| 設定例 > IPsec負荷分散+冗長設定 |
| 2．F100（PPPoEとEWANの2回線）とF1000×2台でIPsec負荷分散をおこなう |
| F1000-1側 | 192.168.3.1 |
| F1000-2側 | 192.168.3.20 |
| F100側 | 172.16.0.1 |
| 回線1 | PPPoE１ |
| 回線2 | EWAN2 |
! ! ! LAN側IPアドレスを設定します。 ! Router> enable Enter password: super ←パスワードを入力します。（実際は表示されない） Router# Router# configure terminal Router(config)# Router(config)# interface lan 1 Router(config-if lan 1)# ip address 172.16.0.1 255.255.0.0 Router(config-if lan 1)# exit ! ! ! PPPoE1インタフェース設定モードに移行します。 ! Router(config)# interface pppoe 1 Router(config-if pppoe 1)# ! ! ! PPPoEの各種設定をします。 ! Router(config-if pppoe 1)# ip nat inside source list 99 interface Router(config-if pppoe 1)# pppoe server A-Provider Router(config-if pppoe 1)# pppoe account user@xxxx.ne.jp secret Router(config-if pppoe 1)# pppoe type host Router(config-if pppoe 1)# crypto map map1 Router(config-if pppoe 1)# exit ! ! ! ewan 2インタフェース設定モードに移行します。 ! Router(config)# interface ewan 2 Router(config-if ewan 2)# ! ! ! 負荷分散用の設定をします。 ! Router(config-if pppoe 5)# crypto map map2 Router(config-if pppoe 5)# ip address 192.168.100.1 255.255.255.0 Router(config-if pppoe 5)# exit ! ! ! access-listを登録します。 ! Router(config)# access-list 99 permit any ! ! ! ルート情報を設定します。 ! Router(config)# ip route 10.0.0.2 255.255.255.255 pppoe 1 Router(config)# ip route 192.168.200.1 255.255.255.255 192.168.100.2 ! ! ! DHCPサーバ機能を設定します。 ! Router(config)# service dhcp-server Router(config)# ip dhcp pool lan1 Router(config-dhcp-pool)# default-router 172.16.0.1 Router(config-dhcp-pool)# exit Router(config)# ! ! ! ホストネームを指定します。 ! Router(config)# hostname F100-1 ! ! ! 暗号化を使用する設定します。 ! Router(config)# vpn enable Router(config)# vpnlog enable Router(config)# ipsec access-list 32 ipsec ip 172.16.0.0 0.0.255.255 192.168.3.0 0.0.0.255 Router(config)# ipsec access-list 64 bypass ip any any Router(config)# crypto isakmp policy 1 Router(config-isakmp)# authentication prekey Router(config-isakmp)# key ascii furukawa Router(config-isakmp)# negotiation-mode aggressive Router(config-isakmp)# my-identity kyoten1 Router(config-isakmp)# peer-identity address 10.0.0.2 Router(config-isakmp)# keepalive-icmp peer-address 192.168.3.1 Router(config-isakmp)# keepalive-icmp source-interface lan 1 Router(config-isakmp)# keepalive-icmp multi-path interface pppoe 1 Router(config-isakmp)# keepalive icmp always-send Router(config-isakmp)# exit Router(config)# crypto isakmp policy 2 Router(config-isakmp)# authentication prekey Router(config-isakmp)# key ascii furukawa Router(config-isakmp)# peer-identity address 192.168.200.1 Router(config-isakmp)# keepalive-icmp peer-address 192.168.3.20 Router(config-isakmp)# keepalive-icmp source-interface lan 1 Router(config-isakmp)# keepalive-icmp multi-path address 192.168.100.2 Router(config-isakmp)# keepalive icmp always-send Router(config-isakmp)# exit Router(config)#crypto map map1 1 Router(config-crypto-map)# match address 32 multi-path Router(config-crypto-map)# set peer address 10.0.0.2 Router(config-crypto-map)# set security-association always-up Router(config-crypto-map)# sa-up route interface pppoe 1 Router(config-crypto-map)# exit Router(config)#crypto map map2 2 Router(config-crypto-map)# match address 32 multi-path Router(config-crypto-map)# set peer address 192.168.200.1 Router(config-crypto-map)# set security-association always-up Router(config-crypto-map)# sa-up route address 192.168.100.2 Router(config-crypto-map)# exit Router(config)# end Router# save SIDE-A.cfg % saving working-config % finished saving |
FITELnet-F1000-1の設定
! ip route 172.16.0.1 255.255.255.255 pppoe 1 ! vpn enable ewan 1 vpnlog enable ! ipsec access-list 10 ipsec ip 192.168.3.0 0.0.0.255 172.16.0.0 0.0.255.255 ipsec access-list 64 bypass ip any any ! hostname F1000-1 ! interface lan 1 ip address 192.168.3.1 255.255.255.0 exit interface pppoe 1 crypto map map1 pppoe server test pppoe account zyx@furukawa.co.jp zyx pppoe type host ip address 10.0.0.2 exit ! crypto isakmp policy 1 authentication prekey keepalive icmp always-send keepalive-icmp peer-address 172.16.0.1 keepalive-icmp source-interface lan 1 keepalive-icmp multi-path interface pppoe 1 key ascii furukawa peer-identity host kyoten1 exit crypto map map1 1 match address 10 set peer host kyoten1 sa-up route address 10.0.0.1 local-prot1 100 exit ! route-map AAA permit 1 set metric 6 set weight 0 exit ! router rip network lan 1 redistribute local-prot1 route-map AAA exit ! crypto security-association tunnel-route interface pppoe 1 exit ! end |
FITELnet-F1000-2の設定
! ip route 192.168.100.1 255.255.255.255 192.168.200.2 ip route 172.16.0.1 255.255.255.255 192.168.200.2 ! vpn enable vpnlog enable ! ipsec access-list 10 ipsec ip 192.168.3.0 0.0.0.255 172.16.0.0 0.0.255.255 ipsec access-list 64 bypass ip any any ! hostname F1000-2 ! interface ewan 1 crypto map map2 ip address 192.168.200.1 255.255.255.0 exit interface lan 1 ip address 192.168.3.20 255.255.255.0 exit ! crypto isakmp policy 1 authentication prekey keepalive icmp always-send keepalive-icmp peer-address 172.16.0.1 keepalive-icmp source-interface lan 1 keepalive-icmp multi-path address 192.168.200.2 key ascii furukawa peer-identity address 192.168.100.1 exit crypto map map2 1 match address 10 set peer address 192.168.100.1 sa-up route address 192.168.200.2 local-prot2 150 exit ! route-map AAA permit 1 set metric 10 set weight 0 exit ! router rip network lan 1 redistribute local-prot2 route-map AAA exit ! end |
