VPN Router-To-Router Với NAT Ta có sơ đồ sau: (Xem hình) Mô tả: Bài lab thực hiện quá trình tạo một tunnel giữa 2 LAN của 2 chi nhánh qua một môi trường public vớI router Gateway làm router giả lập ISP. Kết hợp ta sử dụng NAT để cho các host bên trong nôi bộ mạng ra internet trừ những traffic được gửI từ 2 LAN để tạo private tunnel. Cấu hình: RA: Building configuration *Mar 1 00:33:37.207: %SYS-5-CONFIG_I: Configured from console by console Current configuration : 1344 bytes ! version 12.2 ! hostname RA ! crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key cisco address 95.95.95.2 ! crypto ipsec transform-set vnpro esp-des ! crypto map lee 10 ipsec-isakmp set peer 95.95.95.2 set transform-set vnpro match address 115 ! interface FastEthernet0/0 ip address 10.50.50.50 255.255.255.0 ip nat inside duplex auto speed auto ! interface Serial0/0 ip address 99.99.99.2 255.255.255.0 ip nat outside no fair-queue crypto map lee ! ip nat inside source route-map nonat interface Serial0/0 overload ßtất cả đều NAT khi đi ra ngoài trừ traffic trong tunnel ip classless ip route 0.0.0.0 0.0.0.0 99.99.99.1 ip http server ! access-list 110 deny ip 10.50.50.0 0.0.0.255 10.103.1.0 0.0.0.255 access-list 110 permit ip any any access-list 115 permit tcp 10.50.50.0 0.0.0.255 10.103.1.0 0.0.0.255 ! route-map nonat permit 10 match ip address 110 ! end RB ! hostname RB ! crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key cisco address 99.99.99.2 ! crypto ipsec transform-set vnpro esp-des ! crypto map lee 10 ipsec-isakmp set peer 99.99.99.2 set transform-set vnpro match address 115 ! interface Ethernet0/0 ip address 10.103.1.75 255.255.255.0 ip nat inside half-duplex ! interface Serial0/0 ip address 95.95.95.2 255.255.255.0 ip nat outside no fair-queue crypto map lee ! ip nat inside source route-map nonat interface Serial0/0 overload ip classless ip route 0.0.0.0 0.0.0.0 95.95.95.1 ip http server ! ! access-list 110 deny ip 10.103.1.0 0.0.0.255 10.50.50.0 0.0.0.255 access-list 110 permit ip any any access-list 115 permit tcp 10.103.1.0 0.0.0.255 10.50.50.0 0.0.0.255 ! route-map nonat permit 10 match ip address 110 ! end RI(Gateway) hostname RI ! ip subnet-zero ! interface Serial0 ip address 99.99.99.1 255.255.255.0 clockrate 64000 ! interface Serial1 ip address 95.95.95.1 255.255.255.0 clockrate 64000 ! ip classless ip route 10.50.50.0 255.255.255.0 99.99.99.2 ip route 10.103.1.0 255.255.255.0 95.95.95.2 end Thực hiện: Sau khi đã thực hiện cấu hình các mạng thấy được nhau, ta bắt đầu tạo VPN vớI NAT: Bước đầu tiên, ta thực hiện cấu hình VPN trên các router (Tương tự như bài VPN basic): RA: RA(config)#crypto isakmp policy 10 RA(config-isakmp)#hash md5 RA(config-isakmp)#authentication pre-share RA(config-isakmp)#exit RA(config)#crypto isakmp key cisco address 95.95.95.2 RA(config)#crypto ipsec transform-set vnpro esp-des RA(cfg-crypto-trans)#exit RA(config)#crypto map lee 10 ipsec-isakmp % NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured. RA(config-crypto-map)#set peer 95.95.95.2 RA(config-crypto-map)#set transform-set vnpro RA(config-crypto-map)#match address 115 RA(config-crypto-map)#exit RA(config)#int s0/0 RA(config-if)#crypto map lee RA(config)#access-list 115 permit tcp 10.50.50.0 0.0.0.255 10.103.1.0 0.0.0.255ß cho phép traffic được mã hóa RB: RB(config)#crypto isakmp policy 10 RB(config-isakmp)#hash md5 RB(config-isakmp)#authentication pre-share RB(config)#crypto isakmp key cisco address 99.99.99.2 RB(config)#crypto ipsec transform-set vnpro esp-des RB(cfg-crypto-trans)#exit RB(config)#crypto map lee 10 ipsec-isakmp % NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured. RB(config-crypto-map)#set peer 99.99.99.2 RB(config-crypto-map)#set transform-set vnpro RB(config-crypto-map)#match address 115 RB(config)#int s0/0 RB(config-if)#crypto map lee RB(config)#access-list 115 permit tcp 10.103.1.0 0.0.0.255 10.50.50.0 0.0.0.255 Sau khi đã thực hiện tạo VPN, ta thực hiện NAT trên router: Ta thực hiện NAT overload trên interface nốI vớI Gateway, trừ traffic trong tunnel, để thực hiện điều này, ta phảI sử dụng một route-map để chặn dòng traffic trong tunnel không bị NAT: RA: RA(config)#access-list 110 deny ip 10.50.50.0 0.0.0.255 10.103.1.0 0.0.0.255 RA(config)#access-list 110 permit ip any any RA(config)#route-map nonat RA(config-route-map)#match ip address 110 RA(config)#ip nat inside source route-map nonat interface s0/0 overload RA(config)#int s0/0 RA(config-if)#ip nat outside RA(config)#int fa0/0 RA(config-if)#ip nat inside RA(config-if)#exit RB RB(config)#access-list 110 deny ip 10.103.1.0 0.0.0.255 10.50.50.50 0.0.0.255 RB(config)#access-list 110 permit ip any any RB(config)#route-map nonat permit 10 RB(config-route-map)#match ip address 110 RB(config)#ip nat inside source route-map nonat interface s0/0 overload RB(config)#int s0/0 RB(config-if)#ip nat outside RB(config-if)#int e0/0 RB(config-if)#ip nat inside RB(config-if)#exit Kiểm tra: Ta sử dụng các lệnh show trên các router: RA#sh crypto isakmp policy Protection suite of priority 10 encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Message Digest 5 authentication method: Pre-Shared Key Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit RA#sh crypto ipsec transform-set Transform set vnpro: { esp-des } will negotiate = { Tunnel, }, RA#sh crypto map Crypto Map "lee" 10 ipsec-isakmp Peer = 95.95.95.2 Extended IP access list 115 access-list 115 permit tcp 10.50.50.0 0.0.0.255 10.103.1.0 0.0.0.255 Current peer: 95.95.95.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ vnpro, } Interfaces using crypto map lee: Serial0/0 Thực hiện debug trên các router và ghi nhận kết quả: Ví dụ: trên RB:Ta thực hiện lệnh ping từ pc bên trong nộI bộ mạng ra ngòai internet và ra chính LAN bên kia: và ghi nhận kết quả lệnh debug ip nat: RB#debug ip nat IP NAT debugging is on RB#debug cry RB#debug crypto ipsec Crypto IPSEC debugging is on RB#debug crypto isakmp Crypto ISAKMP debugging is on RB# *Mar 1 00:41:23.847: NAT: s=10.103.1.1->95.95.95.2, d=99.99.99.1 [1760] *Mar 1 00:41:23.867: NAT*: s=99.99.99.1, d=95.95.95.2->10.103.1.1 [1760] *Mar 1 00:41:24.848: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.1 [1761] *Mar 1 00:41:24.868: NAT*: s=99.99.99.1, d=95.95.95.2->10.103.1.1 [1761] *Mar 1 00:41:25.850: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.1 [1762] *Mar 1 00:41:25.870: NAT*: s=99.99.99.1, d=95.95.95.2->10.103.1.1 [1762] *Mar 1 00:41:26.847: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.1 [1763] *Mar 1 00:41:26.872: NAT*: s=99.99.99.1, d=95.95.95.2->10.103.1.1 [1763] RB# *Mar 1 00:41:44.040: NAT: s=10.103.1.1->95.95.95.2, d=95.95.95.1 [1764] *Mar 1 00:41:44.064: NAT*: s=95.95.95.1, d=95.95.95.2->10.103.1.1 [1764] *Mar 1 00:41:45.037: NAT*: s=10.103.1.1->95.95.95.2, d=95.95.95.1 [1765] *Mar 1 00:41:45.057: NAT*: s=95.95.95.1, d=95.95.95.2->10.103.1.1 [1765] *Mar 1 00:41:46.039: NAT*: s=10.103.1.1->95.95.95.2, d=95.95.95.1 [1766] *Mar 1 00:41:46.087: NAT*: s=95.95.95.1, d=95.95.95.2->10.103.1.1 [1766] *Mar 1 00:41:47.037: NAT*: s=10.103.1.1->95.95.95.2, d=95.95.95.1 [1767] *Mar 1 00:41:47.061: NAT*: s=95.95.95.1, d=95.95.95.2->10.103.1.1 [1767] RB# *Mar 1 00:42:00.270: NAT: s=10.103.1.1->95.95.95.2, d=99.99.99.2 [1768] *Mar 1 00:42:00.314: NAT*: s=99.99.99.2, d=95.95.95.2->10.103.1.1 [1768] *Mar 1 00:42:01.272: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.2 [1769] *Mar 1 00:42:01.308: NAT*: s=99.99.99.2, d=95.95.95.2->10.103.1.1 [1769] *Mar 1 00:42:02.274: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.2 [1770] *Mar 1 00:42:02.310: NAT*: s=99.99.99.2, d=95.95.95.2->10.103.1.1 [1770] *Mar 1 00:42:03.271: NAT*: s=10.103.1.1->95.95.95.2, d=99.99.99.2 [1771] *Mar 1 00:42:03.311: NAT*: s=99.99.99.2, d=95.95.95.2->10.103.1.1 [1771] RB# *Mar 1 00:42:26.874: NAT: expiring 95.95.95.2 (10.103.1.1) icmp 512 (512) *Mar 1 00:42:47.063: NAT: expiring 95.95.95.2 (10.103.1.1) icmp 512 (512) *Mar 1 00:43:03.314: NAT: expiring 95.95.95.2 (10.103.1.1) icmp 512 (512) Ta thấy khi ping ra các mạng ngòai internet thì router có thực hiện Nat, nhưng khi ping tớI 10.50.50.1 thì router không thực hiện NAT. CuốI cùng, ta thực hiện telnet đến pc bên kia và ghi nhận debug: *Mar 1 00 42.164: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= 95.95.95.2, remote= 99.99.99.2, local_proxy= 10.103.1.0/255.255.255.0/6/0 (type=4), remote_proxy= 10.50.50.0/255.255.255.0/6/0 (type=4), protocol= ESP, transform= esp-des , lifedur= 3600s and 4608000kb, spi= 0x3EFC898D(1056737677), conn_id= 0, keysize= 0, flags= 0x400C *Mar 1 00 42.168: ISAKMP: received ke message (1/1) *Mar 1 00 42.168: ISAKMP: local port 500, remote port 500 *Mar 1 00 42.172: ISAKMP (0:1): Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Mar 1 00 42.172: ISAKMP (0:1): Old State = IKE_READY New State = IKE_I_MM1 *Mar 1 00 42.172: ISAKMP (0:1): beginning Main Mode exchange *Mar 1 00 42.172: ISAKMP (0:1): sending packet to 99.99.99.2 (I) MM_NO_STATE *Mar 1 00 42.288: ISAKMP (0:1): received packet from 99.99.99.2 (I) MM_NO_STATE *Mar 1 00 42.288: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00 42.288: ISAKMP (0:1): Old State = IKE_I_MM1 New State = IKE_I_MM2 *Mar 1 00 42.292: ISAKMP (0:1): processing SA payload. message ID = 0 *Mar 1 00 42.292: ISAKMP (0:1): found peer pre-shared key matching 99.99.99.2 *Mar 1 00 42.292: ISAKMP (0:1): Checking ISAKMP transform 1 against priority 10 policy *Mar 1 00 42.292: ISAKMP: encryption DES-CBC *Mar 1 00 42.292: ISAKMP: hash MD5 *Mar 1 00 42.292: ISAKMP: default group 1 *Mar 1 00 42.296: ISAKMP: auth pre-share *Mar 1 00 42.296: ISAKMP: life type in seconds *Mar 1 00 42.296: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Mar 1 00 42.296: ISAKMP (0:1): atts are acceptable. Next payload is 0 *Mar 1 00 42.464: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00 42.464: ISAKMP (0:1): Old State = IKE_I_MM2 New State = IKE_I_MM2 *Mar 1 00 42.468: ISAKMP (0:1): sending packet to 99.99.99.2 (I) MM_SA_SETUP *Mar 1 00 42.468: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Mar 1 00 42.472: ISAKMP (0:1): Old State = IKE_I_MM2 New State = IKE_I_MM3 *Mar 1 00 42.680: ISAKMP (0:1): received packet from 99.99.99.2 (I) MM_SA_SETUP *Mar 1 00 42.684: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00 42.684: ISAKMP (0:1): Old State = IKE_I_MM3 New State = IKE_I_MM4 *Mar 1 00 42.684: ISAKMP (0:1): processing KE payload. message ID = 0 *Mar 1 00 42.893: ISAKMP (0:1): processing NONCE payload. message ID = 0 *Mar 1 00 42.893: ISAKMP (0:1): found peer pre-shared key matching 99.99.99.2 *Mar 1 00 42.893: ISAKMP (0:1): SKEYID state generated *Mar 1 00 42.897: ISAKMP (0:1): processing vendor id payload *Mar 1 00 42.897: ISAKMP (0:1): vendor ID is Unity *Mar 1 00 42.897: ISAKMP (0:1): processing vendor id payload *Mar 1 00 42.897: ISAKMP (0:1): vendor ID is DPD *Mar 1 00 42.897: ISAKMP (0:1): processing vendor id payload *Mar 1 00 42.897: ISAKMP (0:1): speaking to another IOS box! *Mar 1 00 42.897: ISAKMP (0:1): processing vendor id payload *Mar 1 00 42.901: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00 42.901: ISAKMP (0:1): Old State = IKE_I_MM4 New State = IKE_I_MM4 *Mar 1 00 42.917: ISAKMP (0:1): Send initial contact *Mar 1 00 42.917: ISAKMP (0:1): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR *Mar 1 00 42.917: ISAKMP (1): ID payload next-payload : 8 type : 1 protocol : 17 port : 500 length : 8 *Mar 1 00 42.917: ISAKMP (1): Total payload length: 12 *Mar 1 00 42.921: ISAKMP (0:1): sending packet to 99.99.99.2 (I) MM_KEY_EXCH *Mar 1 00 42.921: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Mar 1 00 42.925: ISAKMP (0:1): Old State = IKE_I_MM4 New State = IKE_I_MM5 *Mar 1 00 43.021: ISAKMP (0:1): received packet from 99.99.99.2 (I) MM_KEY_EXCH *Mar 1 00 43.021: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00 43.021: ISAKMP (0:1): Old State = IKE_I_MM5 New State = IKE_I_MM6 *Mar 1 00 43.025: ISAKMP (0:1): processing ID payload. message ID = 0 *Mar 1 00 43.025: ISAKMP (0:1): processing HASH payload. message ID = 0 *Mar 1 00 43.025: ISAKMP (0:1): SA has been authenticated with 99.99.99.2 *Mar 1 00 43.029: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00 43.029: ISAKMP (0:1): Old State = IKE_I_MM6 New State = IKE_I_MM6 *Mar 1 00 43.029: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Mar 1 00 43.029: ISAKMP (0:1): Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE *Mar 1 00 43.033: ISAKMP (0:1): beginning Quick Mode exchange, M-ID of 2008853158 *Mar 1 00 43.037: ISAKMP (0:1): sending packet to 99.99.99.2 (I) QM_IDLE *Mar 1 00 43.037: ISAKMP (0:1): Node 2008853158, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Mar 1 00 43.037: ISAKMP (0:1): Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Mar 1 00 43.037: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Mar 1 00 43.037: ISAKMP (0:1): Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 1 00 43.426: ISAKMP (0:1): received packet from 99.99.99.2 (I) QM_IDLE *Mar 1 00 43.430: ISAKMP (0:1): processing HASH payload. message ID = 2008853158 *Mar 1 00 43.430: ISAKMP (0:1): processing SA payload. message ID = 2008853158 *Mar 1 00 43.434: ISAKMP (0:1): Checking IPSec proposal 1 *Mar 1 00 43.434: ISAKMP: transform 1, ESP_DES *Mar 1 00 43.434: ISAKMP: attributes in transform: *Mar 1 00 43.434: ISAKMP: encaps is 1 *Mar 1 00 43.434: ISAKMP: SA life type in seconds *Mar 1 00 43.434: ISAKMP: SA life duration (basic) of 3600 *Mar 1 00 43.434: ISAKMP: SA life type in kilobytes *Mar 1 00 43.434: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Mar 1 00 43.438: ISAKMP (0:1): atts are acceptable. *Mar 1 00 43.438: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 95.95.95.2, remote= 99.99.99.2, local_proxy= 10.103.1.0/255.255.255.0/6/0 (type=4), remote_proxy= 10.50.50.0/255.255.255.0/6/0 (type=4), protocol= ESP, transform= esp-des , lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4 *Mar 1 00 43.442: ISAKMP (0:1): processing NONCE payload. message ID = 2008853158 *Mar 1 00 43.442: ISAKMP (0:1): processing ID payload. message ID = 2008853158 *Mar 1 00 43.442: ISAKMP (0:1): processing ID payload. message ID = 2008853158 *Mar 1 00 43.450: ISAKMP (0:1): Creating IPSec SAs *Mar 1 00 43.450: inbound SA from 99.99.99.2 to 95.95.95.2 (proxy 10.50.50.0 to 10.103.1.0) *Mar 1 00 43.450: has spi 0x3EFC898D and conn_id 2000 and flags 4 *Mar 1 00 43.450: lifetime of 3600 seconds *Mar 1 00 43.450: lifetime of 4608000 kilobytes *Mar 1 00 43.450: outbound SA from 95.95.95.2 to 99.99.99.2 (proxy 10.103.1.0 to 10.50.50.0 ) *Mar 1 00 43.450: has spi -1029094571 and conn_id 2001 and flags C *Mar 1 00 43.454: lifetime of 3600 seconds *Mar 1 00 43.454: lifetime of 4608000 kilobytes *Mar 1 00 43.454: ISAKMP (0:1): sending packet to 99.99.99.2 (I) QM_IDLE *Mar 1 00 43.454: ISAKMP (0:1): deleting node 2008853158 error FALSE reason "" *Mar 1 00 43.454: ISAKMP (0:1): Node 2008853158, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Mar 1 00 43.458: ISAKMP (0:1): Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE *Mar 1 00 43.458: IPSEC(key_engine): got a queue event *Mar 1 00 43.458: IPSEC(initialize_sas): , (key eng. msg.) INBOUND local= 95.95.95.2, remote= 99.99.99.2, local_proxy= 10.103.1.0/255.255.255.0/6/0 (type=4), remote_proxy= 10.50.50.0/255.255.255.0/6/0 (type=4), protocol= ESP, transform= esp-des , lifedur= 3600s and 4608000kb, spi= 0x3EFC898D(1056737677), conn_id= 2000, keysize= 0, flags= 0x4 *Mar 1 00 43.458: IPSEC(initialize_sas): , (key eng. msg.) OUTBOUND local= 95.95.95.2, remote= 99.99.99.2, local_proxy= 10.103.1.0/255.255.255.0/6/0 (type=4), remote_proxy= 10.50.50.0/255.255.255.0/6/0 (type=4), protocol= ESP, transform= esp-des , lifedur= 3600s and 4608000kb, spi= 0xC2A94355(3265872725), conn_id= 2001, keysize= 0, flags= 0xC . hiện: Sau khi đã thực hiện cấu hình các mạng thấy được nhau, ta bắt đầu tạo VPN vớI NAT: Bước đầu tiên, ta thực hiện cấu hình VPN trên các router (Tương tự như bài VPN basic): RA: RA(config)#crypto. 255.255.255.0 ip nat inside duplex auto speed auto ! interface Serial0/0 ip address 99.99.99.2 255.255.255.0 ip nat outside no fair-queue crypto map lee ! ip nat inside source route-map nonat interface. 255.255.255.0 ip nat inside half-duplex ! interface Serial0/0 ip address 95.95.95.2 255.255.255.0 ip nat outside no fair-queue crypto map lee ! ip nat inside source route-map nonat interface Serial0/0