Ipsec 详细配置

1.Berlin(config)#crypto isakmp enable

启用IKE/isakmp(建立传送IPsec隧道参数的隧道)

2.Berlin(config)#crypto isakmp policy 1

设置isakmp策略

Berlin(config-isakmp)#authentication pre-share

身份验证方法：pre-share/rsa-encr/rsa-sig

Berlin(config-isakmp)#encryption 3des

加密的方法：des/3des/aes

Berlin(config-isakmp)#group 5

传密钥的方法D-H算法：1/2/5

Berlin(config-isakmp)#hash sha

完整性的方法：md5/sha

Berlin(config-isakmp)#lifetime 3600

isakmp/IKE的SA的存在时间

Berlin(config-isakmp)#exit

Berlin(config)#crypto isakmp key cisco address 192.168.0.1

预共享密钥是什么，IKE/isakmp对端是什么

3.Berlin(config)#crypto ipsec transform-set 10 esp-3des ah-sha-hmac

配置IPSec转换集合

Berlin(cfg-crypto-trans)#mode tunnel

采用隧道模式还是传输模式tunnel/transport

Berlin(cfg-crypto-trans)#exit

Berlin(config)#crypto ipsec security-association lifetime seconds 3600

IPSec安全关联存在的时间

4.Berlin(config)#access-list 101 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255

什么样的流量要进隧道加密

5.Berlin(config)#crypto map mymap 110 ipsec-isakmp

建立加密映射

Berlin(config-crypto-map)#match address 101

访问控制列表101的流量要加密

Berlin(config-crypto-map)#set peer 192.168.0.1

IPSEC SA对端是192.168.0.1

Berlin(config-crypto-map)#set transform-set 10

IPSEC SA的参数采用转换集名称10

Berlin(config-crypto-map)#exit

6.Berlin(config)#int f0/0

Berlin(config-if)#crypto map mymap

加密映射应用到接口上

Berlin#show crypto isakmp policy

查看IKE/isakmp策略

Global IKE policy

Protection suite of priority 1

encryption algorithm: Three key triple DES

hash algorithm: Secure Hash Standard

authentication method: Pre-Shared Key

Diffie-Hellman group: #5 (1536 bit)

lifetime: 3600 seconds, no volume limit

Default protection suite

encryption algorithm: DES - Data Encryption Standard (56 bit keys).

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

Berlin#show crypto ipsec transform-set

查看ipsec转换集

Transform set 10: { ah-sha-hmac }

will negotiate = { Tunnel, },

{ esp-3des }

Berlin#show crypto isakmp sa

查看IKE/isakmp的安全关联

dst src state conn-id slot status

192.168.0.1 192.168.0.2 QM_IDLE 1 0 ACTIVE