ip route 0.0.0.0 0.0.0.0 pppoe 1 ip route 192.168.2.0 255.255.255.0 connected ipsecif 1 access-list 99 permit 192.168.1.0 0.0.0.255 proxydns mode v4 vpn enable vpnlog enable ipsec access-list 1 ipsec ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 ipsec access-list 64 bypass ip any any ipsec transform-set aes256-sha esp-aes-256 esp-sha-hmac service dhcp-server hostname Router_A ip dhcp pool lan 1 dns-server 0.0.0.0 default-router 0.0.0.0 exit interface ipsecif 1 crypto map Router_B exit interface lan 1 ip address 192.168.1.1 255.255.255.0 exit interface pppoe 1 ip address 192.0.2.1 ip nat inside source list 99 interface pppoe server test1 pppoe account ********@***.***.ne.jp ****** pppoe type host exit crypto isakmp policy 1 authentication prekey encryption aes 256 group 5 hash sha key ascii secret1 negotiation-mode aggressive peer-identity host Router_B exit crypto map Router_B 1 match address 1 set peer host Router_B set pfs group5 set transform-set aes256-sha exit end
ip route 0.0.0.0 0.0.0.0 pppoe 1 ip route 192.168.1.0 255.255.255.0 connected ipsecif 1 access-list 99 permit 192.168.2.0 0.0.0.255 proxydns mode v4 vpn enable vpnlog enable ipsec access-list 1 ipsec ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 ipsec access-list 64 bypass ip any any ipsec transform-set aes256-sha esp-aes-256 esp-sha-hmac service dhcp-server hostname Router_B ip dhcp pool lan 1 dns-server 0.0.0.0 default-router 0.0.0.0 exit interface ipsecif 1 crypto map Router_A exit interface lan 1 ip address 192.168.2.1 255.255.255.0 exit interface pppoe 1 ip nat inside source list 99 interface pppoe server test1 pppoe account ********@***.***.ne.jp ****** pppoe type host exit crypto isakmp policy 1 authentication prekey encryption aes 256 group 5 hash sha key ascii secret1 my-identity Router_B negotiation-mode aggressive peer-identity address 192.0.2.1 exit crypto map Router_A 1 match address 1 set peer address 192.0.2.1 set pfs group5 set security-association always-up set transform-set aes256-sha exit end
設定内容 | 画面表示例 |
---|---|
特権ユーザモードへの移行 パスワードの入力 設定情報の初期化 設定モードの変更 設定入力 設定保存 装置再起動 |
Router>enable Enter password: Router# Router#clear working.cfg Router# Router#configure terminal Router(config)#ip route 0.0.0.0 0.0.0.0 pppoe 1 Router(config)#ip route 192.168.2.0 255.255.255.0 connected ipsecif 1 Router(config)#access-list 99 permit 192.168.1.0 0.0.0.255 Router(config)#proxydns mode v4 Router(config)#vpn enable Router(config)#vpnlog enable Router(config)#ipsec access-list 1 ipsec ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 Router(config)#ipsec access-list 64 bypass ip any any Router(config)#ipsec transform-set aes256-sha esp-aes-256 esp-sha-hmac Router(config)#service dhcp-server Router(config)#hostname Router_A Router_A(config)#ip dhcp pool lan 1 Router_A(config-dhcp-pool)# dns-server 0.0.0.0 Router_A(config-dhcp-pool)# default-router 0.0.0.0 Router_A(config-dhcp-pool)#exit Router_A(config)#interface ipsecif 1 Router_A(config-if ipsecif 1)# crypto map Router_B Router_A(config-if ipsecif 1)#exit Router_A(config)#interface lan 1 Router_A(config-if lan 1)# ip address 192.168.1.1 255.255.255.0 Router_A(config-if lan 1)#exit Router_A(config)#interface pppoe 1 Router_A(config-if pppoe 1)# ip address 192.0.2.1 Router_A(config-if pppoe 1)# ip nat inside source list 99 interface Router_A(config-if pppoe 1)# pppoe server test1 Router_A(config-if pppoe 1)# pppoe account *******@***.***.ne.jp ****** Router_A(config-if pppoe 1)# pppoe type host Router_A(config-if pppoe 1)#exit Router_A(config)#crypto isakmp policy 1 Router_A(config-isakmp)# authentication prekey Router_A(config-isakmp)# encryption aes 256 Router_A(config-isakmp)# group 5 Router_A(config-isakmp)# hash sha Router_A(config-isakmp)# key ascii secret1 Router_A(config-isakmp)# negotiation-mode aggressive Router_A(config-isakmp)# peer-identity host Router_B Router_A(config-isakmp)#exit Router_A(config)#crypto map Router_B 1 Router_A(config-crypto-map)# match address 1 Router_A(config-crypto-map)# set peer host Router_B Router_A(config-crypto-map)# set pfs group5 Router_A(config-crypto-map)# set transform-set aes256-sha Router_A(config-crypto-map)#exit Router_A(config)# Router_A(config)#end Router_A# Router_A#save SIDE-A % saving working-config % finished saving Router_A#reset Going to reset with SIDE-A.frm and SIDE-A.cfg. Boot-back not scheduled for next boot. Next rebooting firmware SIDE-A.frm is fine. Are you OK to cold start?(y/n)y |
設定内容 | 画面表示例 |
---|---|
特権ユーザモードへの移行 パスワードの入力 設定情報の初期化 設定モードの変更 設定入力 ※ 設定保存 装置再起動 |
Router>enable Enter password: Router# Router#clear working.cfg Router# Router#configure terminal Router(config)#ip route 0.0.0.0 0.0.0.0 pppoe 1 Router(config)#ip route 192.168.1.0 255.255.255.0 connected ipsecif 1 Router(config)#access-list 99 permit 192.168.2.0 0.0.0.255 Router(config)#proxydns mode v4 Router(config)#vpn enable Router(config)#vpnlog enable Router(config)#ipsec access-list 1 ipsec ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 Router(config)#ipsec access-list 64 bypass ip any any Router(config)#ipsec transform-set aes256-sha esp-aes-256 esp-sha-hmac Router(config)#service dhcp-server Router(config)#hostname Router_B Router_B(config)#ip dhcp pool lan 1 Router_B(config-dhcp-pool)# dns-server 0.0.0.0 Router_B(config-dhcp-pool)# default-router 0.0.0.0 Router_B(config-dhcp-pool)#exit Router_B(config)#interface ipsecif 1 Router_B(config-if ipsecif 1)# crypto map Router_A Router_B(config-if ipsecif 1)#exit Router_B(config)#interface lan 1 Router_B(config-if lan 1)# ip address 192.168.2.1 255.255.255.0 Router_B(config-if lan 1)#exit Router_B(config)#interface pppoe 1 Router_B(config-if pppoe 1)# ip address 192.0.2.129 Router_B(config-if pppoe 1)# ip nat inside source list 99 interface Router_B(config-if pppoe 1)# pppoe server test1 Router_B(config-if pppoe 1)# pppoe account ********@***.***.ne.jp ****** Router_B(config-if pppoe 1)# pppoe type host Router_B(config-if pppoe 1)#exit Router_B(config)#crypto isakmp policy 1 Router_B(config-isakmp)# authentication prekey Router_B(config-isakmp)# encryption aes 256 Router_B(config-isakmp)# group 5 Router_B(config-isakmp)# hash sha Router_B(config-isakmp)# key ascii secret1 Router_B(config-isakmp)# my-identity Router_B Router_B(config-isakmp)# negotiation-mode aggressive Router_B(config-isakmp)# peer-identity address 192.0.2.1 Router_B(config-isakmp)#exit Router_B(config)#crypto map Router_A 1 Router_B(config-crypto-map)# match address 1 Router_B(config-crypto-map)# set peer address 192.0.2.1 Router_B(config-crypto-map)# set pfs group5 Router_B(config-crypto-map)# set security-association always-up Router_B(config-crypto-map)# set transform-set aes256-sha Router_B(config-crypto-map)#exit Router_B(config)# Router_B(config)#end Router_B# Router_B#save SIDE-A % saving working-config % finished saving Router_B#reset Going to reset with SIDE-A.frm and SIDE-A.cfg. Boot-back not scheduled for next boot. Next rebooting firmware SIDE-A.frm is fine. Are you OK to cold start?(y/n)y |
※:SAの確立に合わせてIPsecインターフェースやIPsec経路が動的にアップダウンします。
Router AのPhase1 SAの情報を確認します。
確認内容 | 画面表示例 |
---|---|
Phase1 SA の情報を表示 ※ |
Router_A#show crypto isakmp sa ISAKMP SA current sa : 1 [ 1] 192.0.2.129 Router_B <--> 192.0.2.1 <R>Aggressive Mode UP pre-shared key AES(256bits) SHA Lifetime : 1000secs Current : 15secs,1kbytes mcfg config-mode: off mcfg addr: off mcfg apl-version: IKE Keepalive: dpd ICMP Keepalive: off release on addr-change: off |
※:Router A←→Router B間でPhase1 SAが確立されていることを確認してください。
Router BのPhase1 SAの情報を確認します。
確認内容 | 画面表示例 |
---|---|
Phase1 SA の情報を表示 ※ |
Router_B#show crypto isakmp sa ISAKMP SA current sa : 1 [ 1] 192.0.2.1 <--> 192.0.2.129 Router_B <I> Aggressive Mode UP pre-shared key AES(256bits) SHA Lifetime : 1000secs Current : 33secs,1kbytes mcfg config-mode: off mcfg addr: off mcfg apl-version: IKE Keepalive: dpd ICMP Keepalive: off release on addr-change: off |
※:Router A←→Router B間でPhase1 SAが確立されていることを確認してください。
Router AのPhase2 SAの情報を確認します。
確認内容 | 画面表示例 |
---|---|
Phase2 SA の情報を表示 ※ |
Router_A#show crypto ipsec sa IPSEC SA current insa : 1 current outsa : 1 [ 1] 192.168.2.0,255.255.255.0 ALL ALL <--> 192.168.1.0,255.255.255.0 ALL ALL peer: 192.0.2.129 Router_B <R> UP ESP AES(256bits) HMAC-SHA PFS:on(group5) Lifetime: 600secs Anti-Replay: Enable O-SPI: 0x23ee5604 Current: 17secs,0kbytes out packet : 0 error packet : 0 I-SPI: 0x3112d8cb Current: 17secs,0kbytes in packet : 0 auth packet : 0 decrypt packet : 0 discard packet : 0 replay packet : 0 auth error packet : 0 |
※:Router A←→Router B間でPhase2 SAが確立されていることを確認してください。
Router BのPhase2 SAの情報を確認します。
確認内容 | 画面表示例 |
---|---|
Phase2 SA の情報を表示 ※ |
Router_B#show crypto ipsec sa IPSEC SA current insa : 1 current outsa : 1 [ 1] 192.168.1.0,255.255.255.0 ALL ALL <--> 192.168.2.0,255.255.255.0 ALL ALL peer: 192.0.2.1 <I> UP ESP AES(256bits) HMAC-SHA PFS:on(group5) Lifetime: 600secs Anti-Replay: Enable O-SPI: 0x3112d8cb Current: 36secs,0kbytes out packet : 0 error packet : 0 I-SPI: 0x23ee5604 Current: 36secs,0kbytes in packet : 0 auth packet : 0 decrypt packet : 0 discard packet : 0 replay packet : 0 auth error packet : 0 |
※:Router A←→Router B間でPhase2 SAが確立されていることを確認してください。
Router AのVPNログ情報を確認します。
確認内容 | 画面表示例 |
---|---|
ログ情報の表示 vpn enable 状態 isakmp 確立状態 ipsec 確立状態 |
Router_A#show vpnlog 0000 0000:00:00.00 2012/02/16 (thu) 14:51:28 0 00000000 4f34ce80 #BOOT[V01.06(02)a1-021512] SIDE-A.frm SIDE-A.cfg 0001 0000:00:02.01 2012/02/16 (thu) 14:51:32 16 10000002 00000000 vpn enabled. 0002 0000:00:23.93 2012/02/16 (thu) 14:51:54 16 10000320 00000000 IKE SA<R> 1/- 192.0.2.129 0003 0000:00:23.93 2012/02/16 (thu) 14:51:54 16 10000320 00000000 30f9b0e745000000 e171a306bf000000 Router_B 0004 0000:00:23.93 2012/02/16 (thu) 14:51:54 16 100003a7 00000000 Recv INIT IKE SA 1/- 192.0.2.129 0005 0000:00:23.93 2012/02/16 (thu) 14:51:54 16 100003a7 00000000 30f9b0e745000000 e171a306bf000000 Router_B 0006 0000:00:23.94 2012/02/16 (thu) 14:51:54 16 10000220 00000000 IPSEC SA<R> 1/1 192.0.2.129 0007 0000:00:23.94 2012/02/16 (thu) 14:51:54 16 10000220 00000000 23ee5604 3112d8cb |
Router BのVPNログ情報を確認します。
確認内容 | 画面表示例 |
---|---|
ログ情報の表示 vpn enable 状態 isakmp 確立状態 ipsec 確立状態 |
Router_B#show vpnlog 0000 0000:00:00.00 2012/02/16 (thu) 14:52:28 0 00000000 4f34ce80 #BOOT[V01.06(02)a1-021512] SIDE-A.frm SIDE-A.cfg 0001 0000:00:02.19 2012/02/16 (thu) 14:52:33 16 10000002 00000000 vpn enabled. 0002 0000:00:27.78 2012/02/16 (thu) 14:52:58 16 10000320 00000000 IKE SA<I> 1/- 192.0.2.1 0003 0000:00:27.78 2012/02/16 (thu) 14:52:58 16 10000320 00000000 30f9b0e745000000 e171a306bf000000 0004 0000:00:27.78 2012/02/16 (thu) 14:52:58 16 100003a7 00000000 Recv INIT IKE SA 1/- 192.0.2.1 0005 0000:00:27.78 2012/02/16 (thu) 14:52:58 16 100003a7 00000000 30f9b0e745000000 e171a306bf000000 0006 0000:00:27.80 2012/02/16 (thu) 14:52:58 16 10000220 00000000 IPSEC SA<I> 1/1 192.0.2.1 0007 0000:00:27.80 2012/02/16 (thu) 14:52:58 16 10000220 00000000 3112d8cb 23ee5604 |
平文対象のデータ通信にてNAT変換されることを確認します。
例:Router_Aより ping 192.0.2.129 source-interface lan 1を実施します。
確認内容 | 画面表示例 |
---|---|
ping を実行する ping 応答あり |
Router_A#ping 192.0.2.129 source-interface lan 1 Sending 5, 100-byte ICMP Echos to 192.0.2.129, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 0/2/10 ms |
Router AのNAT変換テーブルの情報を確認します。
確認内容 | 画面表示例 |
---|---|
NATテーブル情報を表示 ※ |
Router_A#show ip nat translation Session summary (equipment total): Max sessions: 2048 Reserved sessions: 0 Active sessions: 2 Peak: 2 List of active sessions: PPPoE1 Local(address port) Global(address port) Remote(address port) prot tm(s) -------------------+--------------------+--------------------+----+----- 192.168.1.1 8433 192.0.2.1 8433 192.0.2.129 8433 icmp 56 192.0.2.1 500 192.0.2.1 500 192.0.2.129 500 udp 236 |
※:プライベートネットワーク192.168.1.0/24のアドレスからip nat inside sourceで指定した PPPoE1インタフェースの固定アドレス192.0.2.1に変換した場合のNAT変換テーブルを確認してください。
Router Aのルーティング情報を確認します。
確認内容 | 画面表示例 |
---|---|
ルーティング情報を表示 ※ |
Router_A#show ip route Max entry: 10000 (Commonness in IPv4 and IPv6) Active entry:5 (IPv4), 2 (IPv6) Peak:5 Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF B - BGP, I - IKE, U - SA-UP, D - REDUNDANCY, E - EventAction A - AutoConfig, > - selected route, * - FIB route, p - stale info. S> * 0.0.0.0/0 [1/0] is directly connected, PPPoE1 C> * 127.0.0.0/8 is directly connected, LOOP0 C> * 192.0.2.11/32 is directly connected, PPPoE1 C> * 192.168.1.0/24 is directly connected, LAN S> * 192.168.2.0/24 [0/0] is directly connected, IPSECIF1 |
※:IPSECIF1の経路が確立されていることを確認してください。
Router Bのルーティング情報を確認します。
確認内容 | 画面表示例 |
---|---|
ルーティング情報を表示 ※ |
Router_B#show ip route Max entry: 10000 (Commonness in IPv4 and IPv6) Active entry:5 (IPv4), 2 (IPv6) Peak:5 Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF B - BGP, I - IKE, U - SA-UP, D - REDUNDANCY, E - EventAction A - AutoConfig, > - selected route, * - FIB route, p - stale info. S> * 0.0.0.0/0 [1/0] is directly connected, PPPoE1 C> * 127.0.0.0/8 is directly connected, LOOP0 C> * 192.0.2.139/32 is directly connected, PPPoE1 S> * 192.168.1.0/24 [0/0] is directly connected, IPSECIF1 C> * 192.168.2.0/24 is directly connected, LAN |
※:IPSECIF1の経路が確立されていることを確認してください。