模板方式配置多站点思路

模板方式配置多站点思路

第一步：基本配置

FW1防火墙的配置

#
 sysname FW1
#
interface GigabitEthernet0/0/0
 ip address 202.1.1.1 255.255.255.0
service-manage ping permit
#
interface GigabitEthernet1/0/0
 ip address 192.168.1.254 255.255.255.0
 service-manage ping permit
#
ip route-static 0.0.0.0 0.0.0.0 202.1.1.254
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet1/0/0
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/0
#
security-policy
 default action permit
#

FW2路由器的配置

#
 sysname FW2
#
interface GigabitEthernet0/0/0
 ip address 101.1.1.1 255.255.255.0
service-manage ping permit
#
interface GigabitEthernet1/0/0
 ip address 192.168.2.254 255.255.255.0
service-manage ping permit
#
ip route-static 0.0.0.0 0.0.0.0 101.1.1.254
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet1/0/0
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/0
#
security-policy
 default action permit
#

FW3路由器的配置

#
 sysname FW3
#
interface GigabitEthernet0/0/0
 ip address 60.1.1.1 255.255.255.0
service-manage ping permit
#
interface GigabitEthernet1/0/0
 ip address 192.168.3.254 255.255.255.0
service-manage ping permit
#
ip route-static 0.0.0.0 0.0.0.0 60.1.1.254
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet1/0/0
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/0
#
security-policy
 default action permit
#

internet的配置

#
interface GigabitEthernet0/0/0
 ip address 202.1.1.254 255.255.255.0
#
interface GigabitEthernet0/0/1
 ip address 101.1.1.254 255.255.255.0
#

检查如下：
检查FW1和PC1的通信

<FW1>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=128 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=128 time=60 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=128 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=128 time=60 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=128 time=50 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/50/60 ms

检查FW2和PC2的通信

[FW2]ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Reply from 192.168.2.2: bytes=56 Sequence=1 ttl=128 time=45 ms
    Reply from 192.168.2.2: bytes=56 Sequence=2 ttl=128 time=53 ms
    Reply from 192.168.2.2: bytes=56 Sequence=3 ttl=128 time=51 ms
    Reply from 192.168.2.2: bytes=56 Sequence=4 ttl=128 time=52 ms
    Reply from 192.168.2.2: bytes=56 Sequence=5 ttl=128 time=32 ms

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
round-trip min/avg/max = 32/46/53 ms

检查FW3和PC3的通信

[FW3]ping 192.168.3.3
  PING 192.168.3.3: 56  data bytes, press CTRL_C to break
    Request time out
    Reply from 192.168.3.3: bytes=56 Sequence=2 ttl=128 time=47 ms
    Reply from 192.168.3.3: bytes=56 Sequence=3 ttl=128 time=42 ms
    Reply from 192.168.3.3: bytes=56 Sequence=4 ttl=128 time=36 ms
    Reply from 192.168.3.3: bytes=56 Sequence=5 ttl=128 time=27 ms

  --- 192.168.3.3 ping statistics ---
    5 packet(s) transmitted
    4 packet(s) received
    20.00% packet loss
    round-trip min/avg/max = 27/38/47 ms

检查FW1和FW2的通信

<FW1>ping 101.1.1.1
  PING 101.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 101.1.1.1: bytes=56 Sequence=1 ttl=254 time=30 ms
    Reply from 101.1.1.1: bytes=56 Sequence=2 ttl=254 time=20 ms
    Reply from 101.1.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms
    Reply from 101.1.1.1: bytes=56 Sequence=4 ttl=254 time=20 ms
    Reply from 101.1.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms

  --- 101.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
round-trip min/avg/max = 20/28/40 ms

检查FW1和FW3的通信

[FW1]ping 60.1.1.1
  PING 60.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 60.1.1.1: bytes=56 Sequence=1 ttl=254 time=15 ms
    Reply from 60.1.1.1: bytes=56 Sequence=2 ttl=254 time=11 ms
    Reply from 60.1.1.1: bytes=56 Sequence=3 ttl=254 time=8 ms
    Reply from 60.1.1.1: bytes=56 Sequence=4 ttl=254 time=9 ms
    Reply from 60.1.1.1: bytes=56 Sequence=5 ttl=254 time=8 ms

  --- 60.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 8/10/15 ms

检查PC1和PC2的通信

PC>ping  192.168.2.2

Ping 192.168.2.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 192.168.2.2 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

检查PC1和PC3的通信

PC>ping  192.168.3.3

Ping 192.168.3.3: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 192.168.3.3 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

第二步：IPSEC 阶段一配置

IKE安全提议

在FW1和FW2和FW3分别配置如下

ike proposal 10       注意：安全提议是有默认配置，可以修改
 encryption-algorithm aes-256
 dh group14
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256       IKEv1中不用这个参数 IKEv2中使用这个参数
 prf hmac-sha2-256
#

检查：

[FW1]display ike proposal
2020-03-14 14:25:22.420 

Number of IKE Proposals: 2

-------------------------------------------
 IKE Proposal: 10
   Authentication Method      : PRE_SHARED
   Authentication Algorithm   : SHA2-256
   Encryption Algorithm       : AES-256
   Diffie-Hellman Group       : MODP-2048
   SA Duration(Seconds)       : 86400
   Integrity Algorithm        : HMAC-SHA2-256
   Prf Algorithm              : HMAC-SHA2-256
-------------------------------------------

配置IKE对等体（PEER）

FW1配置 注意: 模板方式不需要配置remote-address 也可以配置网段，也可以不配置

ike peer yuanduan  -----------取名
 pre-shared-key  [email protected]如果采用预共享方式，配置密钥
 ike-proposal 10 -----------------------------调用安全提议
 undo version 2-------------------------------关闭V2版本，默认就是V2版本
FW2和FW3的配置
ike peer fw1
 pre-shared-key [email protected]
 ike-proposal 10
 undo version 2
 remote-address 202.1.1.1

检查如下：

[FW1]display ike peer brief
2020-03-14 14:31:19.910 

Current ike peer number: 1

---------------------------------------------------------------------------
Peer name        Version  Exchange-mode   Proposal   Id-type   RemoteAddr
---------------------------------------------------------------------------
yuanduan              v1       main            10         IP

第三步：IPSEC阶段二配置

配置感兴趣流（就是实际通信点）

FW1:

acl number 3000
 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

FW2
acl number 3000
 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 

FW3
acl number 3000
 rule 5 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

注意：IKEV1感兴趣流要互为镜像，必须是相互匹配的，不是包含或者不一样的，都不能协商成功

IPSEC安全提议

在FW1和FW2和FW3配置

ipsec proposal 10
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256

检查：

[FW1]display ipsec proposal
2020-03-14 14:33:58.850 

Number of proposals: 1

IPSec proposal name: 10
 Encapsulation mode: Tunnel
 Transform         : esp-new
 ESP protocol      : Authentication SHA2-HMAC-256
                     Encryption AES-256
[FW1]

配置IPSEC安全策略

FW1

#
ipsec policy-template 10 10     第一个10是名称   第二个10是序号
 security acl 3000-----------------------调用感兴趣流
 ike-peer fw2---------------------------调用IKE PEER
 proposal 10---------------------------调用IPSEC安全
#
ipsec policy ipsec_policy 10 isakmp template 10

FW2和FW3的配置

ipsec policy ipsec_policy 10 isakmp          后面接isakmp的话是自动方式
 security acl 3000  -----------------------调用感兴趣流
 ike-peer fw1 ---------------------------调用IKE PEER
 alias ipsec_policy_10
 proposal 10  ---------------------------调用IPSEC安全

物理接口调用

在FW1和FW2和FW3上配置

interface GigabitEthernet0/0/0
 ipsec policy ipsec_policy

放行安全策略

FW1的配置

#
security-policy
 rule name ipsec1
  source-zone local
  destination-zone untrust
  source-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec2
  source-zone untrust
  destination-zone local
  destination-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec3
  source-zone trust
  destination-zone untrust
  source-address 192.168.1.0 mask 255.255.255.0
  destination-address 192.168.2.0 mask 255.255.255.0
destination-address 192.168.3.0 mask 255.255.255.0
  action permit
 rule name ipsec4
  source-zone untrust
  destination-zone trust
source-address 192.168.3.0 mask 255.255.255.0
  source-address 192.168.2.0 mask 255.255.255.0
  destination-address 192.168.1.0 mask 255.255.255.0
  action permit
#

FW2的配置

#
security-policy
 rule name ipsec1
  source-zone local
  destination-zone untrust
  destination-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec2
  source-zone untrust
  destination-zone local
  source-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec3
  source-zone trust
  destination-zone untrust
  source-address 192.168.2.0 mask 255.255.255.0
  destination-address 192.168.1.0 mask 255.255.255.0
  action permit
 rule name ipsec4
  source-zone untrust
  destination-zone trust
  source-address 192.168.1.0 mask 255.255.255.0
  destination-address 192.168.2.0 mask 255.255.255.0
  action permit
#

FW3的配置

#
security-policy
 rule name ipsec1
  source-zone local
  destination-zone untrust
  destination-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec2
  source-zone untrust
  destination-zone local
  source-address 202.1.1.0 mask 255.255.255.0
  action permit
 rule name ipsec3
  source-zone trust
  destination-zone untrust
  source-address 192.168.3.0 mask 255.255.255.0
  destination-address 192.168.1.0 mask 255.255.255.0
  action permit
 rule name ipsec4
  source-zone untrust
  destination-zone trust
  source-address 192.168.1.0 mask 255.255.255.0
  destination-address 192.168.3.0 mask 255.255.255.0
  action permit
#

测试如下：
在PC2上pingPC1

PC>ping 192.168.1.1

Ping 192.168.1.1: 32 data bytes, Press Ctrl_C to break
From 192.168.1.1: bytes=32 seq=1 ttl=126 time=94 ms
From 192.168.1.1: bytes=32 seq=2 ttl=126 time=78 ms
From 192.168.1.1: bytes=32 seq=3 ttl=126 time=94 ms
From 192.168.1.1: bytes=32 seq=4 ttl=126 time=78 ms
From 192.168.1.1: bytes=32 seq=5 ttl=126 time=62 ms

--- 192.168.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 62/81/94 ms

PC>

在PC3上pingPC1

PC>ping 192.168.1.1

Ping 192.168.1.1: 32 data bytes, Press Ctrl_C to break
From 192.168.1.1: bytes=32 seq=1 ttl=126 time=62 ms
From 192.168.1.1: bytes=32 seq=2 ttl=126 time=78 ms
From 192.168.1.1: bytes=32 seq=3 ttl=126 time=94 ms
From 192.168.1.1: bytes=32 seq=4 ttl=126 time=63 ms
From 192.168.1.1: bytes=32 seq=5 ttl=126 time=62 ms

--- 192.168.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 62/71/94 ms

在FW1上面查看ike sa

[FW1]display ike sa
2020-03-15 05:22:58.390 

IKE SA information :
 Conn-ID    Peer        ***              Flag(s)               Phase  RemoteType  RemoteID
------------------------------------------------------------------------------------------------------------------------------------
 2          101.1.1.1:500                RD|A                  v1:2   IP          101.1.1.1
 1          101.1.1.1:500                RD|A                  v1:1   IP          101.1.1.1
 4          60.1.1.1:500                 RD|A                  v1:2   IP          60.1.1.1
 3          60.1.1.1:500                 RD|A                  v1:1   IP          60.1.1.1        

  Number of IKE SA : 4
------------------------------------------------------------------------------------------------------------------------------------

 Flag Description:
 RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
 HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
 M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

在FW1上面查看ipsec sa

[FW1]display ipsec sa
2020-03-15 05:23:01.660 

ipsec sa information:

===============================
Interface: GigabitEthernet0/0/0
===============================

  -----------------------------
  IPSec policy name: "ipsec_policy"
  Sequence number  : 10
  Acl group        : 3000
  Acl rule         : 5
  Mode             : Template
  -----------------------------
    Connection ID     : 2
    Encapsulation mode: Tunnel
    Holding time      : 0d 0h 35m 23s
    Tunnel local      : 202.1.1.1:500
    Tunnel remote     : 101.1.1.1:500
    Flow source       : 192.168.1.0/255.255.255.0 0/0-65535
    Flow destination  : 192.168.2.0/255.255.255.0 0/0-65535

    [Outbound ESP SAs]
      SPI: 187921672 (0xb337508)
      Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
      SA remaining key duration (kilobytes/sec): 10485760/1476
      Max sent sequence-number: 17
      UDP encapsulation used for NAT traversal: N
      SA encrypted packets (number/bytes): 16/960

    [Inbound ESP SAs]
      SPI: 197430515 (0xbc48cf3)
      Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
      SA remaining key duration (kilobytes/sec): 10485759/1476
      Max received sequence-number: 1
      UDP encapsulation used for NAT traversal: N
      SA decrypted packets (number/bytes): 19/1140
      Anti-replay : Enable
      Anti-replay window size: 1024

  -----------------------------
  IPSec policy name: "ipsec_policy"
  Sequence number  : 10
  Acl group        : 3000
  Acl rule         : 10
  Mode             : Template
  -----------------------------
    Connection ID     : 4
    Encapsulation mode: Tunnel
    Holding time      : 0d 0h 35m 10s
    Tunnel local      : 202.1.1.1:500
    Tunnel remote     : 60.1.1.1:500
    Flow source       : 192.168.1.0/255.255.255.0 0/0-65535
    Flow destination  : 192.168.3.0/255.255.255.0 0/0-65535

    [Outbound ESP SAs]
      SPI: 197283812 (0xbc24fe4)
      Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
      SA remaining key duration (kilobytes/sec): 10485760/1489
      Max sent sequence-number: 14
      UDP encapsulation used for NAT traversal: N
      SA encrypted packets (number/bytes): 13/780

    [Inbound ESP SAs]
      SPI: 187509375 (0xb2d2a7f)
      Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
      SA remaining key duration (kilobytes/sec): 10485760/1489
      Max received sequence-number: 1
      UDP encapsulation used for NAT traversal: N
      SA decrypted packets (number/bytes): 14/840
      Anti-replay : Enable
      Anti-replay window size: 1024

在FW1上面查看ipsec加密解密情况

[FW1]display ipsec statistics
2020-03-15 05:23:12.690
 IPSec statistics information:
 Number of IPSec tunnels: 2
 Number of standby IPSec tunnels: 0
 the security packet statistics:
   input/output security packets: 33/29
   input/output security bytes: 1980/1740
   input/output dropped security packets: 0/0
   the encrypt packet statistics:
     send chip: 29, recv chip: 29, send err: 0
     local cpu: 29, other cpu: 0, recv other cpu: 0
     intact packet: 29, first slice: 0, after slice: 0
   the decrypt packet statistics:
     send chip: 33, recv chip: 33, send err: 0
     local cpu: 33, other cpu: 0, recv other cpu: 0
     reass  first slice: 0, after slice: 0
   dropped security packet detail:
     can not find SA: 0, wrong SA: 0
     authentication: 0, replay: 0
     front recheck: 0, after recheck: 0
     change cpu enc: 0, dec change cpu: 0
     fib search: 0, output l3: 0
     flow err: 0, slice err: 0, byte limit: 0
     slave drop: 0
   negotiate about packet statistics:
     IKE fwd packet ok: 10, err: 0
     IKE ctrl packet inbound ok: 10, outbound ok: 8
     SoftExpr: 0, HardExpr: 0, DPDOper: 0
     trigger ok: 0, switch sa: 2, sync sa: 0
     recv IKE nat keepalive: 0, IKE input: 0

[FW1]

原文地址：https://blog.51cto.com/13817711/2480611

时间： 2024-11-09 06:08:57

模板方式配置多站点思路的相关文章

IPSec配置模板方式配置思路

配置模板方式配置思路 ike peer fw2 exchange-mode aggressive 修改模式为野蛮 其它部分同主模式注意: 野蛮模式也必须指定remote-address , 必须配置远端地址或者域名 华为不建议野蛮模式,推荐使用模板方式 [FW1-ipsec-policy-isakmp-ipsec_policy-10]ike-peer fw2 Error: ike peer's remote addresses or domain name should be configed.

Appserv配置多站点访问（转）

这两天一直在弄着微信开发,但是贪便宜租用了两个坑爹的空间,唉,一个是版本太低,一个是没有创建权限,实在是无语 没办法之下只好租用过台空间,但是天意玩人,我搭建环境花费了两天的时间才搭建上环境,第一次大家wamp发现wamp在里面居然不好使,没办法,那只好下载个appserv 但是在里面发现apache的修改方法和wamp里面的修改方法居然不同,纠结得要命 无奈之下我只好来来找度娘,结果那些方法几乎都没多少个是可以使用的,把我好一顿恶心 废话不多说开干 Appserv配置多站点教程 第一步:下载A

AEAI Portal-虚拟菜单方式配置SSO界面集成

1.前言 一般情况下虚拟菜单集成方式:先创建虚拟菜单节点,然后配置虚拟菜单的数据URL,同时指定显示页面,在显示页面中添加虚拟IframePortlet.而且:通常情况虚拟菜单是要依赖CAS认证的. 在本文中虚拟菜单集成方式,不依赖CAS认证,而是依赖于表单认证模式.主要区别是在于,显示页面配置的不再是虚拟IframePortlet,而是配置SSO界面集成Portlet (SSORedirectPortlet),具体如下. 2.虚拟菜单配置 2.1  流程机制说明 虚拟菜单配置包括虚拟菜单目录及

java web学习总结(二十一) -------------------模拟Servlet3.0使用注解的方式配置Servlet

一.Servlet的传统配置方式 在JavaWeb开发中, 每次编写一个Servlet都需要在web.xml文件中进行配置,如下所示: 1 <servlet> 2 <servlet-name>ActionServlet</servlet-name> 3 <servlet-class>me.gacl.web.controller.ActionServlet</servlet-class> 4 </servlet> 5 6 <ser

jenkins介绍部署及三种构建方式配置

[隐藏] 1前言 1.1jenkins介绍 1.2jenkins好处 1.3我的jenkins实践 1.4jenkins使用前提 2jenkins部署 2.1下面内容介绍 2.2环境介绍 2.3jenkins安装 3插件安装 3.1手动下载jenkins插件 4Jenkins密钥配置 5jenkins触发式构建 6jenkins参数化构建 7jenkins定时构建 8Jenkins用户权限设置 8.1新创建一个用户 8.2用户权限设置 1.前言 1.1.jenkins介绍 jenkins是基于j

JavaWeb学习总结(四十八)——模拟Servlet3.0使用注解的方式配置Servlet

JavaWeb学习总结(四十八)——模拟Servlet3.0使用注解的方式配置Servlet 一.Servlet的传统配置方式 在JavaWeb开发中, 每次编写一个Servlet都需要在web.xml文件中进行配置,如下所示: 1 <servlet> 2 <servlet-name>ActionServlet</servlet-name> 3 <servlet-class>me.gacl.web.controller.ActionServlet</s

XenServer 以模板方式安装新的虚拟机后虚拟机网卡无法启动的解决办法

在XenServer上根据模板新建一个虚拟机后无法识别网卡,重新启动网卡后显示 Bringing up interface eth0:  Device eth0 has different MAC address than expected, ignoring. 最终解决办法是将/etc/sysconfig/network-scripts/ifcfg-eth0 中的HDADDR给注释掉,因为这里配置文件的MAC地址还是原来模板机的MAC地址,新配置的虚拟机的MAC地址和这个不一样,所以无法启动.

Linux：Vmware安装linux虚拟机，桥接方式配置静态IP后重启网卡，提示：Error,some other host already uses address 10.252.252.21...

问题: Vmware安装linux虚拟机,桥接方式配置静态IP后重启网卡,提示:Error,some other host already uses address 10.252.252.21... 思路: 网上查找资料,得到解决方案如下: 编辑 /etc/sysconfig/network-scripts/ifup-eth, 将 (注:RHEL5.3 )if ! arping -q -c 2 -w 3 -D -I ${REALDEVICE} ${IPADDR} ; thenecho $”Err

怎么使用Appserv配置多站点访问

在之前的Appserv教程中,我介绍了AppServ配置与安装使用教程,Appserv作为PHP集成环境安装包,可以实现多种功能,配置 Appserv实现多站点功能可方便PHP开发团队实时调试多个PHP网站,有访友向我提出怎么使用Appserv配置多站点问题,通过实践验证后,我以 Appserv教程形式来作下解答. Appserv配置多站点教程第一步:下载Appserv并安装 我下载的是Appserv-Win32-2.5.10版本,下载后直接双击并根据提示安装即可. Appserv配置多站点教程