国家 / 地区

H3C MSR系列路由器典型配置举例(V5)-6W100

15-MSR系列路由器IKE DPD功能的配置举例

本章节下载  (138.64 KB)

docurl=/cn/Service/Document_Software/Document_Center/Routers/Catalog/MSR/MSR_50/Configure/Typical_Configuration_Example/H3C_MSR_(V5)-6W100/201401/812726_30005_0.htm

15-MSR系列路由器IKE DPD功能的配置举例

MSR系列路由器IKE DPD功能的配置举例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

H3C_彩色.emf

 



1  简介

本文档介绍MSR系列路由器IKE DPD功能的典型配置举例。

2  配置前提

本文档不严格与具体软、硬件版本对应,如果使用过程中与产品实际情况有差异,请参考相关产品手册,或以设备实际情况为准。

本文档中的配置均是在实验室环境下进行的配置和验证,配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置,为了保证配置效果,请确认现有配置和以下举例中的配置不冲突。

本文档假设您已了解IPsec特性。

3  配置举例

3.1  组网需求

图1所示,Router A和Router B之间建立IPsec连接。要求:在Router A和Router B上都配置DPD功能进行对等体存活状态检测。

图1 MSR系列路由器IKE DPD功能的配置组网图

 

3.2  使用版本

本举例是在Release 2317版本上进行配置和验证的。

3.3  配置注意事项

DPD实验不要采用2台设备直连方式,因为在这种方式下把网线、链路层Down,不会有路由,所以用于触发IPsec的包不会发送到接口,因而也不能触发任何IPsec模块。

3.4  配置步骤

3.4.1  Router A的配置

# 配置接口Ethernet0/0的IP地址。

<RouterA> system-view

[RouterA] interface ethernet 0/0

[RouterA-Ethernet0/0] ip address 1.2.0.2 255.255.255.252

[RouterA-Ethernet0/0] quit

# 配置ACL,定义由1.2.0.2/30到1.2.0.1/30的数据流。

[RouterA] acl number 3000

[RouterA-acl-adv-3000] rule 0 permit ip source 1.2.0.2 0 destination 1.2.0.1 0

[RouterA-acl-adv-3000] quit

# 创建一个DPD并采用默认配置。

[RouterA] ike dpd dpdgroup

[RouterA-ike-dpd-dpdgroup] quit

# 配置IKE对等体。

[RouterA] ike peer branch

[RouterA-ike-peer-branch] pre-shared-key 123

[RouterA-ike-peer-branch] remote-address 1.2.0.1

# 引用指定的DPD。

[RouterA-ike-peer-branch] dpd dpdgroup

[RouterA-ike-peer-branch] quit

# 采用安全提议的缺省配置。

[RouterA] ipsec proposal def

[RouterA-ipsec-transform-set-def] esp authentication-algorithm md5

[RouterA-ipsec-transform-set-def] quit

# 配置IPsec安全策略branch,其协商方式为isakmp

[RouterA] ipsec policy branch 1 isakmp

[RouterA-ipsec-policy-isakmp-branch-1] security acl 3000

[RouterA-ipsec-policy-isakmp-branch-1] ike-peer branch

[RouterA-ipsec-policy-isakmp-branch-1] proposal def

[RouterA-ipsec-policy-isakmp-branch-1] quit

# 在接口上应用安全策略。

[RouterA] interface ethernet 0/0

[RouterA-Ethernet0/0] ipsec policy branch

[RouterA-Ethernet0/0] quit

3.4.2  Router B的配置

# 配置接口Ethernet0/0的IP地址。

<RouterB> system-view

[RouterB] interface ethernet 0/0

[RouterB-Ethernet0/0] ip address 1.2.0.1 255.255.255.252

[RouterB-Ethernet0/0] quit

# 配置ACL,定义由1.2.0.1/30到1.2.0.2/30的数据流。

[RouterB] acl number 3000

[RouterB-acl-adv-3000] rule 0 permit ip source 1.2.0.1 0 destination 1.2.0.2 0

[RouterB-acl-adv-3000] quit

# 创建一个DPD并采用默认配置。

[RouterB] ike dpd dpdgroup

[RouterB-ike-dpd-dpdgroup] quit

# 配置IKE对等体。

[RouterB] ike peer center

[RouterB-ike-peer-center] pre-shared-key 123

[RouterB-ike-peer-center] remote-address 1.2.0.2

# 引用指定的DPD。

[RouterB-ike-peer-center] dpd dpdgroup

[RouterB-ike-peer-center] quit

# 采用安全提议的缺省配置。

[RouterB] ipsec proposal def

[RouterB-ipsec-transform-set-def] esp authentication-algorithm md5

[RouterB-ipsec-transform-set-def] quit

# 配置IPsec安全策略center,其协商方式为isakmp

[RouterB] ipsec policy center 1 isakmp

[RouterB-ipsec-policy-isakmp-center-1] security acl 3000

[RouterB-ipsec-policy-isakmp-center-1] ike-peer center

[RouterB-ipsec-policy-isakmp-center-1] proposal def

[RouterB-ipsec-policy-isakmp-center-1] quit

# 在接口上应用安全策略。

[RouterB] interface ethernet 0/0

[RouterB-Ethernet0/0] ipsec policy center

[RouterB-Ethernet0/0] quit

3.5  验证配置

以上配置完成后,IPsec建立,即可进行对等体存活检测。此处以Router A为例进行验证。

# 通过ping触发建立IPsec会话:

<RouterA> ping 1.2.0.1

  PING 1.2.0.1: 56  data bytes, press CTRL_C to break

    Request time out

    Reply from 1.2.0.1: bytes=56 Sequence=1 ttl=255 time=3 ms

    Reply from 1.2.0.1: bytes=56 Sequence=2 ttl=255 time=2 ms

    Reply from 1.2.0.1: bytes=56 Sequence=3 ttl=255 time=3 ms

    Reply from 1.2.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms

 

  --- 1.2.0.1 ping statistics ---

    5 packet(s) transmitted

    4 packet(s) received

    20.00% packet loss

round-trip min/avg/max = 2/2/3 ms

# 可以通过如下显示信息看到,Router A作为发起方已与Router B协商生成了两个阶段的SA。

<RouterA> display ike sa

    total phase-1 SAs:  1

    connection-id  peer                    flag        phase   doi

  ----------------------------------------------------------------

     1             1.2.0.1                 RD|ST       1       IPSEC

     2             1.2.0.1                 RD|ST       2       IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK—REKEY

# 可以通过如下显示信息查看协商生成的IPsec SA

<RouterA> display ipsec sa

===============================

Interface: Ethernet0/0

    path MTU: 1500

===============================

 

  -----------------------------

  IPsec policy name: "branch"

  sequence number: 1

  acl version: ACL4

  mode: isakmp

  -----------------------------

    PFS: N, DH group: none

    tunnel:

        local  address: 1.2.0.2

        remote address: 1.2.0.1

    flow:

        sour addr: 1.2.0.2/255.255.255.255  port: 0  protocol: IP

        dest addr: 1.2.0.1/255.255.255.255  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 0xBC64491(197543057)

      transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 1

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843199/3098

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 0x6F69A823(1869195299)

      transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 2

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843199/3098

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

# 打开Debugging IKE DPD的开关。

<RouterA> debugging ike dpd

<RouterA> terminal debugging

Info: Current terminal debugging is on.

<RouterA> terminal monitor

Info: Current terminal monitor is on.

# 连续发出100个包进行测试。

<RouterA> ping -c 100 1.2.0.1

  PING 1.2.0.1: 56  data bytes, press CTRL_C to break

# 发包前会发出DPD请求。

*Jun 17 15:47:31:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: branch send dpd request message(seqno:59559045)

# 收到了对方发出的DPD应答。

*Jun 17 15:47:32:002 2013 RouterA IKE/7/DEBUG:

IKE_DPD: recv dpd response message(seqno:59559045)

*Jun 17 15:47:32:002 2013 RouterA IKE/7/DEBUG:

IKE_DPD: PF_KEY notify ipsec to update dpd recv_time.

    Reply from 1.2.0.1: bytes=56 Sequence=0 ttl=255 time=7 ms

    Reply from 1.2.0.1: bytes=56 Sequence=1 ttl=255 time=2 ms

    Reply from 1.2.0.1: bytes=56 Sequence=2 ttl=255 time=3 ms

    Reply from 1.2.0.1: bytes=56 Sequence=3 ttl=255 time=2 ms

    Reply from 1.2.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms

    Reply from 1.2.0.1: bytes=56 Sequence=5 ttl=255 time=3 ms

    Reply from 1.2.0.1: bytes=56 Sequence=6 ttl=255 time=2 ms

Reply from 1.2.0.1: bytes=56 Sequence=7 ttl=255 time=3 ms

# 此时Branch端拔掉网线。

    Request time out

    Request time out

    Request time out

# 在等候一段时间后发送第一个DPD请求。

*Jun 17 15:48:31:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: branch send dpd request message(seqno:59559045)

    Request time out

    Request time out

# 发送第一个DPD请求后,等待5秒后超时。

*Jun 17 15:48:31:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: wait for response timeout

# 发送第二个DPD请求。

*Jun 17 15:48:36:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: branch send dpd request message(seqno:59559045)

    Request time out

    Request time out

# 第二个请求等候超时。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: wait for response timeout

# 发送第三个DPD请求。

*Jun 17 15:48:46:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: branch send dpd request message(seqno:59559045)

    Request time out

    Request time out

# 第三个请求等候超时。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: wait for response timeout

# DPD三次请求超时后删除所有SA。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:

IKE_DPD: there are three fail and all SAs associated were deleted

    Request time out

    Request time out

# 再次察看,已不存在任何SA。

<RouterA> display ike sa

    total phase-1 SAs:  0

    connection-id  peer                    flag        phase   doi

  ----------------------------------------------------------------

 

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK--REKEY

3.6  配置文件

·     Router A:

acl number 3000

 rule 0 permit ip source 1.2.0.2 0 destination 1.2.0.1 0

#

ike dpd dpdgroup

#

ike peer branch

 pre-shared-key cipher $c$3$MobqI+3fm3cTUxd2w6SRHBUPNUVU7Q==

 remote-address 1.2.0.1

 dpd dpdgroup

#

ipsec transform-set def

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

#

ipsec policy branch 1 isakmp

 security acl 3000

 ike-peer branch

 transform-set def

#

interface Ethernet0/0

 port link-mode route

ip address 1.2.0.2 255.255.255.252

 ipsec policy branch

#

·     Router B:

acl number 3000

 rule 0 permit ip source 1.2.0.1 0 destination 1.2.0.2 0

#

ike dpd dpdgroup

#

ike peer center

 pre-shared-key cipher $c$3$y9shh89pN5at95nRCMBmm55d7G0WQg==

 remote-address 1.2.0.2

 dpd dpdgroup

#

ipsec transform-set def

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

#

ipsec policy center 1 isakmp

 security acl 3000

 ike-peer center

 transform-set def

#

interface Ethernet0/0

 port link-mode route

ip address 1.2.0.1 255.255.255.252

 ipsec policy center

#

4  相关资料

·     H3C MSR 系列路由器 命令参考(V5)-R2311

·     H3C MSR 系列路由器 配置指导(V5)-R2311

不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!