1、IPsec VPNsConfiguring GRE Tunnels over IPsecGeneric Routing EncapsulationGeneric Routing EncapsulationOSI Layer 3 tunneling protocol:OSI第三層隧道協(xié)議:Uses IP for transport使用IP傳輸U(kuò)ses an additional header to support any other OSI Layer 3 protocol as payload (e.g., IP, IPX, AppleTalk)使用附加的報(bào)頭支持其它的第三層的協(xié)議,其它的第三

2、層的協(xié)議被作為負(fù)載(如IP,IPX,AppleTalk)Default GRE CharacteristicsTunneling of arbitrary OSI Layer 3 payload is the primary goal of GREStateless (no flow control mechanisms)No security (no confidentiality, data authentication, or integrity assurance)24-byte overhead by default (20-byte IP header and 4-byte GRE

3、 header)Optional GRE ExtensionsGRE can optionally contain any one or more of these fields:Tunnel checksumTunnel keyTunnel packet sequence numberGRE keepalives can be used to track tunnel path status.GRE Configuration ExampleGRE tunnel is up and protocol up if:Tunnel source and destination are config

4、uredTunnel destination is in routing tableGRE keepalives are received (if used)GRE is the default tunnel mode.Introducing Secure GRE TunnelsIntroducing Secure GRE TunnelsGRE is good at tunneling:GRE隧道優(yōu)點(diǎn):Multiprotocol support多協(xié)議的支持Provides virtual point-to-point connectivity, allowing routing protoco

5、ls to be used提供了虛擬的點(diǎn)到點(diǎn)的連接,允許使用路由協(xié)議GRE is poor at securityonly very basic plaintext authentication can be implemented using the tunnel key (not very secure)GRE的安全性不高通過隧道密鑰僅僅可以支持基本的明文認(rèn)證(非常不安全)Introducing Secure GRE Tunnels (Cont.)GRE cannot accommodate typical security requirements:GRE不能提供典型安全的特性:Conf

6、identiality機(jī)密性Data source authentication數(shù)據(jù)源的認(rèn)證Data integrity數(shù)據(jù)完整性IPsec CharacteristicsIPsec provides what GRE lacks:IPsec能夠提供GRE無法實(shí)現(xiàn)的如下安全特性:Confidentiality through encryption using symmetric algorithms (e.g., 3DES or AES)通過使用對稱式的加密算法實(shí)現(xiàn)數(shù)據(jù)的機(jī)密性(如3DES或AES)Data source authentication using HMACs (e.g., MD

7、5 or SHA-1)使用HMACs實(shí)現(xiàn)數(shù)據(jù)的源認(rèn)證(如MD5或SHA-1)Data integrity verification using HMACs同時(shí)HMACs還提供的數(shù)據(jù)完整性的確認(rèn)IPsec Characteristics (Cont.)IPsec is not perfect at tunneling:當(dāng)以隧道方式工作時(shí),IPsec并不是最好的:Older Cisco IOS software versions do not support IP multicast over IPsec老版的Cisco IOS軟件版本可能不支持基于IPsec的組播IPsec was design

8、ed to tunnel IP only (no multiprotocol support)IPsec僅僅設(shè)計(jì)用于IP的網(wǎng)絡(luò)環(huán)境(不支持多協(xié)議的環(huán)境)Using crypto maps to implement IPsec does not allow the usage of routing protocols across the tunnel使用加密圖實(shí)現(xiàn)的IPsec不允許一些路由協(xié)議產(chǎn)生的數(shù)據(jù)包通過隧道,其本身也不支持廣播IPsec does not tunnel IP protocols; GRE doesGRE over IPsecGRE over IPsec is typica

9、lly used to do the following:GRE over IPsec通過用于如下的情況:Create a logical hub-and-spoke topology of virtual point-to-point connections使用點(diǎn)到點(diǎn)的虛鏈路創(chuàng)建邏輯的hub-and-spoke拓?fù)銼ecure communication over an untrusted transport network (e.g., Internet)在不安全的傳輸網(wǎng)絡(luò)中保護(hù)通信(如Internet)GRE over IPsec CharacteristicsGRE encapsula

10、tes arbitrary payload.IPsec encapsulates unicast IP packet (GRE):Tunnel mode (default): IPsec creates a new tunnel IP packetTransport mode: IPsec reuses the IP header of the GRE (20 bytes less overhead)Configuring GRE over IPsec Site-to-Site Tunnel Using SDMConfiguring GRE over IPsecSite-to-Site Tun

11、nel Using SDM.3.4.Configuring GRE over IPsecSite-to-Site Tunnel Using SDM (Cont.)Configuring GRE over IPsecSite-to-Site Tunnel Using SDM (Cont.).Backup GRE Tunnel InformationBackup GRE Tunnel Information.VPN Authentication InformationVPN Authentication Information2.1A1BIKE Propo

12、salsIKE ProposalsCreating a Custom IKE PolicyDefine all IKE policy parameters:PriorityEncryption algorithm: DES, 3DES, AESHMAC: SHA-1 or MD5Authentication method: preshared secrets or digital certificatesDiffie-Hellman group: 1, 2, or 5IKE lifetimeTransform SetTransform Set1.2.3.Routing InformationR

13、outing InformationOption 1: Static RoutingOption 2: Dynamic Routing Using EIGRP1.2.Option 3: Dynamic Routing Using OSPF1.3.2.Completing the ConfigurationReview the Generated ConfigurationReview the Generated Configuration (Cont.)Test Tunnel Configuration and Operation.3.5.Test Tunnel Configur

14、ationand Operation (Cont.)7.Monitor Tunnel Operation1.2.3.Advanced MonitoringAdvanced monitoring can be performed using the default Cisco IOS HTTP server interface.Requires knowledge of Cisco IOS CLI commands.show crypto isakmp saLists active IKE sessionsrouter#show crypto ipsec saLists active IPsec

15、 security associationsrouter#show interfacesLists interface and the statistics including the statistics of tunnel interfacesrouter#Troubleshootingdebug crypto isakmprouter#Debugs IKE communicationAdvanced troubleshooting can be performed using the Cisco IOS CLIRequires knowledge of Cisco IOS CLI commandsSummaryGRE is a multiprotocol tunneling technology.SDM can be used to implement GRE over IPsec site-to-site VPNs.Backup tunnels can be configured in addition to one primary tunnel.Rou