MSR系列路由器IKEDPD功能的配置举例

MSR系列路由器IKEDPD功能的配置举例
MSR系列路由器IKE DPD功能的配置举例
Copyright ? 2014杭州华三通信技术有限公司版权所有，保留⼀切权利。

⾮经本公司书⾯许可，任何单位和个⼈不得擅⾃摘抄、复制本⽂档内容的部分或全部，
并不得以任何形式传播。

本⽂档中的信息可能变动，恕不另⾏通知。

⽬录
1 简介 (1)
2 配置前提 (1)
3 配置举例 (1)
3.1 组⽹需求 (1)
3.2 使⽤版本 (1)
3.3 配置注意事项 (1)
3.4 配置步骤 (1)
3.4.1 Router A的配置 (1)
3.4.2 Router B的配置 (2)
3.5 验证配置 (3)
3.6 配置⽂件 (6)
4 相关资料 (7)
1 简介
本⽂档介绍MSR系列路由器IKE DPD功能的典型配置举例。

2 配置前提
本⽂档不严格与具体软、硬件版本对应，如果使⽤过程中与产品实际情况有差异，请参考相关产品⼿册，或以设备实际情况为准。

本⽂档中的配置均是在实验室环境下进⾏的配置和验证，配置前设备的所有参数均采⽤出⼚时的缺省配置。

如果您已经对设备进⾏了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。

本⽂档假设您已了解IPsec特性。

3 配置举例
3.1 组⽹需求
如图1所⽰，Router A和Router B之间建⽴IPsec连接。

要求：在Router A和Router B上都配置DPD 功能进⾏对等体存活状态检测。

图1MSR系列路由器IKE DPD功能的配置组⽹图
3.2 使⽤版本
本举例是在Release 2317版本上进⾏配置和验证的。

3.3 配置注意事项
DPD实验不要采⽤2台设备直连⽅式，因为在这种⽅式下把⽹线、链路层Down，不会有路由，所
以⽤于触发IPsec的包不会发送到接⼝，因⽽也不能触发任何IPsec模块。

3.4 配置步骤
3.4.1 Router A的配置
# 配置接⼝Ethernet0/0的IP地址。

system-view
[RouterA] interface ethernet 0/0
[RouterA-Ethernet0/0] ip address 1.2.0.2 255.255.255.252
[RouterA-Ethernet0/0] quit
# 配置ACL，定义由1.2.0.2/30到1.2.0.1/30的数据流。

[RouterA] acl number 3000
[RouterA-acl-adv-3000] rule 0 permit ip source 1.2.0.2 0 destination 1.2.0.1 0 [RouterA-acl-adv-3000] quit # 创建⼀个DPD并采⽤默认配置。

[RouterA] ike dpd dpdgroup
[RouterA-ike-dpd-dpdgroup] quit
# 配置IKE对等体。

[RouterA] ike peer branch
[RouterA-ike-peer-branch] pre-shared-key 123
[RouterA-ike-peer-branch] remote-address 1.2.0.1
# 引⽤指定的DPD。

[RouterA-ike-peer-branch] dpd dpdgroup
[RouterA-ike-peer-branch] quit
# 采⽤安全提议的缺省配置。

[RouterA] ipsec proposal def
[RouterA-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterA-ipsec-transform-set-def] quit
# 配置IPsec安全策略branch，其协商⽅式为isakmp。

[RouterA] ipsec policy branch 1 isakmp
[RouterA-ipsec-policy-isakmp-branch-1] security acl 3000
[RouterA-ipsec-policy-isakmp-branch-1] ike-peer branch
[RouterA-ipsec-policy-isakmp-branch-1] proposal def
[RouterA-ipsec-policy-isakmp-branch-1] quit
# 在接⼝上应⽤安全策略。

[RouterA] interface ethernet 0/0
[RouterA-Ethernet0/0] ipsec policy branch
[RouterA-Ethernet0/0] quit
3.4.2 Router B的配置
# 配置接⼝Ethernet0/0的IP地址。

system-view
[RouterB] interface ethernet 0/0
[RouterB-Ethernet0/0] ip address 1.2.0.1 255.255.255.252
[RouterB-Ethernet0/0] quit
# 配置ACL，定义由1.2.0.1/30到1.2.0.2/30的数据流。

[RouterB] acl number 3000
[RouterB-acl-adv-3000] rule 0 permit ip source 1.2.0.1 0 destination 1.2.0.2 0 [RouterB-acl-adv-3000] quit # 创建⼀个DPD并采⽤默认配置。

[RouterB] ike dpd dpdgroup
[RouterB-ike-dpd-dpdgroup] quit
# 配置IKE对等体。

[RouterB] ike peer center
[RouterB-ike-peer-center] pre-shared-key 123
[RouterB-ike-peer-center] remote-address 1.2.0.2
# 引⽤指定的DPD。

[RouterB-ike-peer-center] dpd dpdgroup
[RouterB-ike-peer-center] quit
# 采⽤安全提议的缺省配置。

[RouterB] ipsec proposal def
[RouterB-ipsec-transform-set-def] esp authentication-algorithm md5
[RouterB-ipsec-transform-set-def] quit
# 配置IPsec安全策略center，其协商⽅式为isakmp。

[RouterB] ipsec policy center 1 isakmp
[RouterB-ipsec-policy-isakmp-center-1] security acl 3000
[RouterB-ipsec-policy-isakmp-center-1] ike-peer center
[RouterB-ipsec-policy-isakmp-center-1] proposal def
[RouterB-ipsec-policy-isakmp-center-1] quit
# 在接⼝上应⽤安全策略。

[RouterB] interface ethernet 0/0
[RouterB-Ethernet0/0] ipsec policy center
[RouterB-Ethernet0/0] quit
3.5 验证配置
以上配置完成后，IPsec建⽴，即可进⾏对等体存活检测。

此处以Router A为例进⾏验证。

# 通过ping触发建⽴IPsec会话：
ping 1.2.0.1
PING 1.2.0.1: 56 data bytes, press CTRL_C to break
Request time out
Reply from 1.2.0.1: bytes=56 Sequence=1 ttl=255 time=3 ms
Reply from 1.2.0.1: bytes=56 Sequence=2 ttl=255 time=2 ms
Reply from 1.2.0.1: bytes=56 Sequence=3 ttl=255 time=3 ms
Reply from 1.2.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms
--- 1.2.0.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 2/2/3 ms
# 可以通过如下显⽰信息看到，Router A作为发起⽅已与Router B协商⽣成了两个阶段的SA。

display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------------
1 1.2.0.1 RD|ST 1 IPSEC
2 1.2.0.1 RD|ST 2 IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK—REKEY # 可以通过如下显⽰信息查看协商⽣成的IPsec SA。

display ipsec sa
===============================
Interface: Ethernet0/0
path MTU: 1500
===============================
-----------------------------
IPsec policy name: "branch"
sequence number: 1
acl version: ACL4
mode: isakmp
-----------------------------
PFS: N, DH group: none
tunnel:
local address: 1.2.0.2
remote address: 1.2.0.1
flow:
sour addr: 1.2.0.2/255.255.255.255 port: 0 protocol: IP dest addr: 1.2.0.1/255.255.255.255 port: 0 protocol: IP [inbound ESP SAs]
spi: 0xBC64491(197543057)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5 in use setting: Tunnel
connection id: 1
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1843199/3098 anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: N [outbound ESP SAs]
spi: 0x6F69A823(1869195299)
transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5 in use setting: Tunnel
connection id: 2
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1843199/3098 anti-replay detection: Enabled
anti-replay window size(counter based): 32
udp encapsulation used for nat traversal: N
# 打开Debugging IKE DPD的开关。

debugging ike dpd
terminal debugging
Info: Current terminal debugging is on.
terminal monitor
Info: Current terminal monitor is on.
# 连续发出100个包进⾏测试。

ping -c 100 1.2.0.1
PING 1.2.0.1: 56 data bytes, press CTRL_C to break
# 发包前会发出DPD请求。

*Jun 17 15:47:31:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: branch send dpd request message(seqno:59559045)
# 收到了对⽅发出的DPD应答。

*Jun 17 15:47:32:002 2013 RouterA IKE/7/DEBUG:
IKE_DPD: recv dpd response message(seqno:59559045)
*Jun 17 15:47:32:002 2013 RouterA IKE/7/DEBUG:
IKE_DPD: PF_KEY notify ipsec to update dpd recv_time.
Reply from 1.2.0.1: bytes=56 Sequence=0 ttl=255 time=7 ms Reply from 1.2.0.1: bytes=56 Sequence=1 ttl=255 time=2 ms Reply from 1.2.0.1: bytes=56 Sequence=2 ttl=255 time=3 ms Reply from 1.2.0.1: bytes=56 Sequence=3 ttl=255 time=2 ms Reply from 1.2.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms Reply from 1.2.0.1: bytes=56 Sequence=5 ttl=255 time=3 ms Reply from 1.2.0.1: bytes=56 Sequence=6 ttl=255 time=2 ms Reply from 1.2.0.1: bytes=56 Sequence=7 ttl=255 time=3 ms #此时Branch端拔掉⽹线。

Request time out
Request time out
Request time out
# 在等候⼀段时间后发送第⼀个DPD请求。

*Jun 17 15:48:31:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: branch send dpd request message(seqno:59559045)
Request time out
Request time out
# 发送第⼀个DPD请求后，等待5秒后超时。

*Jun 17 15:48:31:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: wait for response timeout
# 发送第⼆个DPD请求。

*Jun 17 15:48:36:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: branch send dpd request message(seqno:59559045) Request time out
Request time out
# 第⼆个请求等候超时。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: wait for response timeout
# 发送第三个DPD请求。

*Jun 17 15:48:46:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: branch send dpd request message(seqno:59559045)
Request time out
Request time out
# 第三个请求等候超时。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: wait for response timeout
# DPD三次请求超时后删除所有SA。

*Jun 17 15:48:41:999 2013 RouterA IKE/7/DEBUG:
IKE_DPD: there are three fail and all SAs associated were deleted
Request time out
Request time out
# 再次察看，已不存在任何SA。

display ike sa
total phase-1 SAs: 0
connection-id peer flag phase doi
----------------------------------------------------------------
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK--REKEY 3.6 配置⽂件Router A：
acl number 3000
rule 0 permit ip source 1.2.0.2 0 destination 1.2.0.1 0
#
ike dpd dpdgroup
#
ike peer branch
pre-shared-key cipher $c$3$MobqI+3fm3cTUxd2w6SRHBUPNUVU7Q==
remote-address 1.2.0.1
dpd dpdgroup
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy branch 1 isakmp
security acl 3000
ike-peer branch
transform-set def
#
interface Ethernet0/0
port link-mode route
ip address 1.2.0.2 255.255.255.252
ipsec policy branch
#
Router B：
acl number 3000
rule 0 permit ip source 1.2.0.1 0 destination 1.2.0.2 0
#
ike dpd dpdgroup
#
ike peer center
pre-shared-key cipher $c$3$y9shh89pN5at95nRCMBmm55d7G0WQg== remote-address 1.2.0.2 dpd dpdgroup
#
ipsec transform-set def
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
#
ipsec policy center 1 isakmp
security acl 3000
ike-peer center
transform-set def
#
interface Ethernet0/0
port link-mode route
ip address 1.2.0.1 255.255.255.252
ipsec policy center
#
4 相关资料
H3C MSR 系列路由器命令参考(V5)-R2311
H3C MSR 系列路由器配置指导(V5)-R2311。