Tweet
Mọi người xem và fix lỗi dùm em nhe - LAB về VPN IPSec GRE Backup
Chào mọi người! EM có mô hình LAB thế này.
MÌnh có thuê 1 đường lease line giữa CENTER và BRANCH. Và mổi site mình cũng thuê 1 đường ADSL để ra net.
Mục tiêu bài LAB sau khi làm xong: Nếu đường leaseline giữa BRANCH và CENTER sống thì dữ liệu giữa 2 site sẽ được truyền qua đường này. Nếu đường leaseline giữa BRANCH và CENTER chết thì dữ liệu sẽ được truyền qua đường dự phòng(GRE tunnel) trên đường ADSL. Trên đường dự phòng này mình có cấu hình VPN IPSec để tăng độ an toàn thông tin dữ liệu. Đồng thời đường ADSL cũng đảm nhiệm chức năng ra net.
Đây là cấu hình:
***Sau khi kiểm tra, kêt quả như sau:
- Khi chưa shutdown int s1/0 trên CENTER
- Khi shutdown int s1/0 trên CENTER
MÌnh có thuê 1 đường lease line giữa CENTER và BRANCH. Và mổi site mình cũng thuê 1 đường ADSL để ra net.
Mục tiêu bài LAB sau khi làm xong: Nếu đường leaseline giữa BRANCH và CENTER sống thì dữ liệu giữa 2 site sẽ được truyền qua đường này. Nếu đường leaseline giữa BRANCH và CENTER chết thì dữ liệu sẽ được truyền qua đường dự phòng(GRE tunnel) trên đường ADSL. Trên đường dự phòng này mình có cấu hình VPN IPSec để tăng độ an toàn thông tin dữ liệu. Đồng thời đường ADSL cũng đảm nhiệm chức năng ra net.
Đây là cấu hình:
Code:
! ! ! Last configuration change at 18:55:13 UTC Sat Jul 23 2011 ! NVRAM config last updated at 18:55:25 UTC Sat Jul 23 2011 ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname BRANCH ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! ip cef ! ! ! ! no ip domain lookup ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! username cisco password 0 123 ! ! ! crypto isakmp policy 1 authentication pre-share crypto isakmp key cisco address 193.168.123.6 ! ! crypto ipsec transform-set mine esp-3des ! crypto map gre-tunnel local-address Serial1/1 crypto map gre-tunnel 10 ipsec-isakmp set peer 193.168.123.6 set transform-set mine match address 100 ! ! ! ! ! interface Tunnel1 ip address 10.0.1.2 255.255.255.0 delay 500 tunnel source 194.168.123.6 tunnel destination 193.168.123.6 crypto map gre-tunnel ! interface Loopback0 ip address 10.0.2.1 255.255.255.0 ! interface FastEthernet0/0 no ip address shutdown duplex half ! interface Serial1/0 ip address 192.168.123.7 255.255.255.0 encapsulation ppp delay 100 serial restart-delay 0 clock rate 64000 ppp authentication chap ppp chap hostname vnpro ppp chap password 0 123 ! interface Serial1/1 ip address 194.168.123.6 255.255.255.0 serial restart-delay 0 clock rate 64000 crypto map gre-tunnel ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! interface Serial1/4 no ip address shutdown serial restart-delay 0 ! interface Serial1/5 no ip address shutdown serial restart-delay 0 ! interface Serial1/6 no ip address shutdown serial restart-delay 0 ! interface Serial1/7 no ip address shutdown serial restart-delay 0 ! router eigrp 1 network 10.0.1.0 0.0.0.255 network 10.0.2.0 0.0.0.255 network 192.168.123.0 no auto-summary ! ip route 0.0.0.0 0.0.0.0 194.168.123.7 no ip http server no ip http secure-server ! ! ! logging alarm informational access-list 100 permit gre host 194.168.123.6 host 193.168.123.6 ! ! ! ! ! ! control-plane ! ! ! ! ! ! gatekeeper shutdown ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 login ! ! end
Code:
! ! ! Last configuration change at 18:55:27 UTC Sat Jul 23 2011 ! NVRAM config last updated at 18:55:28 UTC Sat Jul 23 2011 ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname CENTER ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! ip cef ! ! ! ! no ip domain lookup ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! username vnpro password 0 123 ! ! ! crypto isakmp policy 1 authentication pre-share crypto isakmp key cisco address 194.168.123.6 ! ! crypto ipsec transform-set vnpro esp-3des ! crypto map vnpro local-address Serial1/1 crypto map vnpro 10 ipsec-isakmp set peer 194.168.123.6 set transform-set vnpro match address 100 ! ! ! ! ! interface Tunnel1 ip address 10.0.1.1 255.255.255.0 delay 500 tunnel source Serial1/1 tunnel destination 194.168.123.6 crypto map vnpro ! interface Loopback0 ip address 10.0.0.1 255.255.255.0 ! interface FastEthernet0/0 no ip address shutdown duplex half ! interface Serial1/0 ip address 192.168.123.6 255.255.255.0 encapsulation ppp delay 100 serial restart-delay 0 clock rate 64000 ppp authentication chap ppp chap hostname cisco ppp chap password 0 123 ! interface Serial1/1 ip address 193.168.123.6 255.255.255.0 serial restart-delay 0 clock rate 64000 ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! interface Serial1/4 no ip address shutdown serial restart-delay 0 ! interface Serial1/5 no ip address shutdown serial restart-delay 0 ! interface Serial1/6 no ip address shutdown serial restart-delay 0 ! interface Serial1/7 no ip address shutdown serial restart-delay 0 ! router eigrp 1 network 10.0.0.0 0.0.0.255 network 10.0.1.0 0.0.0.255 network 192.168.123.0 no auto-summary ! ip route 0.0.0.0 0.0.0.0 193.168.123.7 no ip http server no ip http secure-server ! ! ! logging alarm informational access-list 100 permit gre host 193.168.123.6 host 194.168.123.6 ! ! ! ! ! ! control-plane ! ! ! ! ! ! gatekeeper shutdown ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 login ! ! end
Code:
! ! ! Last configuration change at 17:21:54 UTC Fri Jul 22 2011 ! NVRAM config last updated at 18:07:44 UTC Fri Jul 22 2011 ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ISP ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! ip cef ! ! ! ! no ip domain lookup ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface FastEthernet0/0 no ip address shutdown duplex half ! interface Serial1/0 ip address 193.168.123.7 255.255.255.0 serial restart-delay 0 clock rate 64000 ! interface Serial1/1 ip address 194.168.123.7 255.255.255.0 serial restart-delay 0 clock rate 64000 ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! interface Serial1/4 no ip address shutdown serial restart-delay 0 ! interface Serial1/5 no ip address shutdown serial restart-delay 0 ! interface Serial1/6 no ip address shutdown serial restart-delay 0 ! interface Serial1/7 no ip address shutdown serial restart-delay 0 ! no ip http server no ip http secure-server ! ! ! logging alarm informational ! ! ! ! ! ! control-plane ! ! ! ! ! ! gatekeeper shutdown ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 login ! ! end
- Khi chưa shutdown int s1/0 trên CENTER
Code:
Jul 22 18:03:04.135: %SYS-5-CONFIG_I: Configured from console by console CENTER#traceroute 10.0.2.1 source 10.0.0.1 Type escape sequence to abort. Tracing the route to 10.0.2.1 1 192.168.123.7 76 msec * 16 msec CENTER# Jul 22 18:03:13.487: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded CENTER# Jul 22 18:03:17.127: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency CENTER#
Code:
BRANCH#
Jul 22 18:03:14.759: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /194.168.123.6, src_addr= 193.168.123.6, prot= 47
BRANCH#traceroute 10.0.0.1 source 10.0.2.1
Type escape sequence to abort.
Tracing the route to 10.0.0.1
1 192.168.123.6 40 msec * 20 msec
BRANCH#
Code:
CENTER(config)#int s1/0 CENTER(config-if)#sh CENTER(config-if)#shutdown CENTER(config-if)# Jul 22 17:52:46.235: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.123.7 (Serial1/0) is down: interface down CENTER(config-if)# Jul 22 17:52:48.159: %LINK-5-CHANGED: Interface Serial1/0, changed state to administratively down CENTER(config-if)# Jul 22 17:52:48.159: %ENTITY_ALARM-6-INFO: ASSERT INFO Se1/0 Physical Port Administrative State Down Jul 22 17:52:49.159: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down CENTER(config-if)#shutdown ^Z CENTER#traceroute 10.0.2.1 source 10.0.0.1 Jul 22 17:53:02.671: %SYS-5-CONFIG_I: Configured from console by console CENTER#traceroute 10.0.2.1 source 10.0.0.1 Type escape sequence to abort. Tracing the route to 10.0.2.1 1 * * * 2 * * * 3 * * * 4 Jul 22 17:53:31.991: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded * * Jul 22 17:53:35.979: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * Jul 22 17:54:55.495: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded * Jul 22 17:54:59.867: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * Jul 22 17:56:19.383: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded * 23 Jul 22 17:56:21.987: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency * * * 24 * * * 25 * * * 26 CENTER# Jul 22 17:57:41.503: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded CENTER# Jul 22 17:57:44.771: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency CENTER# Jul 22 17:59:04.291: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is down: retry limit exceeded CENTER# Jul 22 17:59:08.911: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.1.2 (Tunnel1) is up: new adjacency
Comment