- 產品與解決方案
- 行業解決方案
- 服務
- 支持
- 合作夥伴
- 關於我們
25-MSR係列路由器ISISv6 over GRE over IPsec方式穿越NAT功能的配置舉例
本章節下載： 25-MSR係列路由器ISISv6 over GRE over IPsec方式穿越NAT功能的配置舉例 (161.43 KB)
MSR係列路由器ISISv6 over GRE over IPsec方式穿越NAT功能的配置舉例
|
Copyright © 2014杭州華三通信技術有限公司 版權所有，保留一切權利。 非經本公司書麵許可，任何單位和個人不得擅自摘抄、複製本文檔內容的部分或全部， 並不得以任何形式傳播。本文檔中的信息可能變動，恕不另行通知。 |
|
目 錄
本文檔介紹MSR係列路由器ISISv6 over GRE over IPsec方式穿越NAT功能的典型配置舉例。
本文檔不嚴格與具體軟、硬件版本對應，如果使用過程中與產品實際情況有差異，請參考相關產品手冊，或以設備實際情況為準。
本文檔中的配置均是在實驗室環境下進行的配置和驗證，配置前設備的所有參數均采用出廠時的缺省配置。如果您已經對設備進行了配置，為了保證配置效果，請確認現有配置和以下舉例中的配置不衝突。
本文檔假設您已了解IPsec、ISIS、IPv6和NAT特性。
如圖1所示，Router A 和Router C是Ipv6孤島的出口網關，Router B是一台NAT設備，要求：
· Router A和Router C建立穿越NAT的IPsec隧道，對數據流進行加密。
· 在IPsec隧道上建立基於IPv6的GRE隧道。
· 在GRE隧道中運行ISIS路由協議傳遞IPv6路由，使雙方的IPv6站點可以互通。
圖1 MSR係列路由器ISISv6 over GRE over IPsec方式穿越NAT功能的配置組網圖
· 為了使IPsec穿越NAT，必須將IKE第一階段協商模式配置為野蠻模式。
· 為了使ISIS協議傳遞IPv6路由，GRE隧道兩端和IPv6接口必須使能IS-IS路由進程的IPv6能力。
本舉例是在Release 2317版本上進行配置和驗證的。
GRE隧道兩端的IPv6地址可以手動配置，也可以自動配置鏈路本地地址。
# 配置接口Ethernet0/0的IP地址。
<RouterA> system-view
[RouterA] interface ethernet 0/0
[RouterA-Ethernet0/0] ip address 1.1.1.2 255.255.255.0
[RouterA-Ethernet0/0] quit
# 配置接口Ethernet0/1的IPv6地址。
[RouterA] interface ethernet 0/1
[RouterA-Ethernet0/1] ipv6 address 1::1/64
[RouterA-Ethernet0/1] quit
# 配置訪問外網的默認路由。
[RouterA] ip route-static 0.0.0.0 0.0.0.0 1.1.1.1
# 配置本端安全網關的名字為rta。
[RouterA] ike local-name rta
# 全局使能IPv6。
[RouterA] ipv6
# 配置IKE對等體。
[RouterA] ike peer rtc
[RouterA-ike-peer-rtc] exchange-mode aggressive
[RouterA-ike-peer-rtc] pre-shared-key 123
[RouterA-ike-peer-rtc] id-type name
[RouterA-ike-peer-rtc] remote-name rtc
# 啟用NAT穿越功能。
[RouterA-ike-peer-rtc] nat traversal
[RouterA-ike-peer-rtc] quit
# 采用安全提議的缺省配置。
[RouterA] ipsec proposal def
# 配置ESP協議采用md5認證算法。
[RouterA-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterA-ipsec-transform-set-def] quit
# 創建IPsec安全策略模板rtc。
[RouterA] ipsec policy-template rtc 1
[RouterA-ipsec-policy-template-rtc-1] ike-peer rtc
[RouterA-ipsec-policy-template-rtc-1] proposal def
[RouterA-ipsec-policy-template-rtc-1] quit
# 引用IPsec安全策略模板創建一條IPsec安全策略。
[RouterA] ipsec policy policy 1 isakmp template rtc
# 配置路由協議IPv6 ISIS。
[RouterA] isis 1
[RouterA-isis-1] network-entity 11.1111.1111.1111.00
[RouterA-isis-1] ipv6 enable
[RouterA-isis-1] quit
# 配置GRE隧道。
[RouterA] interface tunnel 0
[RouterA-Tunnel0] ipv6 address auto link-local
[RouterA-Tunnel0] source ethernet 0/0
[RouterA-Tunnel0] destination 192.168.2.1
# 使能GRE隧道IS-IS路由進程的IPv6能力。
[RouterA-Tunnel0] isis ipv6 enable 1
[RouterA-Tunnel0] quit
# 在接口Ethernet0/0上應用安全策略。
[RouterA] interface ethernet 0/0
[RouterA-Ethernet0/0] ipsec policy policy
[RouterA-Ethernet0/0] quit
# 使能接口IS-IS路由進程的IPv6能力。
[RouterA] interface ethernet 0/1
[RouterA-Ethernet0/1] isis ipv6 enable 1
[RouterA-Ethernet0/1] quit
# 配置接口Ethernet0/1的IP地址。
<RouterB> system-view
[RouterB] interface ethernet 0/1
[RouterB-Ethernet0/1] ip address 1.1.1.1 255.255.255.0
[RouterB-Ethernet0/1] quit
# 配置接口Ethernet0/0的IP地址。
[RouterB] interface ethernet 0/0
[RouterB-Ethernet0/0] ip address 192.168.2.2 255.255.255.0
[RouterB-Ethernet0/0] quit
# 創建NAT轉換地址池。
[RouterB] nat address-group 0 1.1.1.3 1.1.1.13
# 創建ACL2000,定義需要NAT轉換的數據流。
[RouterB] acl number 2000
[RouterB-acl-basic-2000] rule 0 permit source 192.168.2.1 0
[RouterB-acl-basic-2000] quit
# 在接口下配置訪問控製列表和地址池關聯。
[RouterB] interface ethernet 0/1
[RouterB-Ethernet0/1] nat outbound 2000 address-group 0
[RouterB-Ethernet0/1] quit
# 配置接口Ethernet0/0的IP地址。
<RouterC> system-view
[RouterC] interface ethernet 0/0
[RouterC-Ethernet0/0] ip address 192.168.2.1 255.255.255.0
[RouterC-Ethernet0/0] quit
# 配置接口Ethernet0/1的IPv6地址。
[RouterC] interface ethernet 0/1
[RouterC-Ethernet0/1] ipv6 address 2::1/64
[RouterC-Ethernet0/1] quit
# 配置訪問外網的默認路由。
[RouterC] ip route-static 0.0.0.0 0.0.0.0 192.168.2.2
# 配置本端安全網關的名字為rtc。
[RouterC] ike local-name rtc
# 全局使能IPv6。
[RouterC] ipv6
# 創建ACL3000,定義需要IPsec保護的數據流。
[RouterC] acl number 3000
[RouterC-acl-adv-3000] rule 0 permit gre source 192.168.2.1 0 destination 1.1.1.
2 0
[RouterC-acl-adv-3000] quit
# 配置IKE對等體。
[RouterC] ike peer rta
[RouterC-ike-peer-rta] exchange-mode aggressive
[RouterC-ike-peer-rta] pre-shared-key 123
[RouterC-ike-peer-rta] id-type name
[RouterC-ike-peer-rta] remote-name rta
[RouterC-ike-peer-rta] remote-address 1.1.1.2
# 啟用NAT穿越功能。
[RouterC-ike-peer-rta] nat traversal
[RouterC-ike-peer-rta] quit
# 采用安全提議的缺省配置。
[RouterC] ipsec proposal def
# 配置ESP協議采用md5認證算法。
[RouterC-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterC-ipsec-transform-set-def] quit
# 創建IPsec安全策略policy，其協商方式為isakmp。
[RouterC] ipsec policy policy 1 isakmp
[RouterC-ipsec-policy-isakmp-policy-1] security acl 3000
[RouterC-ipsec-policy-isakmp-policy-1] ike-peer rta
[RouterC-ipsec-policy-isakmp-policy-1] proposal def
[RouterC-ipsec-policy-isakmp-policy-1] quit
# 配置路由協議IPv6 ISIS。
[RouterC] isis 1
[RouterC-isis-1] network-entity 22.2222.2222.2222.00
[RouterC-isis-1] ipv6 enable
[RouterC-isis-1] quit
# 配置GRE隧道。
[RouterC] interface tunnel 0
[RouterC-Tunnel0] ipv6 address auto link-local
[RouterC-Tunnel0] source Ethernet0/0
[RouterC-Tunnel0] destination 1.1.1.2
# 使能GRE隧道IS-IS路由進程的IPv6能力。
[RouterC-Tunnel0] isis ipv6 enable 1
[RouterC-Tunnel0] quit
# 在接口Ethernet0/0上應用安全策略。
[RouterC] interface ethernet 0/0
[RouterC-Ethernet0/0] ipsec policy policy
[RouterC-Ethernet0/0] quit
# 使能接口IS-IS路由進程的IPv6能力。
[RouterC] interface ethernet 0/1
[RouterC-Ethernet0/1] isis ipv6 enable 1
[RouterC-Ethernet0/1] quit
完成以上配置後，Router A和Router C之間建立了能使用ISIS協議傳遞IPv6路由的GRE隧道，且數據經IPsec進行加密，並不受NAT影響。這裏Router C為例進行驗證。
# 可以通過如下顯示信息看到，Router A和Router C後的IPv6孤島可以實現互通。
<RouterC> ping ipv6 -a 2::1 1::1
PING 1::1 : 56 data bytes, press CTRL_C to break
Reply from 1::1
bytes=56 Sequence=0 hop limit=64 time = 3 ms
Reply from 1::1
bytes=56 Sequence=1 hop limit=64 time = 9 ms
Reply from 1::1
bytes=56 Sequence=2 hop limit=64 time = 3 ms
Reply from 1::1
bytes=56 Sequence=3 hop limit=64 time = 1 ms
Reply from 1::1
bytes=56 Sequence=4 hop limit=64 time = 3 ms
--- 1::1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/3/9 ms
# 可以通過如下顯示信息看到，IKE協商成功，生成了兩個階段的SA。
<RouterC> display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------------
3 1.1.1.2 RD|ST 1 IPSEC
5 1.1.1.2 RD|ST 2 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK--REKEY
# 可以通過如下顯示信息查看協商生成的IPsec SA。
<RouterC> display ipsec sa
===============================
Interface: Ethernet0/0
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "policy"
sequence number: 1
acl version: ACL4
mode: isakmp
-----------------------------
PFS: N, DH group: none
tunnel:
local address: 192.168.2.1
remote address: 1.1.1.2
flow:
sour addr: 192.168.2.1/255.255.255.255 port: 0 protocol: GRE
dest addr: 1.1.1.2/255.255.255.255 port: 0 protocol: GRE
[inbound ESP SAs]
spi: 0x3D55779D(1029011357)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5
in use setting: Tunnel
connection id: 5
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1842990/2462
anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: Y
[outbound ESP SAs]
spi: 0x22E8AAEA(585673450)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5
in use setting: Tunnel
connection id: 6
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1842991/2462
anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: Y
# 查看Router C的IPv6 IS-IS路由表。
<RouterC> display isis route ipv6
Route information for ISIS(1)
-----------------------------
ISIS(1) IPv6 Level-1 Forwarding Table
-------------------------------------
Destination: 2:: PrefixLen: 64
Flag : D/L/- Cost : 10
Next Hop : Direct Interface: Eth0/0
Flags: D-Direct, R-Added to RM, L-Advertised in LSPs, U-Up/Down Bit Set
ISIS(1) IPv6 Level-2 Forwarding Table
-------------------------------------
Destination: 1:: PrefixLen: 64
Flag : R/-/- Cost : 20
Next Hop : FE80::101:102 Interface: Tun0
FE80::20F:E2FF:FE3A:FF6B Eth0/0
Destination: 2:: PrefixLen: 64
Flag : D/L/- Cost : 10
Next Hop : Direct Interface: Eth0/0
Flags: D-Direct, R-Added to RM, L-Advertised in LSPs, U-Up/Down Bit Set
# 查看Router C的Tunnel接口狀態。
<RouterC> display interface tunnel0
Tunnel0 current state: UP
Line protocol current state: UP
Description: Tunnel0 Interface
The Maximum Transmit Unit is 1476
Internet protocol processing : disabled
Encapsulation is TUNNEL, service-loopback-group ID not set.
Tunnel source 192.168.2.1 (Ethernet0/0), destination 1.1.1.2
Tunnel bandwidth 64 (kbps)
Tunnel keepalive disabled
Tunnel protocol/transport GRE/IP
GRE key disabled
Checksumming of GRE packets disabled
Output queue : (Urgent queuing : Size/Length/Discards) 0/100/0
Output queue : (Protocol queuing : Size/Length/Discards) 0/500/0
Output queue : (FIFO queuing : Size/Length/Discards) 0/75/0
Last clearing of counters: Never
Last 300 seconds input: 177 bytes/sec, 0 packets/sec
Last 300 seconds output: 177 bytes/sec, 0 packets/sec
737 packets input, 1039698 bytes
0 input error
747 packets output, 1044505 bytes
0 output error
· Router A：
#
ike local-name rta
#
ipv6
#
ike peer rtc
exchange-mode aggressive
pre-shared-key cipher $c$3$A3MTEVjp+dMILVyV4Uw0kFcJMYfrJA==
id-type name
remote-name rtc
nat traversal
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy-template rtc 1
ike-peer rtc
transform-set def
#
ipsec policy policy 1 isakmp template rtc
#
isis 1
network-entity 11.1111.1111.1111.00
#
ipv6 enable
#
interface Ethernet0/1
port link-mode route
ipv6 address 1::1/64
isis ipv6 enable 1
interface Ethernet0/0
port link-mode route
ip address 1.1.1.2 255.255.255.0
ipsec policy policy
#
interface Tunnel0
ipv6 address auto link-local
source Ethernet0/0
destination 192.168.2.1
isis ipv6 enable 1
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.1
#
· Router B：
#
nat address-group 0 1.1.1.3 1.1.1.13
#
acl number 2000
rule 0 permit source 192.168.2.1 0
#
interface Ethernet0/0
port link-mode route
ip address 192.168.2.2 255.255.255.0
#
interface Ethernet0/1
port link-mode route
nat outbound 2000 address-group 0
ip address 1.1.1.1 255.255.255.0
#
· Router C：
#
ike local-name rtc
#
ipv6
#
acl number 3000
rule 0 permit gre source 192.168.2.1 0 destination 1.1.1.2 0
#
ike peer rta
exchange-mode aggressive
pre-shared-key cipher $c$3$P1CRcMmHfxHOxGxGEw499ashSB37tQ==
id-type name
remote-name rta
remote-address 1.1.1.2
nat traversal
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy policy 1 isakmp
security acl 3000
ike-peer rta
transform-set def
#
isis 1
network-entity 22.2222.2222.2222.00
#
ipv6 enable
#
interface Ethernet0/1
port link-mode route
ipv6 address 2::1/64
isis ipv6 enable 1
#
interface Ethernet0/0
port link-mode route
ip address 192.168.2.1 255.255.255.0
ipsec policy policy
#
interface Tunnel0
ipv6 address auto link-local
source Ethernet0/0
destination 1.1.1.2
isis ipv6 enable 1
#
ip route-static 0.0.0.0 0.0.0.0 192.168.2.2
#
· H3C MSR 係列路由器 命令參考(V5)-R2311
· H3C MSR 係列路由器 配置指導(V5)-R2311
不同款型規格的資料略有差異, 詳細信息請向具體銷售和400谘詢。H3C保留在沒有任何通知或提示的情況下對資料內容進行修改的權利!
支持
