华为设备上的安全技术总结之ipsec

ipsec

I IPSec 是一系列网络安全协议的总称，它是由IETF（Internet 工程任务组）开发的，可为通讯双方提供访问控制、无连接的完整性、数据来源认证、反重放、加密以及对数据流分类加密等服务。它是网络层的安全机制，通过对网络层包信息的保护，上层应用程序即使没有实现安全性，也能够自动从网络层提供的安全性中获益。这打消了人们对×××安全性的顾虑，使得××× 得以广泛应用。IPSec的工作方式有两种;传输方式；隧道方式。而且ipsec的工作模式有两种 手动配置 和自动协商

【实验目的】

 运用ipsec 的一系列网络协议建立×××管道模式保证信息的安全

【实验拓扑】

【实验配置】

交换机上的基本配置

dis cu

#

sysname Quidway

#

radius scheme system

server-type huawei

primary authentication 127.0.0.1 1645

primary accounting 127.0.0.1 1646

user-name-format without-domain

domain system

radius-scheme system

access-limit disable

state active

vlan-assignment-mode integer

idle-cut disable

self-service-url disable

messenger time disable

domain default enable system

#

local-server nas-ip 127.0.0.1 key huawei

#

vlan 1

#

vlan 10

#

vlan 20

#

vlan 30

#

interface Vlan-interface1

#

interface Vlan-interface10

ip address 1.1.1.2 255.255.255.0

#

interface Vlan-interface20

ip address 1.1.2.2 255.255.255.0

#

interface Vlan-interface30

ip address 1.1.3.2 255.255.255.0

#

interface Aux0/0

#

interface Ethernet0/1

#

interface Ethernet0/2

#

interface Ethernet0/3

#

interface Ethernet0/4

#

interface Ethernet0/5

#

interface Ethernet0/6

#

interface Ethernet0/7

#

interface Ethernet0/8

#

interface Ethernet0/9

#

interface Ethernet0/10

port access vlan 10

#

interface Ethernet0/11

#

interface Ethernet0/12

#

interface Ethernet0/13

#

interface Ethernet0/14

#

interface Ethernet0/15

#

interface Ethernet0/16

#

interface Ethernet0/17

#

interface Ethernet0/18

#

interface Ethernet0/19

#

interface Ethernet0/20

port access vlan 20

#

interface Ethernet0/21

#

interface Ethernet0/22

#

interface Ethernet0/23

#

interface Ethernet0/24

port access vlan 30

#

interface NULL0

#

user-interface aux 0

user-interface vty 0 4

#

return

手工配置

[h4c1]dis cu

#

sysname h4c1

#

firewall packet-filter enable

firewall packet-filter default permit

#

insulate

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

local-user admin

password cipher .]@USE=B,53Q=^Q`MAF4<1!!<>

service-type telnet terminal

level 3

service-type ftp

#

ipsec proposal tran1

#

ipsec policy policy1 10 manual

security acl 3000

proposal tran1

tunnel local 1.1.1.1

tunnel remote 1.1.2.1

sa spi inbound esp 54321

sa string-key inbound esp dcba

sa spi outbound esp 12345

sa string-key outbound esp abcd

#

acl number 3000 match-order auto

rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

#

interface Aux0

async mode flow

#

interface Ethernet0/0

loopback

ip address 192.168.1.1 255.255.255.0

#

interface Ethernet0/1

#

interface Ethernet0/2

#

interface Ethernet0/3

#

interface Ethernet0/4

ip address 1.1.1.1 255.255.255.0

ipsec policy policy1

#

interface Encrypt1/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/0

set priority 85

#

firewall zone untrust

add interface Ethernet0/4

set priority 5

#

firewall zone DMZ

set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

FTP server enable

#

ip route-static 0.0.0.0 0.0.0.0 1.1.1.2 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

return

[h4c2]dis cu

#

sysname h4c2

#

firewall packet-filter enable

firewall packet-filter default permit

#

insulate

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

local-user admin

password cipher .]@USE=B,53Q=^Q`MAF4<1!!<>

service-type telnet terminal

level 3

service-type ftp

#

ipsec proposal tran1

#

ipsec policy policy1 10 manual

security acl 3000

proposal tran1

tunnel local 1.1.2.1

tunnel remote 1.1.1.1

sa spi inbound esp 12345

sa string-key inbound esp abcd

sa spi outbound esp 54321

sa string-key outbound esp dcba

#

acl number 3000 match-order auto

rule 10 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

rule 20 deny ip

#

interface Aux0

async mode flow

#

interface Ethernet0/0

loopback

ip address 192.168.2.1 255.255.255.0

#

interface Ethernet0/1

#

interface Ethernet0/2

#  

interface Ethernet0/3

#

interface Ethernet0/4

ip address 1.1.2.1 255.255.255.0

ipsec policy policy1

#

interface Encrypt1/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/0

set priority 85

#

firewall zone untrust

add interface Ethernet0/4

set priority 5

#

firewall zone DMZ

set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

FTP server enable

#

ip route-static 0.0.0.0 0.0.0.0 1.1.2.2 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

return

自动协商

[h4c1]dis cu

#

sysname h4c1

#

firewall packet-filter enable

firewall packet-filter default permit

#

insulate

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

local-user admin

password cipher .]@USE=B,53Q=^Q`MAF4<1!!<>

service-type telnet terminal

level 3

service-type ftp

#

ike peer fw3

pre-shared-key 1234567

remote-address 1.1.3.1

#

ipsec proposal tran1

#

ipsec proposal tran2

#

ipsec policy policy1 11 isakmp

security acl 3001

ike-peer fw3

proposal tran2

#

ipsec policy policy1 10 manual

security acl 3000

proposal tran1

tunnel local 1.1.1.1

tunnel remote 1.1.2.1

sa spi inbound esp 54321

sa string-key inbound esp dcba

sa spi outbound esp 12345

sa string-key outbound esp abcd

#

acl number 3000 match-order auto

rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

acl number 3001 match-order auto

rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

rule 20 deny ip

#

interface Aux0

async mode flow

#

interface Ethernet0/0

loopback

ip address 192.168.1.1 255.255.255.0

#

interface Ethernet0/1

#

interface Ethernet0/2

#

interface Ethernet0/3

#

interface Ethernet0/4

ip address 1.1.1.1 255.255.255.0

ipsec policy policy1

#

interface Encrypt1/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/0

set priority 85

#

firewall zone untrust

add interface Ethernet0/4

set priority 5

#

firewall zone DMZ

set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

FTP server enable

#

ip route-static 0.0.0.0 0.0.0.0 1.1.1.2 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

return

[h4c3]dis cu

#

sysname h4c3

#

firewall packet-filter enable

firewall packet-filter default permit

#

insulate

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

local-user admin

password cipher .]@USE=B,53Q=^Q`MAF4<1!!<>

service-type telnet terminal

level 3

service-type ftp

#

ike peer fw11

pre-shared-key 1234567

remote-address 1.1.1.1

#

ipsec proposal tran2

#

ipsec policy policy1 11 isakmp

security acl 3000

ike-peer fw11

proposal tran2

#

acl number 3000 match-order auto

rule 10 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

rule 20 deny ip

#

interface Aux0

async mode flow

#

interface Ethernet0/0

loopback

ip address 192.168.3.1 255.255.255.0

#

interface Ethernet0/1

#

interface Ethernet0/2

#

interface Ethernet0/3

#

interface Ethernet0/4

ip address 1.1.3.1 255.255.255.0

ipsec policy policy1

#

interface Encrypt1/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/0

set priority 85

#

firewall zone untrust

add interface Ethernet0/4

set priority 5

#

firewall zone DMZ

set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

FTP server enable

#

ip route-static 0.0.0.0 0.0.0.0 1.1.3.2 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

return

【实验验证】

  手动配置的测试

自动协商的测试