环境拓扑图 R1配置 接口配置 R1#conf terminalR1(config)#interface ethernet 1/0R1(config-if)#ip address 172.16.1.193 255.255.255.0R1(config-if)#no shutdownR1(config-if)#exitR1(config)#interface ethernet 1/1R1(config-if)#no shutdownR1(config-if)#ip address 30.1.1.2 255.255.255.0R1(config-if)#exit
IPSec配置 # ike密钥配置R1(config)#crypto ikev2 keyring ike_key # 生成ike密钥名称R1(config-ikev2-keyring)#peer 20.1.1.1 # 对端IPR1(config-ikev2-keyring-peer)#address 20.1.1.1 # 添加对端IPR1(config-ikev2-keyring-peer)#pre-shared-key 123456 # 配置预共享密钥R1(config-ikev2-keyring-peer)#exitR1(config-ikev2-keyring)#exit# IKEv2一阶段配置R1(config)#crypto ikev2 profile ike_pro # 生成ike概要名称R1(config-ikev2-profile)#match identity remote address 20.1.1.1 255.255.255.255 # 配置对端ike IP地址R1(config-ikev2-profile)#authentication remote pre-share # 设置对端认证方式为预共享密钥R1(config-ikev2-profile)#authentication local pre-share # 设置本端认证方式为预共享密钥R1(config-ikev2-profile)#keyring local ike_key # 关联预共享密钥配置R1(config-ikev2-profile)#exit# IKEv2二阶段配置R1(config)#crypto ipsec transform-set ipsec_tra esp-aes esp-sha-hmac # 添加二阶段名称为ipsec_tra，并添加算法R1(cfg-crypto-trans)#mode tunnel # 使用隧道模式协商R1(cfg-crypto-trans)#exit# map配置R1(config)#crypto map map_ipsec 10 ipsec-isakmp # 添加map，进入配置R1(config-crypto-map)#set transform-set ipsec_tra # 关联ike二阶段R1(config-crypto-map)#set ikev2-profile ike_pro # 关联ike一阶段R1(config-crypto-map)#match address 100 # 匹配要加密的感兴趣流R1(config-crypto-map)#exit# 添加感兴趣流R1(config)#access-list 100 permit ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255# 接口关联mapR1(config)#interface ethernet 1/1R1(config-if)#crypto map map_ipsecR1(config-if)#exit
路由配置 R1(config)#ip route 10.1.1.0 255.255.255.0 30.1.1.1R1(config)#ip route 20.1.1.0 255.255.255.0 30.1.1.1
R2配置 接口配置 R2#configure terminalR2(config-if)#no shutdownR2(config-if)#ip address 30.1.1.1 255.255.255.0R2(config-if)#exitR2(config)#interface ethernet 1/0R2(config-if)#no shutdownR2(config-if)#ip address 20.1.1.2 255.255.255.0R2(config-if)#exit
R3配置 接口配置 R3#configure terminalR3(config)#interface ethernet 1/0R3(config-if)#no shutdownR3(config-if)#ip address 20.1.1.1 255.255.255.0R3(config-if)#exitR3(config)#interface ethernet 1/1R3(config-if)#no shutdownR3(config-if)#ip address 10.1.1.2 255.255.255.0R3(config-if)#exit
IPSec配置 # ike密钥配置R3(config)#crypto ikev2 keyring ike_key # 生成ike密钥名称R3(config-ikev2-keyring)#peer 30.1.1.2 # 对端IPR3(config-ikev2-keyring-peer)#address 30.1.1.2 # 添加对端IPR3(config-ikev2-keyring-peer)#pre-shared-key 123456 # 配置预共享密钥R3(config-ikev2-keyring-peer)#exitR3(config-ikev2-keyring)#exit# IKEv2一阶段配置R3(config)#crypto ikev2 profile ike_pro # 生成ike概要名称R3(config-ikev2-profile)#match identity remote address 30.1.1.2 255.255.255.255 # 配置对端ike IP地址R3(config-ikev2-profile)#authentication remote pre-share # 设置对端认证方式为预共享密钥R3(config-ikev2-profile)#authentication local pre-share # 设置本端认证方式为预共享密钥R3(config-ikev2-profile)#keyring local ike_key # 关联预共享密钥配置R3(config-ikev2-profile)#exit# IKEv2二阶段配置R3(config)#crypto ipsec transform-set ipsec_tra esp-aes esp-sha-hmac # 添加二阶段名称为ipsec_tra，并添加算法R3(cfg-crypto-trans)#mode tunnel # 使用隧道模式协商R3(cfg-crypto-trans)#exit# map配置R3(config)#crypto map map_ipsec 10 ipsec-isakmp # 添加map，进入配置R3(config-crypto-map)#set transform-set ipsec_tra # 关联ike二阶段R3(config-crypto-map)#set ikev2-profile ike_pro # 关联ike一阶段R3(config-crypto-map)#match address 100 # 匹配要加密的感兴趣流R3(config-crypto-map)#exit# 添加感兴趣流R3(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255# 接口关联mapR3(config)#interface ethernet 1/0R3(config-if)#crypto map map_ipsecR3(config-if)#exit
路由配置 R3(config)#ip route 30.1.1.0 255.255.255.0 20.1.1.2R3(config)#ip route 172.16.1.0 255.255.255.0 20.1.1.2R3(config)#end
R4配置 接口配置 R4#configure terminalR4(config)#interface ethernet 1/1R4(config-if)#no shutdownR4(config-if)#ip address 10.1.1.1 255.255.255.0R4(config-if)#exit
路由配置 R4(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.2R4(config)#end
调试命令 查看ikev2协商过程 debug crypto ikev2查看IPSec转发过程 debug crypto ipsec查看IPSec配置 show running-config | section crypto查看IKEv2 sa show crypto IKEv2 SA查看IPSec sa show crypto ipsec sa查看IKEv2统计数据 show crypto ikev2 start查看map 信息 show crypto map