gre over ipsec&ipsec over gre

原创

cz涛声依旧 2011-04-13 20:08:12 博主文章分类：vpn ©著作权

文章标签 vpn H3C ipsec 休闲 gre 文章分类 网络安全

©著作权归作者所有：来自51CTO博客作者cz涛声依旧的原创作品，请联系作者获取转载授权，否则将追究法律责任

GRE over IPsec & IPsec over GRE总结

1.gre over ipsec：

从字面上就能看出，先gre后ipsec，也就是ipsec封装gre，利用gre的支持多协议支持组播等优点，补偿了ipsec虽然足够安全却不能支持组播的缺点。

一般的这种方法较为常用！

2.ipsec over gre：

先ipsec后gre，即用gre封装ipsec，不过注意！使用这种方法的时候，路由协议传播的是明文！个人认为这种方法几乎没什么用处

3.配置上的区别：

GRE over IPsec IPsec over GRE

ACL定义：                 GRE数据流                    内网数据流
IKE Peer中remote-address  对方公网地               对方GRE Tunnel地址
应用端口：                 公网出                          GRE Tunnel上

下面演示一个gre over ipsec的情况：

现象：

<MSR20-1>ping -a 1.1.1.1 3.3.3.3

PING 3.3.3.3: 56 data bytes, press CTRL_C to break

Request time out//触发成功

Reply from 3.3.3.3: bytes=56 Sequence=2 ttl=255 time=15 ms

Reply from 3.3.3.3: bytes=56 Sequence=3 ttl=255 time=25 ms

Reply from 3.3.3.3: bytes=56 Sequence=4 ttl=255 time=4 ms

Reply from 3.3.3.3: bytes=56 Sequence=5 ttl=255 time=10 ms

--- 3.3.3.3 ping statistics ---

5 packet(s) transmitted

4 packet(s) received

20.00% packet loss

round-trip min/avg/max = 4/13/25 ms

<MSR20-1>dis ipsec sa

===============================

Interface: Serial0/2/0

path MTU: 1500

===============================

-----------------------------

IPsec policy name: "1"

sequence number: 10

mode: isakmp

-----------------------------

connection id: 4

encapsulation mode: tunnel

perfect forward secrecy: None

tunnel:

local address: 12.12.12.1

remote address: 23.23.23.3

Flow :

sour addr: 12.12.12.1/255.255.255.255 port: 0 protocol: IP

dest addr: 23.23.23.3/255.255.255.255 port: 0 protocol: IP

[inbound ESP SAs]

spi: 3986132179 (0xed978cd3)

proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

sa remaining key duration (bytes/sec): 1887436368/3541

max received sequence-number: 4

udp encapsulation used for nat traversal: N

[outbound ESP SAs]

spi: 3769304816 (0xe0ab06f0)

proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

sa remaining key duration (bytes/sec): 1887436368/3541

max sent sequence-number: 5

udp encapsulation used for nat traversal: N

<MSR20-1>dis ike sa

total phase-1 SAs: 1

connection-id peer flag phase doi

----------------------------------------------------------

4 23.23.23.3 RD|ST 2 IPSEC

2 23.23.23.3 RD|ST 1 IPSEC

flag meaning

RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT

<MSR20-2>deb gre all

<MSR20-2>deb ipsec all

<MSR20-2>

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:--- Receive IPSec(ESP) packet ---

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:Src:12.12.12.1 Dst:23.23.23.3 SPI:3769304816(0xe0ab06f0)

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:New ESP(RFC2406) Enc Alg:DES Auth Alg:HMAC-MD5-96

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:Replay Checking Enabled! SN:5

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:ESP new input: Authentication succeed!

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:IPSEC Task: Decryption succeed!

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:Tunnel mode. Org Src:12.12.12.1 Org Dst:23.23.23.3

*Apr 13 20:13:08:406 2011 MSR20-2 IPSEC/7/DBG:Now send it to IP input process...