IPSec Internet Protocol Security 作为一种开放标准的安全框架结构，可以用来保证IP数据报文在网络上传输的机密性、完整性和防重放

机密性：对数据进行加密保护，用密文的性质传输数据
完整性：对接收的数据进行认证，以判定报文是否被篡改。
防重放：防止恶意用户通过重复发送捕获到的数据包进行攻击，拒绝接收重复的数据包

IPSec架构：
IPSec 包括AH和ESP这两个安全协议来实现IP数据报文的安全传送。一般用ESP有加密功能
IKE协议：用于自动协商AH和ESP所使用的加密算法进行秘钥协商，建立和维护安全联盟SA等服务

安全联盟SA
安全联盟定义了IPSec对等体间将使用的数据封装模式、认证和加密算法、秘钥等参数；
安全联盟是单向的，两个对等体之间的双向通信、至少需要两个SA.
SA 有一个三元组唯一标识：包括安全参数索引SPI，目的IP地址，安全协议(AH/ESP)
建立SA的方式有两种：
手动方式
IKE动态协商方式

IPSec 协议有两种封装模式:传输模式和隧道模式
传输模式：AH或ESP报头位于IP报头和传输层报头之间
隧道模式：IPSec会另外生成一个新的IP报头，并封装在AH或ESP之前。

IPSec VPN 配置步骤：
1.配置网络可达
2.配置ACL识别兴趣流
3.创建安全提议：定义保护数据流所用的安全协议、认证算法、加密算法和封装模式
4.创建安全策略：手工建立SA策略和IKE协商建立SA的策略
5.应用安全策略

配置实例手动模式

定义

加密点：61.128.1.1-->102.100.1.1
通讯点：172.16.1.0/24 -->10.1.1.0/24

AR2 上配置
###配置默认路由

[AR2]ip route-static 0.0.0.0 0 61.128.1.10
[AR2]dis ip routing-table | include 61.128.1.10
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: PublicDestinations : 11       Routes : 11       
Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
0.0.0.0/0   Static  60   0          RD   61.128.1.10     GigabitEthernet0/0/1

##配置ACL 和 感兴趣流

[AR2]acl 3000
[AR2-acl-adv-3000]rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 10.1.
1.0 0.0.0.255
[AR2-acl-adv-3000]

##创建安全协议 可以自定义加密算法或者默认设置

[AR2]ipsec proposal transAR2
[AR2-ipsec-proposal-transAR2]di th
[V200R003C00]
#
ipsec proposal transAR2esp authentication-algorithm sha2-512esp encryption-algorithm aes-256
#
return
[AR2-ipsec-proposal-transAR2]
###查看安全协议
[AR2]dis ipsec proposal
Number of proposals: 1
IPSec proposal name: transAR2                            Encapsulation mode: Tunnel                            Transform         : esp-newESP protocol      : Authentication SHA2-HMAC-512                             Encryption     AES-256

###创建IPsec sa 阶段

[AR2]ipsec policy AR2-policy 10 manu    
[AR2]ipsec policy AR2-policy 10 manual
[AR2-ipsec-policy-manual-AR2-policy-10]di th
[V200R003C00]
#
ipsec policy AR2-policy 10 manualsecurity acl 3000proposal transAR2tunnel local 61.128.1.1tunnel remote 202.100.1.1sa spi inbound esp 12345sa string-key inbound esp simple huayunsa spi outbound esp 54321sa string-key outbound esp simple huayun
#
return
[AR2-ipsec-policy-manual-AR2-policy-10]q[AR2]dis ipsec policy briefNumber of policies group : 2
Number of policies       : 2Policy name           Mode     ACL   Peer name   Local address    Remote address
--------------------------------------------------------------------------------
AR2-policy-10         manual   3000             61.128.1.1       202.100.1.1
[AR2]dis ipsec policy name AR2-policy===========================================
IPSec policy group: "AR2-policy"
Using interface: GigabitEthernet0/0/1
===========================================Sequence number: 10Security data flow: 3000Tunnel local  address: 61.128.1.1Tunnel remote address: 202.100.1.1Qos pre-classify: DisableProposal name:transAR2Inbound AH setting:AH SPI:AH string-key:AH authentication hex key:Inbound ESP setting:ESP SPI: 12345 (0x3039)ESP string-key: huayunESP encryption hex key:ESP authentication hex key:Outbound AH setting:AH SPI:AH string-key:AH authentication hex key:Outbound ESP setting:ESP SPI: 54321 (0xd431)ESP string-key: huayunESP encryption hex key:ESP authentication hex key:
[AR2]
[AR2]

###放置到接口下条用

[AR2]di ip inter brief
Interface                         IP Address/Mask      Physical   Protocol  
GigabitEthernet0/0/0              172.16.1.254/24      up         up        
GigabitEthernet0/0/1              61.128.1.1/24        up         up        
GigabitEthernet0/0/2              unassigned           down       down      
NULL0                             unassigned           up         up(s)     
[AR2]inter g 0/0/1
[AR2-GigabitEthernet0/0/1]di th
[V200R003C00]
#
interface GigabitEthernet0/0/1ip address 61.128.1.1 255.255.255.0ipsec policy AR2-policy
#
return
[AR2-GigabitEthernet0/0/1]

###AR4 上配置

##配置默认路由
[AR4]
[AR4]ip route-static 0.0.0.0 0 202.100.1.10
<AR4>di ip routing-table | include 202.100.1.10
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: PublicDestinations : 11       Routes : 11       
Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
0.0.0.0/0   Static  60   0          RD   202.100.1.10    GigabitEthernet0/0/0

##配置ACL

[AR4]dis acl allTotal quantity of nonempty ACL number is 1Advanced ACL 3000, 1 rule
Acls step is 5rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

###查看安全协议

[AR4]dis ipsec proposalNumber of proposals: 1IPSec proposal name: transAR4                            Encapsulation mode: Tunnel                            Transform         : esp-newESP protocol      : Authentication SHA2-HMAC-512                             Encryption     AES-256
[AR4]ipsec proposal transAR4
[AR4-ipsec-proposal-transAR4]di th
[V200R003C00]
#
ipsec proposal transAR4esp authentication-algorithm sha2-512esp encryption-algorithm aes-256
#
return
[AR4-ipsec-proposal-transAR4]q

###查看SA 内容

[AR4]dis ipsec policy briefNumber of policies group : 1
Number of policies       : 1Policy name           Mode     ACL   Peer name   Local address    Remote address
--------------------------------------------------------------------------------AR4-policy-10         manual   3000             202.100.1.1      61.128.1.1###SA配置
[AR4]ipsec policy AR4-policy 10 manual
[AR4-ipsec-policy-manual-AR4-policy-10]di th
[V200R003C00]
#
ipsec policy AR4-policy 10 manualsecurity acl 3000proposal transAR4tunnel local 202.100.1.1tunnel remote 61.128.1.1sa spi inbound esp 54321sa string-key inbound esp simple huayunsa spi outbound esp 12345sa string-key outbound esp simple huayun
#
return
[AR4-ipsec-policy-manual-AR4-policy-10]q
[AR4]dis ipsec policy name AR4-policy===========================================
IPSec policy group: "AR4-policy"
Using interface: GigabitEthernet0/0/0
===========================================Sequence number: 10Security data flow: 3000Tunnel local  address: 202.100.1.1Tunnel remote address: 61.128.1.1Qos pre-classify: DisableProposal name:transAR4Inbound AH setting:AH SPI:AH string-key:AH authentication hex key:Inbound ESP setting:ESP SPI: 54321 (0xd431)ESP string-key: huayunESP encryption hex key:ESP authentication hex key:Outbound AH setting:AH SPI:AH string-key:AH authentication hex key:Outbound ESP setting:ESP SPI: 12345 (0x3039)ESP string-key: huayunESP encryption hex key:ESP authentication hex key:

###进入端口进行条用

[AR4]dis ip inter briefInterface                         IP Address/Mask      Physical   Protocol  
GigabitEthernet0/0/0              202.100.1.1/24       up         up        
GigabitEthernet0/0/1              10.1.1.254/24        up         up        
GigabitEthernet0/0/2              unassigned           down       down      
NULL0                             unassigned           up         up(s)     
[AR4]inter g 0/0/0
[AR4-GigabitEthernet0/0/0]di th
[V200R003C00]
#
interface GigabitEthernet0/0/0ip address 202.100.1.1 255.255.255.0ipsec policy AR4-policy
#
return
[AR4-GigabitEthernet0/0/0]

PC机器上进行验证

###查看状态

<AR2>dis ipsec statistics espInpacket count            : 18Inpacket auth count       : 0Inpacket decap count      : 0Outpacket count           : 25Outpacket auth count      : 0Outpacket encap count     : 0Inpacket drop count       : 0Outpacket drop count      : 0BadAuthLen count          : 0AuthFail count            : 0InSAAclCheckFail count    : 0PktDuplicateDrop count    : 0PktSeqNoTooSmallDrop count: 0PktInSAMissDrop count     : 0
<AR2>

自动协商模式