古河電工ネットワーク機器 [FITELnet]:FITELnet-Fシリーズ F220:設定例

古河電工ネットワーク機器の総合ブランド　ファイテルネット

設定例

IPsecで冗長する～イベントアクションで切り替え

内容

　下記リンクよりご確認ください。

1. センター側を機器および回線冗長の構成とする(貼り付け用コンフィグはこちら)
2. メインがPPPoEでバックアップがモバイル接続内蔵LTE(貼り付け用コンフィグはこちら)
3. センタ、拠点各1台でIPsec/PPPoE冗長　～イベントアクションでバックアップ側　　経路制御	センタ側の設定のご利用は
	拠点側の設定のご利用は
4. センタ、拠点各1台でLTE DualSIM 　～イベントアクションでSIM切り替え	センタ側の設定のご利用は
	拠点側の設定のご利用は
5. センタ側を機器および回線冗長　～VRRPプライオリティ減算で切り替え	センタ側メインの設定のご利用は
	センタ側バックアップの設定のご利用は
	拠点1の設定のご利用は
	拠点2の設定のご利用は
6. センタ側/拠点側を機器および回線冗長　～ポリシールーティング・ポリシーフラグ　　を使って負荷分散	センタ1系の設定のご利用は
	センタ2系の設定のご利用は
	拠点1系の設定のご利用は
	拠点2系の設定のご利用は

<pre>
access-list 100 permit udp 200.200.200.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 200.200.200.1 0.0.0.0 any
access-list 101 permit udp 100.100.100.1 0.0.0.0 eq 500 any eq 500
access-list 101 permit 50 100.100.100.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 100.100.100.1 255.255.255.255 tunnel 102
ip route 192.168.1.0 255.255.255.0 tunnel 1 50
ip route 192.168.1.0 255.255.255.0 tunnel 2 event-track event_track 10
ip route 200.200.200.1 255.255.255.255 tunnel 101
!
event-track event_track
!
survey 192.168.1.254 name survey survey-map survey_map source port-channel 11 nexthop tunnel 1
!
survey-map survey_map
 ttl 255
 hop-limit 255
 retry 3
 frequency every 10000
exit
!
event-action 1
 event survey survey down
 action 1.1 event-track event_track up
exit
!
event-action 2
 event survey survey up
 action 1.1 event-track event_track down
exit
!
crypto ipsec policy P2_POLICY_BACKUP
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set mtu 1454
 set mss 1300
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec policy P2_POLICY_MAIN
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set mtu 1454
 set mss 1300
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR_MAIN
 src 1 ipv4 192.168.2.0 255.255.255.0
 dst 1 ipv4 192.168.1.0 255.255.255.0
exit
!
crypto ipsec selector SELECTOR_BACKUP
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_1
 keepalive interval 10
 self-identity user-fqdn Kyoten_1@furukawa.co.jp
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY_MAIN
 set peer 200.200.200.1
 ike-version 1
 local-key secret
exit
!
crypto isakmp profile P1_PROFILE_2
 keepalive interval 10
 self-identity user-fqdn Kyoten_2@furukawa.co.jp
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY_BACKUP
 set peer 100.100.100.1
 ike-version 1
 local-key secret
exit
!
crypto map CryptoMap_1 ipsec-isakmp
 match address SELECTOR_MAIN
 set isakmp-profile P1_PROFILE_1
exit
!
crypto map CryptoMap_2 ipsec-isakmp
 match address SELECTOR_BACKUP
 set isakmp-profile P1_PROFILE_2
exit
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
exit
!
interface GigaEthernet 2/1
 vlan-id 21
 bridge-group 21
 pppoe enable
exit
!
interface GigaEthernet 3/1
 vlan-id 31
 bridge-group 31
 pppoe enable
exit
!
interface Port-channel 11
 ip address 192.168.2.254 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CryptoMap_2
exit
!
interface Tunnel 101
 tunnel mode pppoe profile PPPoE_MAIN
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 102
 tunnel mode pppoe profile PPPoE_BACKUP
 ip access-group 101 in
 ip access-group 111 in
 ip access-group 121 out
 pppoe interface gigaethernet 3/1
exit
!
pppoe profile PPPoE_BACKUP
 account user2@yyyy.ne.jp secret2
 ncp ipcp
exit
!
pppoe profile PPPoE_MAIN
 account user1@yyyy.ne.jp secret1
 ncp ipcp
exit
!
!
end
</pre>

<pre>
access-list 100 permit udp any eq 500 200.200.200.1 0.0.0.0 eq 500
access-list 100 permit 50 any 200.200.200.1 0.0.0.0
access-list 101 permit udp any eq 500 100.100.100.1 0.0.0.0 eq 500
access-list 101 permit 50 any 100.100.100.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any

ip route 192.168.2.0 255.255.255.0 tunnel 2 50
!
crypto ipsec policy P2_POLICY_BACKUP
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec policy P2_POLICY_MAIN
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
 sa-up route distance 1
exit
!
crypto ipsec selector SELECTOR_BACKUP
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto ipsec selector SELECTOR_MAIN_0001
 src 1 ipv4 192.168.1.0 255.255.255.0
 dst 1 ipv4 192.168.2.0 255.255.255.0
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_1
 match identity user Kyoten_1@furukawa.co.jp
 local-address 200.200.200.1
 keepalive interval 10
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY_MAIN
 ike-version 1
 local-key secret
 tunnel-route ip interface tunnel 101
exit
!
crypto isakmp profile P1_PROFILE_2
 match identity user Kyoten_2@furukawa.co.jp
 local-address 100.100.100.1
 keepalive interval 10
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY_BACKUP
 ike-version 1
 local-key secret
 tunnel-route ip interface tunnel 102
exit
!
crypto map CryptoMap_1 ipsec-isakmp
 match address SELECTOR_MAIN_0001
 set isakmp-profile P1_PROFILE_1
exit
!
crypto map CryptoMap_2 ipsec-isakmp
 match address SELECTOR_BACKUP
 set isakmp-profile P1_PROFILE_2
exit
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
exit
!
interface GigaEthernet 2/1
 vlan-id 21
 bridge-group 21
 pppoe enable
exit
!
interface GigaEthernet 3/1
 vlan-id 31
 bridge-group 31
 pppoe enable
exit
!
interface Port-channel 11
 ip address 192.168.1.254 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CryptoMap_2
exit
!
interface Tunnel 101
 ip address 200.200.200.1 255.255.255.0
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPoE_MAIN
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 102
 ip address 100.100.100.1 255.255.255.0
 ip access-group 101 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPoE_BACKUP
 pppoe interface gigaethernet 3/1
exit
!
pppoe profile PPPoE_BACKUP
 account user2@xxxx.ne.jp secret2
 ncp ipcp
exit
!
pppoe profile PPPoE_MAIN
 account user1@xxxx.ne.jp secret1
 ncp ipcp
exit
!
!
end
</pre>

<pre>
access-list 100 permit udp any 192.0.2.1 0.0.0.0 eq 500
access-list 100 permit udp any 192.0.2.1 0.0.0.0 eq 4500
access-list 100 permit 50 any 192.0.2.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
ip route 0.0.0.0 0.0.0.0 tunnel 2
ip route 192.168.1.0 255.255.255.0 tunnel 1
ip route 192.168.1.0 255.255.255.0 null 0 150
ip nat list 1 192.168.0.0 0.0.0.255
!
hardware-fault-detection action reboot
!
logging buffer level informational
!
hostname CENTER
!
crypto ipsec udp-encapsulation nat-t
!
crypto ipsec policy IPsec_POLICY
 set pfs group14
 set security-association lifetime seconds 1800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR1
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive interval 35
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy ISAKMP_POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 3600
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF1
 match identity host id-kyoten
 local-address 192.0.2.1
 self-identity address 192.0.2.1
 set isakmp-policy ISAKMP_POLICY
 set ipsec-policy IPsec_POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map MAP1 ipsec-isakmp
 match address SELECTOR1
 set isakmp-profile PROF1
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.0.1 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map MAP1
 link-state sync-sa
exit
!
interface Tunnel 2
 ip address 192.0.2.1 255.255.255.255
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
exit
!
pppoe profile PPPOE_PROF
 account user@xxxx.ne.jp secret
exit
!
!
end
</pre>

<pre>
access-list 100 permit udp any eq 67 any eq 68
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 4500 any eq 4500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any

ip route 0.0.0.0 0.0.0.0 dhcp port-channel 1
ip route 192.168.0.0 255.255.255.0 tunnel 1
ip route 192.168.0.0 255.255.255.0 null 0 150
ip nat list 1 192.168.1.0 0.0.0.255
!
monitor signal-quality logging lte-module interval 600
!
syslog filter LTE_LIMIT
 message Call count reached limit
exit
!
event-action 1
 event syslog filter LTE_LIMIT
 action 1.1 cli exec command crypto isakmp discard
 action 2.1 cli exec command clear crypto sa
 action 3.1 cli exec command lte-module disconnect moff
 action 4.1 cli exec command lte-module connect reverse moff
 action 5.1 cli exec command no crypto isakmp discard
exit
!
hardware-fault-detection action reboot
!
logging filter 1 LTE_LIMIT event-action
logging buffer level informational
!
!
hostname KYOTEN
!
crypto ipsec udp-encapsulation nat-t
!
crypto ipsec policy IPsec_POLICY
 set pfs group14
 set security-association always-up
 set security-association rekey always
 set security-association lifetime seconds 1800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR1
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive always-send interval 30
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy ISAKMP_POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 3600
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF1
 match identity address 192.0.2.1
 local-address source-interface port-channel 1
 self-identity fqdn id-kyoten
 set isakmp-policy ISAKMP_POLICY
 set ipsec-policy IPsec_POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map MAP1 ipsec-isakmp
 match address SELECTOR1
 set isakmp-profile PROF1
exit
!
interface GigaEthernet 1/1
 vlan-id 2
 bridge-group 2
 channel-group 2
exit
!
interface Port-channel 1
 ip dhcp service client
 ip nat inside source list 1 interface
exit
!
interface Port-channel 2
 ip address 192.168.1.1 255.255.255.0
exit
!
!
interface Tunnel 1
 tunnel mode ipsec map MAP1
 link-state sync-sa
exit
!
interface LTE-Module 1
 channel-group 1
 sim-profile 1 SIM1 default
 sim-profile 2 SIM2
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
exit
!
sim-profile SIM1
 account xxx123yyy@xxxxx.xx.jp XXX123
 pdp ipv4
 apn-name lte-ocn.ntt.com
 max-call 5
exit
!
sim-profile SIM2
 account xxx456yyy@xxxxx.xx.jp XXX456
 pdp ipv4
 apn-name lte-ocn.ntt.com
 max-call 5
exit
!
!
end
</pre>

<pre>
access-list 100 permit udp any eq 500 192.0.2.1 0.0.0.0 eq 500
access-list 100 permit 50 any 192.0.2.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 192.168.1.200
ip route 192.168.2.0 255.255.255.0 192.168.1.252 100
ip route 192.168.2.0 255.255.255.0 tunnel 2
ip route 192.168.3.0 255.255.255.0 192.168.1.252 100
ip route 192.168.3.0 255.255.255.0 tunnel 3
ip vrrp enable
!
track 10 ip host 192.0.2.1 reachability delay-up 30
!
hostname CENTER1
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
hardware-fault-detection action reboot
!
logging level informational
crypto isakmp keepalive
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp tunnel-route ip interface tunnel 1
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 match identity user id-kyoten1
 local-address 192.0.2.1
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto isakmp profile PROF0002
 match identity user id-kyoten2
 local-address 192.0.2.1
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map KYOTEN_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
crypto map KYOTEN_2 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0002
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.251 255.255.255.0
 mss 1300
 vrrp 1 address 192.168.1.254
 vrrp 1 priority 200
 vrrp 1 preempt
 vrrp 1 track 10 decrement 110
exit
!
interface Tunnel 1
 description FLETS
 ip address 192.0.2.1 255.255.255.255
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map KYOTEN_1
 link-state sync-sa
exit
!
interface Tunnel 3
 tunnel mode ipsec map KYOTEN_2
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc012@***.***.ne.jp xxxyyyzzz
exit
!
end
</pre>

<pre>
access-list 100 permit udp any eq 500 192.0.2.2 0.0.0.0 eq 500
access-list 100 permit 50 any 192.0.2.2 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 192.168.1.200
ip route 192.168.2.0 255.255.255.0 tunnel 2
ip route 192.168.3.0 255.255.255.0 tunnel 3
ip route 192.168.2.0 255.255.255.0 null 0 250
ip route 192.168.3.0 255.255.255.0 null 0 250
ip vrrp enable
!
hostname CENTER2
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
hardware-fault-detection action reboot
!
logging level informational
crypto isakmp keepalive
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp tunnel-route ip interface tunnel 1
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 match identity user id-kyoten1
 local-address 192.0.2.2
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto isakmp profile PROF0002
 match identity user id-kyoten2
 local-address 192.0.2.2
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map KYOTEN_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
crypto map KYOTEN_2 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0002
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.252 255.255.255.0
 mss 1300
 vrrp 1 address 192.168.1.254
 vrrp 1 priority 100
 vrrp 1 preempt
exit
!
interface Tunnel 1
 description FLETS
 ip address 192.0.2.2 255.255.255.255
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map KYOTEN_1
 link-state sync-sa
exit
!
interface Tunnel 3
 tunnel mode ipsec map KYOTEN_2
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc123@***.***.ne.jp yyyxxxzzz
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 100 permit udp 192.0.2.2 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.2 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 192.168.1.0 255.255.255.0 null 0 150
ip route 192.168.1.0 255.255.255.0 tunnel 2 survey name t2_ICMP
ip route 192.168.1.0 255.255.255.0 tunnel 3 100
ip nat list 1 192.168.2.0 0.0.0.255
!
survey 192.168.1.251 name t2_ICMP survey-map ICMP-Kanshi source port-channel 1 nexthop tunnel 2 interworking
!
survey-map ICMP-Kanshi
 retry 2 interval 10000
 frequency every 10000
 stability 2 interval 10000
exit
!
hostname KYOTEN1
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set mss 1300
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
hardware-fault-detection action reboot
!
logging level informational
crypto isakmp keepalive
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten1
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto isakmp profile PROF0002
 self-identity user-fqdn id-kyoten1
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.2
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
crypto map CENTER_BK ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0002
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.2.254 255.255.255.0
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
exit
!
interface Tunnel 3
 tunnel mode ipsec map CENTER_BK
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 100 permit udp 192.0.2.2 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.2 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 192.168.1.0 255.255.255.0 null 0 150
ip route 192.168.1.0 255.255.255.0 tunnel 2 survey name t2_ICMP
ip route 192.168.1.0 255.255.255.0 tunnel 3 100
ip nat list 1 192.168.3.0 0.0.0.255
!
survey 192.168.1.251 name t2_ICMP survey-map ICMP-Kanshi source port-channel 1 nexthop tunnel 2 interworking
!
survey-map ICMP-Kanshi
 retry 2 interval 10000
 frequency every 10000
 stability 2 interval 10000
exit
!
hostname KYOTEN2
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set mss 1300
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
hardware-fault-detection action reboot
!
logging level informational
crypto isakmp keepalive
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten2
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto isakmp profile PROF0002
 self-identity user-fqdn id-kyoten2
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.2
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
crypto map CENTER_BK ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0002
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.3.254 255.255.255.0
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
exit
!
interface Tunnel 3
 tunnel mode ipsec map CENTER_BK
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc678@***.***.ne.jp yyyzzzxxx
exit
!
end
</pre>

<pre>
access-list 100 permit ip 192.168.0.2 0.0.0.0 any
access-list 110 permit udp any eq 500 10.0.0.1 0.0.0.0 eq 500
access-list 110 permit 50 any 10.0.0.1 0.0.0.0
access-list 111 deny ip any any
!
ip route 100.0.0.1 255.255.255.255 10.0.0.254
ip route 192.168.1.0 255.255.255.0 192.168.0.253 50
ip route 192.168.1.0 255.255.255.0 tunnel 1 survey name main_point 10
ip route 192.168.1.253 255.255.255.255 192.168.0.253
ip route 192.168.1.253 255.255.255.255 null 0 200
ip vrrp enable
!
survey 192.168.1.252 name main_point survey-map survey_map source port-channel 1 nexthop tunnel 1
!
survey-map survey_map
 ttl 255
 retry 3
 frequency every 10000
exit
!
crypto ipsec policy P2_POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_0001
 match identity user Kyoten_A@furukawa.co.jp
 local-address 10.0.0.1
 keepalive interval 10
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY
 ike-version 1
 local-key secret
exit
!
crypto map CryptoMap_0001 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile P1_PROFILE_0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PBR
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 110 in
 ip access-group 111 in
exit
!
interface Port-channel 1
 ip address 192.168.0.252 255.255.255.0
 vrrp 1 address 192.168.0.254
 vrrp 1 priority 100
 vrrp 1 adver-interval 10
 vrrp 1 preempt
exit
!
interface Port-channel 2
 ip address 10.0.0.1 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_0001
exit
!
class-map Backup
 match ip access-group 100
exit
!
policy-route-map PBR
 !
 class Backup
  count
  action nexthop 192.168.0.253
  watch 192.168.1.253 source port-channel 1 survey-map survey_map
 exit
 !
exit
!
end
</pre>

<pre>
access-list 110 permit udp any eq 500 20.0.0.1 0.0.0.0 eq 500
access-list 110 permit 50 any 20.0.0.1 0.0.0.0
access-list 111 deny ip any any
!
ip route 200.0.0.1 255.255.255.255 20.0.0.254
ip route 192.168.1.0 255.255.255.0 tunnel 1
ip vrrp enable
!
crypto ipsec policy P2_POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_0001
 match identity user Kyoten_B@furukawa.co.jp
 local-address 20.0.0.1
 keepalive interval 10
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY
 ike-version 1
 local-key secret
exit
!
crypto map CryptoMap_0001 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile P1_PROFILE_0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 110 in
 ip access-group 111 in
exit
!
interface Port-channel 1
 ip address 192.168.0.253 255.255.255.0
 vrrp 1 address 192.168.0.254
 vrrp 1 priority 50
 vrrp 1 adver-interval 10
 vrrp 1 preempt
exit
!
interface Port-channel 2
 ip address 20.0.0.1 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_0001
exit
!
end
</pre>

<pre>
access-list 100 permit ip any 192.168.0.2 0.0.0.0
access-list 110 permit udp 10.0.0.1 0.0.0.0 eq 500 any eq 500
access-list 110 permit 50 10.0.0.1 0.0.0.0 any
access-list 111 deny ip any any
!
ip route 10.0.0.1 255.255.255.255 100.0.0.254
ip route 192.168.0.0 255.255.255.0 192.168.1.253 50
ip route 192.168.0.0 255.255.255.0 tunnel 1 survey name main_point 10
ip vrrp enable
!
survey 192.168.0.252 name main_point survey-map survey_map source port-channel 1 nexthop tunnel 1
survey 192.168.0.253 name backup_point survey-map survey_map source port-channel 1 nexthop 192.168.1.253
!
survey-map survey_map
 ttl 255
 retry 3
 frequency every 10000
exit
!
event-action 1
 event survey backup_point down
 action 1.1 cli exec command policy-flag 1 unset
 action 1.2 syslog message EVENT-ACTION NO1 IS FINISH.
exit
!
event-action 2
 event survey backup_point up
 action 1.1 cli exec command policy-flag 1 set
 action 1.2 syslog message EVENT-ACTION NO2 IS FINISH.
exit
!
crypto ipsec policy P2_POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_1
 local-address 100.0.0.1
 keepalive interval 10
 self-identity user-fqdn Kyoten_A@furukawa.co.jp
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY
 set peer 10.0.0.1
 ike-version 1
 local-key secret
exit
!
crypto map CryptoMap_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile P1_PROFILE_1
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PBR
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 110 in
 ip access-group 111 in
exit
!
interface Port-channel 1
 ip address 192.168.1.252 255.255.255.0
 vrrp 1 address 192.168.1.254
 vrrp 1 priority 100
 vrrp 1 adver-interval 10
 vrrp 1 preempt
exit
!
interface Port-channel 2
 ip address 100.0.0.1 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_1
exit
!
class-map Backup
 match ip access-group 100
 match policy-flag 1 set
exit
!
policy-route-map PBR
 !
 class Backup
  count
  action nexthop 192.168.1.253
 exit
 !
exit
!
end
</pre>

<pre>
access-list 110 permit udp 20.0.0.1 0.0.0.0 eq 500 any eq 500
access-list 110 permit 50 20.0.0.1 0.0.0.0 any
access-list 111 deny ip any any
!
ip route 20.0.0.1 255.255.255.255 200.0.0.254
ip route 192.168.0.0 255.255.255.0 tunnel 1
ip vrrp enable
!
crypto ipsec policy P2_POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha256-hmac
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile P1_PROFILE_1
 local-address 200.0.0.1
 keepalive interval 10
 self-identity user-fqdn Kyoten_B@furukawa.co.jp
 set isakmp-policy P1-POLICY
 set ipsec-policy P2_POLICY
 set peer 20.0.0.1
 ike-version 1
 local-key secret
exit
!
crypto map CryptoMap_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile P1_PROFILE_1
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 110 in
 ip access-group 111 in
exit
!
interface Port-channel 1
 ip address 192.168.1.253 255.255.255.0
 vrrp 1 address 192.168.1.254
 vrrp 1 priority 50
 vrrp 1 adver-interval 10
 vrrp 1 preempt
exit
!
interface Port-channel 2
 ip address 200.0.0.1 255.255.255.0
exit
!
interface Tunnel 1
 tunnel mode ipsec map CryptoMap_1
exit
!
!
end
</pre>

ページトップへ

サイトマップ古河電工HOME l 古河電工サーバのご利用にあたっての注意