AR IPSEC與CISCO IPSEC對接，CISCO采用動態(tài)模板形式
2014/10/12 13:26:21點擊：
問題描述
Cisco設備作為總部，AR作為分支設備，cisco采用動態(tài)模板的方式創(chuàng)建map。同時使用ip的方式進行協(xié)商。
告警信息
無
處理過程
AR設備的配置
# acl number 3000
rule 10 permit ip source 4.4.4.4 0
#
ipsec proposal 1
#
ike proposal 1
#
ike peer vpn1 v1
exchange-mode aggressive
pre-shared-key simple huawei123
ike-proposal 1
remote-address 192.168.2.2
#
ipsec policy vpn1 10 isakmp
security acl 3000
ike-peer vpn1
proposal 1
#
interface GigabitEthernet0/0/0
ip address 192.168.1.2 255.255.255.0
ipsec policy vpn1
Cisco設備的配置
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key huawei123 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TRANS01
esp-des esp-md5-hmac
!
crypto dynamic-map vpn 10
set transform-set TRANS01
match address 102
!
crypto map vpn2 10 ipsec-isakmp dynamic vpn
!
access-list 102 permit ip any host 3.3.3.3
access-list 102 permit ip any host 4.4.4.4
! interface GigabitEthernet0/0
ip address 192.168.2.2 255.255.255.0
duplex auto
speed auto
media-type rj45
crypto map vpn2
AR的ike sa：
Cisco 的ike sa：
# acl number 3000
rule 10 permit ip source 4.4.4.4 0
#
ipsec proposal 1
#
ike proposal 1
#
ike peer vpn1 v1
exchange-mode aggressive
pre-shared-key simple huawei123
ike-proposal 1
remote-address 192.168.2.2
#
ipsec policy vpn1 10 isakmp
security acl 3000
ike-peer vpn1
proposal 1
#
interface GigabitEthernet0/0/0
ip address 192.168.1.2 255.255.255.0
ipsec policy vpn1
Cisco設備的配置
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key huawei123 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TRANS01
esp-des esp-md5-hmac
!
crypto dynamic-map vpn 10
set transform-set TRANS01
match address 102
!
crypto map vpn2 10 ipsec-isakmp dynamic vpn
!
access-list 102 permit ip any host 3.3.3.3
access-list 102 permit ip any host 4.4.4.4
! interface GigabitEthernet0/0
ip address 192.168.2.2 255.255.255.0
duplex auto
speed auto
media-type rj45
crypto map vpn2
AR的ike sa：
Cisco 的ike sa：
根因
無
建議與總結
思科動態(tài)策略圖就是目前AR所支持的總部采用模板方式，如果總部采用模板方式，此時總部是完全被動接受分支的主動協(xié)商的，這種方式可以支持分支地址為動態(tài)地址的場景。本案例中分支地址是確定的，AR采用野蠻模式的IP方式與思科進行對接。在采用模板的場景中，如果思科作為總部，需要配置ACL，而如果AR作為總部，ACL會自動生成，無需配置。當然該場景如果采用主模式也可以對接成功，思科不區(qū)分主模式和野蠻模式。
- 上一篇：AR G3路由器在初始配置環(huán)境下是否可以通過Telnet 方 2014/10/12
- 下一篇：AR G3路由器支持哪些方式的NAC 2014/10/12