1、CCNP第一天：IKEv2理IKEv2第二天：IOSvsCCNP第一天：IKEv2理IKEv2第二天：IOSvsASACrypto郭第三天：IOSvsIOS第四天：Router第六天：Anyconnect3.0 to ？基于IKEv2的site-to-site、remote-？基于IKEv2的site-to-site、remote-和spoken-to-spokens、hub-2.的CLI的架構：使用IOS點對點隧道接的特性：很多特性都可以在特性易于學習和管IKEv2IKEv2IKEv2vsAuth6OpenIPSec9msgs4-6msgsIKEv2vsAuth6OpenIPSec9msgs

2、4-6msgsPubkey-sig,Pubkey-Pubkey-Anti-NerverIKERequires re-Nore-IKEv2IKEv2IKE_SA_INIT(222ABProtectedKei：發起方密鑰交換材料，使用最高DHNi：發起方HDR：表示IKESAi1：發起方提交學算Ker：響應方密鑰交Ni：響應方HDR：表示IKESAr1：被響應方選HDR：表示IKECERT：發起IDr：期望的響應者ID（可選SAi2：發起方提交的child SA轉換集流HDR：表示IKECERT：響應（可選AUTH：響應方的認證數據（如果發起方使用EAP認證這個字段就不存在SAr2：發起方提交的c

3、hildSA流HDR：表示IKESK：被加密和完整性后的SA：Rekey或者child/IKENi：發起方KEi：密鑰交換（使用PFS用于IKE SA密鑰更新 HDR：表示IKESK：被加密和完整性后的SAr：響應方提交的chlid SA策Nr：響應方 Information用于日常事物管理（類似Information用于日常事物管理（類似必須確認 被安全保護（加密的 3. 作為IKE_AUTH6. 會適當增加包數量12-162.1標準2.1標準IOSvsASACrypto實驗配置1IOSIKEv2Policy（可選實驗配置1IOSIKEv2Policy（可選實驗預配（略cryptoikev2

4、alGLAB-encryption3desaes-cbc-egritysha256sha512 group 2 5 14cryptoikev2policyGLAB-alGLAB-PRF不配置默egrity一樣，可以不一樣，用來進一步把生成的隨機數進實驗配置2IOS實驗配置2IOSIKEv2cryptoikev2keyringGLAB-peerCenter-（只是個名字，本地有效address（對端IP地址（預共享密鑰實驗配置3IOS實驗配置3IOSIKEv2cryptoikev2profileGLAB-matchidentityremoteaddress61.128.1.1 identity

5、local address 202.100.1.1 authentication remote pre-share authentication local pre-sharekeyringlocalGLAB-實驗配置4IOS實驗配置4IOSIKEv2cryptoipsectransform-setTran1esp-desesp-md5-modecryptoipsectransform-setTran2esp-3desesp-sha256-hmac mode tunnel查看系統默認的Transform-實驗配置5IOSIKEv2實驗配置5IOSIKEv2流ips-listextendedGL

6、AB-permitip1.1.1.00.0.0.2552.2.2.0實驗配置6IOS實驗配置6IOSIKEv2Crypto1.配置Cryptocryptomapcrymap10ipsec-isakmp set peer 61.128.1.1set ikev2-profile GLAB-Prof match address GLAB-Traffic2.調用CryptoMaperfaceipaddress202.100.1.1cryptomap實驗配置7ASA實驗配置7ASAIKEv21. 在Outside接口激活cryptoikev2enable2.配置IKEv2crypto ikev2 pol

7、icy 10 encryptionaes-256desegritysha256sha group 2 1prfsha256實驗配置8ASAIKEv2實驗配置8ASAIKEv2tunnel-group202.100.1.1typeipsec-tunnel-group 202.100.1.1 ipsec-attributes ikev2local-authenticationpre-shared-key 實驗配置9ASAIKEv2實驗配置9ASAIKEv2cryptoipsecikev2ipsec-alprotocolespencryptionaes-192protocolegritysha-1實

8、驗配置10ASAIKEv2實驗配置10ASAIKEv2流extendedpermitip255.255.255.01.1.1.0實驗配置11ASAIKEv2Crypto實驗配置11ASAIKEv2Crypto1.配置Cryptocryptomap crymap 10 matchcryptomapcrymap10setpeercryptomapcrymap10setikev2ipsec-al2.調用CryptoM p到Outsidecryptomapcrym erface2.2IOS2.2IOScryptocryptoikev2keyringGLAB-peer Center-ASA addres

9、s 61.128.1.1 cryptoikev2profileGLAB-matchidentityremoteaddress61.128.1.1 identity local address 202.100.1.1 authentication remote pre-share authentication local pre-sharekeyringlocalGLAB-cryptomapcrymapcryptomapcrymap10ipsec-setpeersetikev2-profileGLAB-Prof ips-listextendedGLAB-permitip1.1.1.00.0.0.2552.2.2.0erfaceipaddress202.100.1.1cryptomap2.32.3cryptocryptoikev2keyringGLAB-peer Center-ASA pre-shared-key local cisco tunnel-group202.100.1.1typetunnel-group202.100.1.1typeipsec-tunnel-group202.100.1.1ipsec-ikev2remote-authenticationpre-shared-key cisco ike