城市里的游牧民族

Menu

DVPN Full-Mesh的组网方式实验配置案例

周五的时候,和同事说到了某客户的需求典型的总部和各个分支进行互联,说到了DVPN,于是回来搭建了模拟环境测试了下,模拟器里面完全能实现。特分享。

实验拓扑图:

\"\"

拓扑说明:

1、RT1模拟总部,为DVPN的HUB节点,总部的公网地址采用静态ip地址的方式用,loopback模拟私网

2、RT2模拟公网

3、RT3为vam server接受DVPN节点向其注册信息,负责管理、维护各DVPN节点的信息

4、RT4\RT5模拟分支,为DVPN的spoke节点,分支的公网地址采用动态获取方式,用loopback模拟私网

5、公网之间的路由用ospf 1、分支间私网路由用ospf 100

配置思路:

1、配置各个路由器的接口地址,RT2上配置DHCP server ,保证RT4\RT5上行接口能自动获取IP地址

2、配置公网路由,ospf1,将RT1\RT2\RT3相关公网接口在ospf 1中进行network,保证RT1\RT3\RT4\RT5公网地址IP能互通。

3、配置VAM SERVER

1)为DVPN节点创建AAA身份认证信息,本实验采用本地认证方式,即需要在VAM server上创建三个local-user。

#
local-user vpn1hub
 password simple vpn1hub
 service-type dvpn
local-user vpn1spoke1
 password simple vpn1spoke1
 service-type dvpn
local-user vpn1spoke2
 password simple vpn1spoke2
 service-type dvpn

2)指定VAM Server上的监听IP地址,即本接口的公网地址

vam server ip-address 10.1.23.3

3)创建VPN域、配置预共享密钥、配置对客户端进行CHAP认证、指定VPN域的Hub地址、启动VPN域的VAM Server功能

#
vam server vpn 1
 pre-shared-key simple 123
 authentication-method chap
 hub private-ip 172.16.1.1
 server enable

4、HUB节点配置

1)创建VPN域的客户端、配置VAM SERVER的IP地址、共享密钥、节点接入验证的用户名和密码、启用客户端

#
vam client name vpn1hub
 vpn 1
 server primary ip-address 10.1.23.3
 pre-shared-key simple 123
 user vpn1hub password simple vpn1hub
 client enable
2)配置IPsec安全提议、 配置IKE对等体、配置IPsec安全框架
#
ipsec proposal vam
 esp authentication-algorithm sha1
#
ike peer vam
 pre-shared-key cipher PMEfbsX04vk=
#
ipsec profile vamp
 pfs dh-group2
 ike-peer vam
 proposal vam
 sa duration time-based 600
3)配置VPN域的隧道接口Tunnel1、隧道IP、UDP封装模式、tunnel口的source接口、修改ospf的接口类型为broadcast、关联VAM client、关联IPSEC
#
interface Tunnel1
 ip address 172.16.1.1 255.255.255.0
 tunnel-protocol dvpn udp
 source GigabitEthernet0/0/0
 ospf network-type broadcast
 ipsec profile vamp
 vam client vpn1hub
 4)配置私网路由
#
ospf 100
 area 0.0.0.0
  network 172.16.1.1 0.0.0.0
  network 192.168.1.1 0.0.0.0
5、spoke节点配置和HUB节点配置思路一致,略。
注意其中的共享密钥、用户名和密码、VAM SERVER的ip地址、tunnel口的ospf接口类型、ipsec相关配置协商参数要一致
<strong>排错思路及验证:</strong>
1、显示注册到主VAM Server的所有VAM Client的地址映射信息
&lt;rt3-vam-server&gt;display vam server address-map all
 VPN name:  1
 Total address-map number:  3

 Private-ip     Public-ip        Type        Holding time

 172.16.1.1     10.1.12.1        Hub         2H 26M 37S
 172.16.1.2     10.1.24.1        Spoke       2H 28M 41S
 172.16.1.3     10.1.25.1        Spoke       2H 28M 36S

&lt;rt3-vam-server&gt;
注意:如果这里没有节点信息或者不完整,重点检查如下
1)每个节点的tunnel口是否UP、公网是否能ping通
2)共享密钥是否正确
3)用户名和密码是否正确、服务类型是否配置
2、显示客户端的状态信息
&lt;RT1-hub&gt;display vam client address-map
 Client name: vpn1hub
 VPN name:  1
 Total address-map number:    1
 Private-ip     Public-ip        Type   Remaining-time(s)
 172.16.1.1     10.1.12.1        Hub    --

&lt;RT1-hub&gt;
3、显示Hub1上的DVPN隧道信息
&lt;RT1-hub&gt;display dvpn session all
 Interface: Tunnel1  VPN name: 1  Total number: 2

  Private IP:    172.16.1.2
  Public IP:     10.1.24.1
  Session type:  <span style="color: #ff0000;">Hub-Spoke</span>
  State:         SUCCESS
  Holding time: 2h 30m 6s
  Input:  1426 packets,  1260 data packets,  166 control packets
          1240 multicasts,  0 errors
  Output: 1432 packets,  1247 data packets,  185 control packets
          1226 multicasts,  0 errors

  Private IP:    172.16.1.3
  Public IP:     10.1.25.1
  Session type:  <span style="color: #ff0000;">Hub-Spoke</span>
  State:         SUCCESS
  Holding time: 2h 30m 4s
  Input:  1430 packets,  1256 data packets,  174 control packets
          1231 multicasts,  0 errors
  Output: 1431 packets,  1250 data packets,  181 control packets
          1225 multicasts,  0 errors

&lt;RT1-hub&gt;
显示spoke上的DVPN隧道信息
&lt;rt4-spoke1&gt;dis dvpn session all
 Interface: Tunnel1  VPN name: 1  Total number: 2

  Private IP:    172.16.1.1
  Public IP:     10.1.12.1
  Session type:  <span style="color: #ff0000;">Spoke-Hub</span>
  State:         SUCCESS
  Holding time: 2h 33m 28s
  Input:  1464 packets,  1276 data packets,  188 control packets
          1254 multicasts,  0 errors
  Output: 1462 packets,  1289 data packets,  173 control packets
          1268 multicasts,  0 errors

  Private IP:    172.16.1.3
  Public IP:     10.1.25.1
  Session type:  <span style="color: #ff0000;">Spoke-Spoke</span>
  State:         SUCCESS
  Holding time: 0h 0m 3s
  Input:  6 packets,  4 data packets,  2 control packets
          0 multicasts,  0 errors
  Output: 5 packets,  4 data packets,  1 control packets
          0 multicasts,  0 errors

&lt;rt4-spoke1&gt;
4、显示ospf peer相关信息
&lt;RT1-hub&gt;dis ospf peer 

                  OSPF Process 1 with Router ID 1.1.1.1
                        Neighbor Brief Information

 Area: 0.0.0.0
 Router ID       Address         Pri Dead-Time Interface       State
 2.2.2.2         10.1.12.2       1   29        GE0/0/0         Full/DR

                  OSPF Process 100 with Router ID 1.1.1.1
                        Neighbor Brief Information

 Area: 0.0.0.0
 Router ID       Address         Pri Dead-Time Interface       State
<span style="color: #ff0000;"> 4.4.4.4 172.16.1.2 0 37 Tun1 Full/DROther</span>
<span style="color: #ff0000;"> 5.5.5.5 172.16.1.3 0 40 Tun1 Full/DROther</span>
&lt;RT1-hub&gt;
5、显示路由相关信息
&lt;RT1-hub&gt;display ip routing-table
Routing Tables: Public
        Destinations : 13       Routes : 13

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

1.1.1.1/32          Direct 0    0            127.0.0.1       InLoop0
10.1.12.0/24        Direct 0    0            10.1.12.1       GE0/0/0
10.1.12.1/32        Direct 0    0            127.0.0.1       InLoop0
10.1.23.0/24        OSPF   10   2            10.1.12.2       GE0/0/0
10.1.24.0/24        OSPF   10   2            10.1.12.2       GE0/0/0
10.1.25.0/24        OSPF   10   2            10.1.12.2       GE0/0/0
127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0
127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0
172.16.1.0/24       Direct 0    0            172.16.1.1      Tun1
172.16.1.1/32       Direct 0    0            127.0.0.1       InLoop0
192.168.1.1/32      Direct 0    0            127.0.0.1       InLoop0
<span style="color: #ff0000;">192.168.2.1/32 OSPF 10 1562 172.16.1.2 Tun1</span>
<span style="color: #ff0000;">192.168.3.1/32 OSPF 10 1562 172.16.1.3 Tun1</span>

&lt;RT1-hub&gt;
— 于 共写了4311个字
— 文内使用到的标签:
本作品采用知识共享署名-非商业性使用-禁止演绎 3.0 中国大陆许可协议进行许可。

评论已关闭。