国家 / 地区

H3C MSR系列路由器典型配置举例(V5)-6W100

19-MSR系列路由器IPsec with VRRP典型配置举例

本章节下载  (139.37 KB)

docurl=/cn/Service/Document_Software/Document_Center/Routers/Catalog/MSR/MSR_50/Configure/Typical_Configuration_Example/H3C_MSR_(V5)-6W100/201401/812730_30005_0.htm

19-MSR系列路由器IPsec with VRRP典型配置举例

MSR系列路由器IPsec with VRRP典型配置举例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 



1  简介

本文档介绍IPsec with VRRP的典型配置举例。

IPsec支持隧道一端采用VRRP的虚拟IP地址进行IKE协商。利用DPD的特性,还可以做到在使用VRRP地址的隧道一端,当Master故障时,IKE重新与Slave进行协商,重新建立IPsec隧道。

2  配置前提

本文档不严格与具体软、硬件版本对应,如果使用过程中与产品实际情况有差异,请参考相关产品手册,或以设备实际情况为准。

本文档中的配置均是在实验室环境下进行的配置和验证,配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置,为了保证配置效果,请确认现有配置和以下举例中的配置不冲突。

本文档假设您已了解IPsec和VRRP特性。

3  配置举例

3.1  组网需求

图1所示,RouterA是分支的接入路由器,RouterB和RouterC分别是总部的主用和备用路由器,分支机构在40.0.0.0网段,总部在30.0.0.0网段,要求:RouterA与VRRP的虚拟地址建立IPsec隧道,配合DPD特性,实现在主用路由器故障时的动态切换。

图1 IPsec with VRRP配置组网图

 

3.2  配置思路

·     为了让Router B成为Master,需要为Router B配置较高的优先级(默认优先级为100);

·     为了与备份组建立IPsec隧道,Router A上IKE指定对端地址为VRRP虚地址;

3.3  使用版本

本举例是在Release 2317版本上进行配置和验证的。

3.4  配置注意事项

配置VRRP虚地址的一端如果作为发起方,还是会选取接口的主地址进行协商,因此在IPsec与VRRP的组合应用环境中,应该让配置VRRP的一方作为IKE协商的响应方,而非发起方。

3.5  配置步骤

3.5.1  RouterA的配置

# 创建ACL3000,定义需要IPsec保护的数据流。

<RouterA> system-view

[RouterA] acl number 3000

[RouterA-acl-adv-3000] rule 0 permit ip source 40.0.0.0 0.255.255.255 destination 30.0.0.0 0.255.255.255

[RouterA-acl-adv-3000] quit

# 创建一个DPD并采用默认配置。

[RouterA] ike dpd 1

[RouterA-ike-dpd-1] quit

# 配置IKE 对等体。

[RouterA] ike peer vrrp

[RouterA-ike-peer-vrrp] pre-shared-key vrrp

[RouterA-ike-peer-vrrp] remote-address 20.1.1.100

[RouterA-ike-peer-vrrp] dpd 1

[RouterA-ike-peer-vrrp] quit

# 采用IPsec安全提议的缺省配置。

[RouterA] ipsec proposal vrrp

[RouterA-ipsec-proposal-vrrp] quit

# 配置IPsec策略。

[RouterA] ipsec policy vrrp 1 isakmp

[RouterA-ipsec-policy-isakmp-vrrp-1] security acl 3000

[RouterA-ipsec-policy-isakmp-vrrp-1] ike-peer vrrp

[RouterA-ipsec-policy-isakmp-vrrp-1] proposal vrrp

[RouterA-ipsec-policy-isakmp-vrrp-1] quit

# 在接口Ethernet0/0上应用IPsec策略。

[RouterA] interface ethernet 0/0

[RouterA-Ethernet0/0] port link-mode route

[RouterA-Ethernet0/0] ip address 20.1.1.3 255.0.0.0

[RouterA-Ethernet0/0] ipsec policy vrrp

[RouterA-Ethernet0/0] quit

[RouterA] ip route-static 30.0.0.0 255.0.0.0 20.1.1.100

3.5.2  RouterB的配置

# 创建ACL3000,定义需要IPsec保护的数据流。

<RouterB> system-view

[RouterB] acl number 3000

[RouterB-acl-adv-3000] rule 0 permit ip source 30.0.0.0 0.255.255.255 destination 40.0.0.0 0.255.255.255

[RouterB-acl-adv-3000] quit

# 配置IKE对等体。

[RouterB] ike peer vrrp

[RouterB-ike-peer-vrrp] pre-shared-key vrrp

[RouterB-ike-peer-vrrp] remote-address 20.1.1.3

[RouterB-ike-peer-vrrp] quit

# 配置IPsec安全提议。

[RouterB] ipsec proposal vrrp

[RouterB-ipsec-proposal-vrrp] encapsulation-mode tunnel

[RouterB-ipsec-proposal-vrrp] transform esp

[RouterB-ipsec-proposal-vrrp] esp encryption-algorithm des

[RouterB-ipsec-proposal-vrrp] esp authentication-algorithm md5

[RouterB-ipsec-proposal-vrrp] quit

# 配置IPsec策略。

[RouterB] ipsec policy vrrp 1 isakmp

[RouterB-ipsec-policy-isakmp-vrrp-1] security acl 3000

[RouterB-ipsec-policy-isakmp-vrrp-1] ike-peer vrrp

[RouterB-ipsec-policy-isakmp-vrrp-1] proposal vrrp

[RouterB-ipsec-policy-isakmp-vrrp-1] quit

# 配置VRRP。

[RouterB] interface gigabitethernet 0/0

[RouterB-GigabitEthernet0/0] vrrp vrid 100 virtual-ip 20.1.1.100

[RouterB-GigabitEthernet0/0] vrrp vrid 100 priority 150

# 在接口GigabitEthernet0/0上应用IPsec策略。

[RouterB-GigabitEthernet0/0] ipsec policy vrrp

[RouterB-GigabitEthernet0/0] quit

[RouterB] ip route-static 40.0.0.0 255.0.0.0 20.1.1.3

3.5.3  RouterC的配置

# 创建ACL3000,定义需要IPsec保护的数据流。

<RouterC> system-view

[RouterC] acl number 3000

[RouterC-acl-adv-3000] rule 0 permit ip source 30.0.0.0 0.255.255.255 destination 40.0.0.0 0.255.255.255

[RouterC-acl-adv-3000] quit

# 配置IKE 对等体。

[RouterC] ike peer vrrp

[RouterC-ike-peer-vrrp] pre-shared-key vrrp

[RouterC-ike-peer-vrrp] remote-address 20.1.1.3

[RouterC-ike-peer-vrrp] quit

# 配置IPSec安全提议。

[RouterC] ipsec proposal vrrp

[RouterC-ipsec-proposal-vrrp] encapsulation-mode tunnel

[RouterC-ipsec-proposal-vrrp] transform esp

[RouterC-ipsec-proposal-vrrp] esp encryption-algorithm des

[RouterC-ipsec-proposal-vrrp] esp authentication-algorithm md5

[RouterC-ipsec-proposal-vrrp] quit

# 配置IPsec策略。

[RouterC] ipsec policy vrrp 1 isakmp

[RouterC-ipsec-policy-isakmp-vrrp-1] security acl 3000

[RouterC-ipsec-policy-isakmp-vrrp-1] ike-peer vrrp

[RouterC-ipsec-policy-isakmp-vrrp-1] proposal vrrp

[RouterC-ipsec-policy-isakmp-vrrp-1] quit

# 配置VRRP。

[RouterC] interface eigabitethernet 0/0

[RouterC-GigabitEthernet0/0] vrrp vrid 100 virtual-ip 20.1.1.100

# 在接口GigabitEthernet0/0上应用IPsec策略。

[RouterC-GigabitEthernet0/0] ipsec policy vrrp

[RouterC-GigabitEthernet0/0] quit

[RouterC] ip route-static 40.0.0.0 255.0.0.0 20.1.1.3

3.6  验证配置

# 查看VRRP状态,RouterB拥有更高的VRRP优先级,因此VRRP协商状态应为Master,RouterC为Backup。

%Jun 12 10:48:39:160 2006 RouterB VRRP/5/MasterChange:

 IPv4 GigabitEthernet0/0/0 | Virtual Router 100 :  BACKUP --> MASTER    reason:Timer fired

%Jun 12 10:48:42:744 2006 RouterC VRRP/5/MasterChange:

IPv4 GigabitEthernet0/0/0 | Virtual Router 100 :  MASTER --> BACKUP    reason:Received VRRP packet

# 从分支机构ping总部的IP地址,IKE协商成功后可以ping通。

<RouterA> ping -a 40.1.1.1 30.1.1.1

  PING 30.1.1.1: 56  data bytes, press CTRL_C to break

    Reply from 30.1.1.1: bytes=56 Sequence=1 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=2 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=3 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=4 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=5 ttl=255 time=1 ms

 

  --- 30.1.1.1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 1/1/1 ms

# 通过diplay ike sadisplay ipsec sa brief命令可以在RouterARouterB上查看到sa建立情况:

<RouterA> display ike sa

    total phase-1 SAs:  1

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

       19          20.1.1.100      RD|ST         2     IPSEC

       18          20.1.1.100      RD|ST         1     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

<RouterA> display ipsec sa brief

 total phase-2 SAs: 2

Src Address     Dst Address     SPI        Protocol  Algorithm

--------------------------------------------------------------

20.1.1.3        20.1.1.100      1795685915 ESP       E:DES

                                                     A:HMAC-MD5-96;

20.1.1.100      20.1.1.3        1353813377 ESP       E:DES

                                                     A:HMAC-MD5-96;

 

<RouterB> display ike sa

    total phase-1 SAs:  1

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

        9          20.1.1.3        RD            2     IPSEC

        8          20.1.1.3        RD            1     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

<RouterB> display ipsec sa brief

 total phase-2 SAs: 2

Src Address     Dst Address     SPI        Protocol  Algorithm

--------------------------------------------------------------

20.1.1.3        20.1.1.100      1795685915 ESP       E:DES

                                                     A:HMAC-MD5-96;

20.1.1.100      20.1.1.3        1353813377 ESP       E:DES

                                                     A:HMAC-MD5-96;

# 关闭RouterB的GigabitEthernet0/0接口,RouterBVRRP状态切换到backupRouterCVRRP状态切换到Master。重新从分支机构ping总部的IP地址,DPD监测到对端SA不存在,重试3次后,会删除本端SA,重新与RouterC进行IKE协商,建立SA后,可以ping通。

%Jun 12 10:59:10:291 2006 RouterB VRRP/5/MasterChange:

IPv4 GigabitEthernet0/0/0 | Virtual Router 100 :  MASTER --> INITIALIZE    reason: Received interface event

%Jun 12 10:59:15:151 2006 RouterC VRRP/5/MasterChange:

IPv4 GigabitEthernet0/0/0 | Virtual Router 100 :  BACKUP --> MASTER    reason:Timer fired

 

<RouterA> ping -a 40.1.1.1 30.1.1.1

  PING 30.1.1.1: 56  data bytes, press CTRL_C to break

    Request time out

    Request time out

    Request time out

    Request time out

    Request time out

    Reply from 30.1.1.1: bytes=56 Sequence=1 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=2 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=3 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=4 ttl=255 time=1 ms

    Reply from 30.1.1.1: bytes=56 Sequence=5 ttl=255 time=1 ms

 

  --- 30.1.1.1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 1/1/1 ms

 

<RouterC> display ike sa

    total phase-1 SAs:  1

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

        5          20.1.1.3        RD            2     IPSEC

        6          20.1.1.3        RD            1     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

<RouterC> display ipsec sa brief

 total phase-2 SAs: 2

Src Address     Dst Address     SPI        Protocol  Algorithm

--------------------------------------------------------------

20.1.1.3        20.1.1.100      483652851  ESP       E:DES

                                                     A:HMAC-MD5-96;

20.1.1.100      20.1.1.3        1727023681 ESP       E:DES

                                                     A:HMAC-MD5-96;

# RouterBGigabitEthernet0/0接口重新UP时,VRRP状态切换会MASTER,从分支到总部的数据流会重新发送到RouterB上,DPD发现SA不存在重传超时后,RouterA删除SA重新与RouterB进行IKE协商,协商成功后分支到总部的数据流会在新的IPSec隧道上得以传输。

3.7  配置文件

·     Router A:

#

acl number 3000

 rule 0 permit ip source 40.0.0.0 0.255.255.255 destination 30.0.0.0 0.255.255.255

#

ike dpd 1

#

ike peer vrrp

 pre-shared-key cipher kswMMJ0oAIg=

 remote-address 20.1.1.100

 dpd 1

#

ipsec proposal vrrp

#

ipsec policy vrrp 1 isakmp

 security acl 3000

 ike-peer vrrp

 proposal vrrp

#

interface Ethernet0/0

 port link-mode route

 ip address 20.1.1.3 255.0.0.0

 ipsec policy vrrp

#

ip route-static 30.0.0.0 255.0.0.0 20.1.1.100

#

·     Router B

#

acl number 3000

 rule 0 permit ip source 30.0.0.0 0.255.255.255 destination 40.0.0.0 0.255.255.255

#

ike peer vrrp

 pre-shared-key cipher kswMMJ0oAIg=

 remote-address 20.1.1.3

#

ipsec proposal vrrp

encapsulation-mode tunnel

 transform esp

 esp encryption-algorithm des

 esp authentication-algorithm md5

#

ipsec policy vrrp 1 isakmp

 security acl 3000

 ike-peer vrrp

 proposal vrrp

#

interface GigabitEthernet0/0

 port link-mode route

 ip address 20.1.1.1 255.0.0.0

 vrrp vrid 100 virtual-ip 20.1.1.100

 vrrp vrid 100 priority 150

 ipsec policy vrrp

#

ip route-static 40.0.0.0 255.0.0.0 20.1.1.3

#

·     Router C:

#

acl number 3000

 rule 0 permit ip source 30.0.0.0 0.255.255.255 destination 40.0.0.0 0.255.255.255

#

ike peer vrrp

 pre-shared-key cipher kswMMJ0oAIg=

 remote-address 20.1.1.3

#

ipsec proposal vrrp

encapsulation-mode tunnel

 transform esp

 esp encryption-algorithm des

 esp authentication-algorithm md5

#

ipsec policy vrrp 1 isakmp

 security acl 3000

 ike-peer vrrp

 proposal vrrp

#

interface GigabitEthernet0/0

 port link-mode route

 ip address 20.1.1.2 255.0.0.0

 vrrp vrid 100 virtual-ip 20.1.1.100

 ipsec policy vrrp

#

ip route-static 40.0.0.0 255.0.0.0 20.1.1.3

#

4  相关资料

·     H3C MSR 系列路由器 命令参考(V5)-R2311

·     H3C MSR 系列路由器 配置指导(V5)-R2311

不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!