Cisco1721とRTX1000でのIPsecができたので1812Jとも接続してみました。
そのまんまでつながるわけなんですが、SVIインターフェースのVLAN1の扱いにちょっと悩んだというか…
今回の構成図
まえとほぼ同じですね～
IPsecVPNのパラメータ
これも同じ
以下がCisco1812Jのコンフィグ
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname C1812J-01
!
boot-start-marker
boot-end-marker
!
enable password kumakuma
!
no aaa new-model
!
resource policy
!
!
!
ip cef
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
lifetime 28800
crypto isakmp key password1234 address 1.2.3.1
!
!
crypto ipsec transform-set DEFAULT esp-aes esp-sha-hmac
!
crypto map LAB local-address FastEthernet0
crypto map LAB 1 ipsec-isakmp
set peer 1.2.3.1
set transform-set DEFAULT
match address 100
!
!
!
!
interface FastEthernet0
ip address 1.2.3.7 255.255.255.224
duplex auto
speed auto
crypto map LAB
!
interface FastEthernet1
no ip address
shutdown
duplex auto
speed auto
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
ip address 192.168.141.254 255.255.255.0
ip tcp adjust-mss 1350
!
ip route 0.0.0.0 0.0.0.0 1.2.3.1
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip 192.168.141.0 0.0.0.255 192.168.105.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
password alpha0
login
!
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
1812J側でのIPsecVPN接続確認
まずはshow crypt isakmp saの結果を確認します。
正しい例
1812J#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
1.2.3.7 1.2.3.1 QM_IDLE 2003 0 ACTIVE
1.2.3.7 1.2.3.1 QM_IDLE 2002 0 ACTIVE
1.2.3.7 1.2.3.1 QM_IDLE 2001 0 ACTIVE
Yamaha RTX100のコンフィグ
ip route 192.168.141.0/24 gateway tunnel 2
ip lan2 address 1.2.3.1/27
tunnel select 2
ipsec tunnel 102
ipsec sa policy 102 2 esp aes-cbc sha-hmac
ipsec ike duration isakmp-sa 2 28800
ipsec ike encryption 2 aes-cbc
ipsec ike group 2 modp1024
ipsec ike hash 2 sha
ipsec ike local address 2 1.2.3.1
ipsec ike local id 2 192.168.105.0/24
ipsec ike pre-shared-key 2 text password1234
ipsec ike remote address 2 1.2.3.7
ipsec ike remote id 2 192.168.141.0/24
ip tunnel tcp mss limit 1350
tunnel enable 2
ipsec auto refresh on
show crypt ipsec saの出力を確認します。
正しい例
1812J#show crypto ipsec sa
interface: FastEthernet0
Crypto map tag: LAB, local addr 1.2.3.7
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.141.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.105.0/255.255.255.0/0/0)
current_peer 1.2.3.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 109, #pkts encrypt: 109, #pkts digest: 109
#pkts decaps: 2353, #pkts decrypt: 2353, #pkts verify: 2353
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 1.2.3.7, remote crypto endpt.: 1.2.3.1
path mtu 1500, ip mtu 1500
current outbound spi: 0xC43838B1(3292018865)
inbound esp sas:
spi: 0xF96E0BEC(4184738796)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: Motorola SEC 2.0:1, crypto map: LAB
sa timing: remaining key lifetime (k/sec): (4483123/2577)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xC43838B1(3292018865)
transform: esp-aes esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: Motorola SEC 2.0:2, crypto map: LAB
sa timing: remaining key lifetime (k/sec): (4483386/2575)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
双方のクライアントマシンでpingを打ち続けるとカウントが増えていきます。
Yamaha側の確認
正しい例
RTX1000# show ipsec sa
sa sgw connection dir life[s] remote-id
--------------------------------------------------------------------------
1 2 isakmp - 28295 1.2.3.7
3 2 tun[002]esp send 28297 1.2.3.7
4 2 tun[002]esp recv 28297 1.2.3.7
5 2 isakmp - 28298 1.2.3.7
6 2 isakmp - 28299 1.2.3.7
