在Cisco路由器上配置VRF-aware IPsec VPN详解

之前通过场景实例向大家展示了用Virtual Routing and Forwarding (VRF，虚拟路由转发)将一个路由器分割成八个虚拟路由器的方法。当时我向大家演示了如何配置VRF，在本文中我们继续使用这个场景，并通过IPsec配置，将完全一致的拓扑结构和地址复制到八个实验环境。整个环境能够顺利进行，首先需要带有ASA的虚拟路由与Cisco 路由器建立VPN。这需要 VRF参与的IPsec。因此我需要一种方法能够实现完全一致的 isakmp 策略，一致的pre-shared keys, 一致的 crypto ACL, 也就是每个 VRF上的参数一致。实际的配置过程可能比我们想像的简单一些。下面我就来举例说明整个过程。

首先是建立ISAKMP 策略：

!

crypto isakmp policy 10

encr aes 256

authentication pre-share

group 2

!

在配置过程中，我们可以在八个VRF中使用相同的元素，因此只需要建立一个ISAKMP 策略。接下来建立crypto ACL 以及一个 IPsec transform set。

ip access-list extended VPN

permit ip 10.0.100.0 0.0.0.255 10.0.1.0 0.0.0.255

crypto ipsec transform-set VPN-TRANS esp-aes esp-sha-hmac.

接下来是建立 pre-shared key。在本例中我曾经使用过一个keyring 作为 预共享 key，因此我直接将其绑定到 VRF即可。

crypto keyring POD1keys vrf POD1

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD2keys vrf POD2

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD3keys vrf POD3

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD4keys vrf POD4

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD5keys vrf POD5

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD6keys vrf POD6

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD7keys vrf POD7

pre-shared-key address 192.168.1.2 key cisco123

crypto keyring POD8keys vrf POD7

pre-shared-key address 192.168.1.2 key cisco123

!

接下来建立 crypto-maps.

!

crypto map pod1 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod2 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod3 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod4 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod5 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod6 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

crypto map pod7 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

set isakmp-profile pod7

match address VPN

!

crypto map pod8 10 ipsec-isakmp

set peer 192.168.1.2

set transform-set VPN-TRANS

set pfs group2

match address VPN

!

一旦 crypto-maps 被合并到一起，就可以应用到接口上了。

interface FastEthernet0/0.1

crypto map pod1

!

interface FastEthernet0/0.2

crypto map pod2

!

interface FastEthernet0/0.3

crypto map pod3

!

interface FastEthernet0/0.4

crypto map pod4

!

interface FastEthernet0/0.5

crypto map pod5

!

interface FastEthernet0/0.6

crypto map pod6

!

interface FastEthernet0/0.7

crypto map pod7

!

interface FastEthernet0/0.8

crypto map pod8

!