IKEv2+证书.note

noteId: WEBc97b11785bcb5391dee5216cfa514bb8 · 原始路径：/ALL/网络 - C模块/VPN 合集/IPSec-VPN、GRE-over-IPSec/（路由器）GRE-over-IPSec VPN/IKEv2+证书.note · 图片：10 · 附件待处理：0

但是这个算不上纯正的GRE over IPSec，因为它 tunnel 的模式是 ipsec ipv4

拓扑：

一、配置 IKEv2 + 证书 GRE over IPSec VPN：

·基础配置（可以跳过不看）：

ISP:

BR-R1:

HQ-R2:

BR-R2:

1、先在 ISP 上配置 CA服务器：

# 先配置 NTP：
ntp master
ntp master 1
 
# 配置 CA：
ip http server 
crypto pki server CA 

 grant auto
 no shutdown
 
# 查看CA：
do show crypto pki server

2、VPN 机器上申请证书：

# HQ-R2：
ntp server 8.8.8.8    //先与CA服务器同步时间，否则时间不同步会失败
 
crypto pki trustpoint VPN

 enrollment url http://8.8.8.8


 ip-address 123.30.0.1    //ip地址写本地公网接口IP地址（对端的tunnel destination指定的地址）

 subject-name cn=HQ-R2
 fqdn none

 revocation-check none
 
crypto pki authenticate VPN    //信任CA根证书
yes
 
crypto pki enroll VPN    //申请证书
# 输入密码
no
yes
 
# BR-R2：
## 一样的配置，改下IP就行
ntp server 8.8.8.8    
 
crypto pki trustpoint VPN

 enrollment url http://8.8.8.8


 ip-address 123.50.0.200

 subject-name cn=BR-R2
 fqdn none

 revocation-check none
 
crypto pki authenticate VPN    
 
crypto pki enroll VPN

3、配置 IKEv2+证书VPN：

# HQ-R2：
crypto ikev2 proposal IKEv2     //一阶段提案

 encryption aes-cbc-256

 integrity sha256

 group 14
 exit
 
crypto ikev2 policy POLICY
 proposal IKEv2    //关联proposal
 exit
 
crypto ikev2 profile PROFILE

 match identity remote any

 identity local address 123.30.0.1    //指定本地公网地址

 authentication remote rsa-sig

 authentication local rsa-sig

 pki trustpoint VPN
 
crypto ipsec transform-set IPSEC esp-aes 256
 mode transport
 
crypto ipsec profile PRO

 set transform-set IPSEC 

 set ikev2-profile PROFILE
 
 
# BR-R2：
crypto ikev2 proposal IKEv2 

 encryption aes-cbc-256

 integrity sha256

 group 14

 exit

 
crypto ikev2 policy POLICY

 proposal IKEv2 

 exit

 
crypto ikev2 profile PROFILE

 match identity remote any

 identity local address 123.50.0.200

 authentication remote rsa-sig

 authentication local rsa-sig

 pki trustpoint VPN

 
crypto ipsec transform-set IPSEC esp-aes 256

 mode transport

 
crypto ipsec profile PRO

 set transform-set IPSEC 

 set ikev2-profile PROFILE

4、配置 GRE tunnel，先确保GRE能够通信：

# HQ-R2
interface Tunnel100

 ip address 10.0.0.1 255.255.255.252

 tunnel source GigabitEthernet0/0

 tunnel destination 123.50.0.200
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile PRO    //关联profile
 exit
 
   
ip route 192.168.10.0 255.255.255.0 tunnel 100
 
# BR-R2
interface Tunnel100

 ip address 10.0.0.2 255.255.255.252

 tunnel source GigabitEthernet0/0

 tunnel destination 123.30.0.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile PRO    //关联profile
 exit
 
ip route 172.16.1.0 255.255.255.0 tunnel 100

先确保tunnel地址、和两端内网能够通信：

·查看状态：

GRE over IPSec VPN，必须要有流量通过才会有状态（简单来说就是IPSec应用后，两边需要先ping通）

# HQ-R2
ping 172.16.1.254
show crypto ipsec sa