypto map: Tunnel901-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/67)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
   
     outbound ah sas:

     outbound pcp sas:

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 1.1.1.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #pkts no sa (send) 0, #pkts invalid sa (rcv) 0
    #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
    #pkts invalid prot (recv) 0, #pkts verify failed: 0
    #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
    #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
    ##pkts replay failed (rcv): 0
    #pkts tagged (send): 0, #pkts untagged (rcv): 0
    #pkts not tagged (send): 0, #pkts not untagged (rcv): 0
    #pkts internal err (send): 0, #pkts internal err (recv) 0

     local crypto endpt.: 10.2.1.6, remote crypto endpt.: 1.1.1.1
     plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

Некоторые debug-команды:

Router_Confignet#debug crypto ikev2 ?
  client    Client
  cluster   IKEv2 Cluster load-balancer debugging
  error     IKEv2 Error debugging
  internal  IKEv2 Internal debugging
  packet    IKEv2 Packet debugging
  <cr>

Router_Confignet#debug crypto ikev2
Router_Confignet#debug crypto ikev2 error
Router_Confignet#debug crypto ikev2 internal
Router_Confignet#debug crypto ikev2 packet

IT и Телеком: IP-телефония, интернет-технологии, программирование, web-сервисы.

Вложения:

Последнее редактирование: 7 мес. 2 нед. назад от TOLLIFi.

Пожалуйста Войти или Регистрация, чтобы присоединиться к беседе.

В начало
Назад
1
Вперёд
В конец

Joomla Templates Best Joomla Templates Premium Joomla Templates Free Joomla Templates

Forum Login

Работает на Kunena форум