网络工程 - 以 Hub/Spoke 方式设置 IPSEC - 吾爱随笔录

我正在尝试以集线器/辐射型方式设置 IPSEC 隧道。我通过创建三个站点在 GNS3 中模拟了这一点。每个站点都使用 IOSv 路由器作为 WAN 路由器。我使用站点 2 作为中心，站点 1 和 3 是辐条。我已经能够在站点 1 和站点 2 之间建立 IPSEC 隧道（活动/活动）。但我无法在站点 2 和站点 3 之间建立 IPSEC 隧道。

我通常知道如何在两个站点（点对点）之间建立 IPSEC 隧道；例如站点 1 和站点 2 之间存在的内容。但是一旦我必须向集线器路由器添加额外的 IPSEC 隧道，我的理解就会崩溃。

这是如何构建模拟的图表。

如您所见，我使用三个第 3 层交换机作为三个站点之间的传输网络。我希望两个 IPSEC 隧道都位于集线器路由器上的同一接口 (gi0/0) 上。

上图应显示所有相关配置。

站点 1 IOSv 配置

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco1 address 195.89.28.249
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 10 ipsec-isakmp
 set peer 195.89.28.249
 set transform-set TSET1
 match address 101
!
ip route 0.0.0.0 0.0.0.0 195.89.28.194
ip route 192.168.15.64 255.255.255.252 195.89.28.194
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.193 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.0.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45

Site2 IOSv路由器

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco1 address 195.89.28.193
crypto isakmp key cisco2 address 195.89.28.65
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
 mode tunnel
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 10 ipsec-isakmp
 set peer 195.89.28.193
 set transform-set TSET1
 match address 101
crypto map TST 20 ipsec-isakmp
 set peer 195.89.28.65
 set transform-set TSET2
 match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.250
ip route 192.168.0.64 255.255.255.252 195.89.28.250
ip route 192.168.30.64 255.255.255.252 195.89.28.250
!
access-list 101 permit ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 102 permit ip 192.168.15.0 0.0.0.255 192.168.30.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.249 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.15.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45

Site3 IOSv路由器

crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco2 address 195.89.28.249
!
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 20 ipsec-isakmp
 set peer 195.89.28.249
 set transform-set TSET2
 match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.66
ip route 192.168.15.64 255.255.255.252 195.89.28.66
!
access-list 102 permit ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.30.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45