Cisco
IPsec IKEv2のコンフィグ
IPsec+PPPoE+NAT+ACLのコンフィグでは、IKEv1でIPsecを設定していますが、ここではIKEv2で設定したコンフィグを記載します。
構成図
コンフィグについて
キーリングは使用せずに設定しています。
IKEv2はPFSの概念がありませんので設定を削除しています。
RT-1コンフィグ
RT-2コンフィグ
※黄色文字はPPPoE+NAT+ACLのコンフィグからの変更箇所です。
RT-1#show run version 15.3 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service sequence-numbers no service dhcp ! hostname RT-1 ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 512000 enable secret 5 $1$UZ.d$263eCd7jDVJHAqwgfcFNL0 ! no aaa new-model clock timezone JST 9 0 ! ! ! no ip bootp server no ip domain lookup ip domain name free-ne.com ip inspect name CBAC tcp ip inspect name CBAC udp ip inspect name CBAC icmp ip cef no ipv6 cef ! ! ! multilink bundle-name authenticated ! ! ! no spanning-tree vlan 1 username admin secret 5 $1$ztjJ$yET4V3rcbtkvdA9yjTJin. ! crypto ikev2 proposal Proposal-name encryption aes-cbc-128 integrity sha256 group 2 ! crypto ikev2 policy Policy-name proposal Proposal-name ! ! crypto ikev2 profile Profile-name match identity remote address 22.22.22.22 255.255.255.255 identity local address 11.11.11.11 authentication remote pre-share key PS-key authentication local pre-share key PS-key lifetime 1800 dpd 30 3 periodic ! ! ! ip ssh version 2 ! ! ! crypto ipsec transform-set TS-name esp-aes esp-sha256-hmac mode tunnel ! ! ! crypto map MAP-name 160 ipsec-isakmp set peer 22.22.22.22 set security-association lifetime seconds 1200 set transform-set TS-name set ikev2-profile Profile-name match address IPsec ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface FastEthernet0 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0 no ip address ! interface GigabitEthernet1 no ip address ! interface GigabitEthernet2 no ip address ! interface GigabitEthernet3 no ip address ! interface GigabitEthernet4 no ip address ! interface GigabitEthernet5 no ip address ! interface GigabitEthernet6 no ip address ! interface GigabitEthernet7 no ip address ! interface GigabitEthernet8 no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface Vlan1 ip address 10.1.1.11 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1350 ! interface Async3 no ip address encapsulation slip ! interface Dialer1 ip address negotiated ip access-group Internet-ACL in ip mtu 1492 ip nat outside ip inspect CBAC out ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 10 ppp authentication chap callin ppp chap hostname user1 ppp chap password 0 cisco no cdp enable crypto map MAP-name ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source list Internet-PAT interface Dialer1 overload ! ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list standard SSH-ACL permit 10.1.1.0 0.0.0.255 ! ! ip access-list extended IPsec permit ip 10.1.1.0 0.0.0.255 10.2.1.0 0.0.0.255 ip access-list extended Internet-ACL permit udp host 9.9.9.1 eq ntp host 11.11.11.11 eq ntp permit icmp any host 11.11.11.11 permit udp host 22.22.22.22 eq isakmp host 11.11.11.11 eq isakmp permit esp host 22.22.22.22 host 11.11.11.11 ! ip access-list extended Internet-PAT deny ip 10.1.1.0 0.0.0.255 10.2.1.0 0.0.0.255 permit ip 10.1.1.0 0.0.0.255 any ! dialer-list 10 protocol ip permit no cdp run ! ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! line con 0 exec-timeout 60 0 logging synchronous no modem enable line aux 0 line 3 modem InOut speed 115200 flowcontrol hardware line vty 0 4 access-class SSH-ACL in exec-timeout 60 0 logging synchronous login local transport input ssh ! scheduler allocate 20000 1000 ntp server 9.9.9.1 ! end
RT-2#show run version 15.3 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service sequence-numbers no service dhcp ! hostname RT-2 ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 512000 enable secret 5 $1$RBil$/zAAQLKQrekcrMgQIHCwW1 ! no aaa new-model clock timezone JST 9 0 ! ! ! no ip bootp server no ip domain lookup ip domain name free-ne.com ip inspect name CBAC tcp ip inspect name CBAC udp ip inspect name CBAC icmp ip cef no ipv6 cef ! ! ! multilink bundle-name authenticated ! ! ! no spanning-tree vlan 1 username admin secret 5 $1$hwGG$LTC0VpW218k/mT9dMrcO.0 ! crypto ikev2 proposal Proposal-name encryption aes-cbc-128 integrity sha256 group 2 ! crypto ikev2 policy Policy-name proposal Proposal-name ! ! crypto ikev2 profile Profile-name match identity remote address 11.11.11.11 255.255.255.255 identity local address 22.22.22.22 authentication remote pre-share key PS-key authentication local pre-share key PS-key lifetime 1800 dpd 30 3 periodic ! ! ! ip ssh version 2 ! ! ! crypto ipsec transform-set TS-name esp-aes esp-sha256-hmac mode tunnel ! ! ! crypto map MAP-name 160 ipsec-isakmp set peer 11.11.11.11 set security-association lifetime seconds 1200 set transform-set TS-name set ikev2-profile Profile-name match address IPsec ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface FastEthernet0 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0 no ip address ! interface GigabitEthernet1 no ip address ! interface GigabitEthernet2 no ip address ! interface GigabitEthernet3 no ip address ! interface GigabitEthernet4 no ip address ! interface GigabitEthernet5 no ip address ! interface GigabitEthernet6 no ip address ! interface GigabitEthernet7 no ip address ! interface GigabitEthernet8 no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface Vlan1 ip address 10.2.1.22 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1350 ! interface Async3 no ip address encapsulation slip ! interface Dialer1 ip address negotiated ip access-group Internet-ACL in ip mtu 1492 ip nat outside ip inspect CBAC out ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 10 ppp authentication chap callin ppp chap hostname user1 ppp chap password 0 cisco no cdp enable crypto map MAP-name ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source list Internet-PAT interface Dialer1 overload ip nat inside source static tcp 10.2.1.2 80 22.22.22.22 80 extendable ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list standard SSH-ACL permit 10.2.1.0 0.0.0.255 permit 10.1.1.0 0.0.0.255 ! ip access-list extended IPsec permit ip 10.2.1.0 0.0.0.255 10.1.1.0 0.0.0.255 ip access-list extended Internet-ACL permit udp host 9.9.9.1 eq ntp host 22.22.22.22 eq ntp permit icmp any host 22.22.22.22 permit tcp any host 22.22.22.22 eq www permit udp host 11.11.11.11 eq isakmp host 22.22.22.22 eq isakmp permit esp host 11.11.11.11 host 22.22.22.22 ip access-list extended Internet-PAT deny ip 10.2.1.0 0.0.0.255 10.1.1.0 0.0.0.255 permit ip 10.2.1.0 0.0.0.255 any ! dialer-list 10 protocol ip permit no cdp run ! ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! line con 0 exec-timeout 60 0 logging synchronous no modem enable line aux 0 line 3 modem InOut speed 115200 flowcontrol hardware line vty 0 4 access-class SSH-ACL in exec-timeout 60 0 logging synchronous login local transport input ssh ! scheduler allocate 20000 1000 ntp server 9.9.9.1 ! end
IPsecの状態確認
RT-2#show crypto engine connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
23 IPsec AES+SHA256 0 12 12 22.22.22.22
24 IPsec AES+SHA256 12 0 0 22.22.22.22
2011 IKEv2 SHA256+AES 0 0 0 22.22.22.22
RT-2#
RT-2#show crypto ikev2 session
IPv4 Crypto IKEv2 Session
Session-id:9, Status:UP-ACTIVE, IKE count:1, CHILD count:1
Tunnel-id Local Remote fvrf/ivrf Status
1 22.22.22.22/500 11.11.11.11/500 none/none READY
Encr: AES-CBC, keysize: 128, Hash: SHA256, DH Grp:2, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 1800/52 sec
Child sa: local selector 10.2.1.0/0 - 10.2.1.255/65535
remote selector 10.1.1.0/0 - 10.1.1.255/65535
ESP spi in/out: 0xF2298290/0x6753C32D
IPv6 Crypto IKEv2 Session
RT-2#
RT-2#show crypto ipsec sa
interface: Dialer1
Crypto map tag: MAP-name, local addr 22.22.22.22
protected vrf: (none)
local ident (addr/mask/prot/port): (10.2.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
current_peer 11.11.11.11 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 22.22.22.22, remote crypto endpt.: 11.11.11.11
plaintext mtu 1422, path mtu 1492, ip mtu 1492, ip mtu idb Dialer1
current outbound spi: 0x6753C32D(1733542701)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xF2298290(4062806672)
transform: esp-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 23, flow_id: Onboard VPN:23, sibling_flags 80000040, crypto map: MAP-name
sa timing: remaining key lifetime (k/sec): (4231300/1140)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6753C32D(1733542701)
transform: esp-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 24, flow_id: Onboard VPN:24, sibling_flags 80000040, crypto map: MAP-name
sa timing: remaining key lifetime (k/sec): (4231301/1140)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
RT-2#