IPsecの設定｜設定例｜ルータ・ネットワーク機器

	対象装置	設定例（txt）
IKEv1メインモードで接続する（拠点のアドレス固定）	F70/F71/F220/F221/F220 EX/F221 EX
IKEv1メインモードで接続する（拠点のアドレス固定）	F2500
IKEv1アグレッシブモードで接続する（拠点のアドレス不定）	F70/F71/F220/F221/F220 EX/F221 EX
IKEv1アグレッシブモードで接続する（拠点のアドレス不定）	F2500
IKEv1アグレッシブモードで接続する（拠点のアドレス不定、nat-traversal利用）	F70/F71/F220/F221/F220 EX/F221 EX
IKEv1アグレッシブモードで接続する（拠点のアドレス不定、nat-traversal利用）	F2500
IKEv1で電子証明書を使って認証する	F70/F71/F220/F221/F220 EX/F221 EX
IKEv1で電子証明書を使って認証する	F2500
IKEv2で接続する（センタ(IP固定)、拠点(IP固定)、VPNピア識別：アドレス形式）	F70/F71/F220/F221/F220 EX/F221 EX
IKEv2で接続する（センタ(IP固定)、拠点(IP不定)、VPNピア識別：FQDN形式）	F70/F71/F220/F221/F220 EX/F221 EX
VPN-NATを行う（拠点間のアドレスが重なっている場合）	F70/F71/F220/F221/F220 EX/F221 EX
IPsec通信を使用したマルチキャストルーティングを行う	F70/F71/F220/F221/F220 EX/F221 EX
証明書登録手順	F70/F71/F220/F221/F220 EX/F221 EX/F2500
F60/F200ルートベース - F70/F220ルートベース	F70/F71/F220/F221/F220 EX/F221 EX
F60/F200ポリシーベース - F70/F220ルートベース	F70/F71/F220/F221/F220 EX/F221 EX
EtherIP over IPsecで接続する：vlan-id anyを使用	F70/F71/F220/F221/F220 EX/F221 EX
L2TPv3 over IPsecで接続する	F70/F71/F220/F221/F220 EX/F221 EX
L2TPv3 over IPsecで接続する	F2500
L2TP/IPsecでVPNクライアント端末からリモートアクセスを行う	F70/F71/F220/F221/F220 EX/F221 EX
IKEv2でVPNクライアント端末からリモートアクセスを行う	F70/F71/F220/F221/F220 EX/F221 EX/F2500
IPv6の通信をIPv4でトンネリングする	F2500
マルチポイントSAによる拠点間通信を利用する	F70/F71/F220/F221/F220 EX/F221 EX
IPoE各社サービス（固定IP）でL2TP/IPsec,L2TPv3/IPsecを利用する	F70/F71/F220/F221/F220 EX/F221 EX

<pre>
ip route 0.0.0.0 0.0.0.0 pppoe 1
ip route 192.168.1.0 255.255.255.0 connected ipsecif 1
ip route 192.168.1.0 255.255.255.0 connected null 0 150
!
access-list 99 permit 192.168.0.0 0.0.0.255
!
vpn enable
vpnlog enable
!
ipsec access-list 1 ipsec ip any any
ipsec access-list 64 bypass ip any any
ipsec transform-set P2-POLICY esp-aes-256 esp-sha-hmac
!
interface ipsecif 1
crypto map CENTER
exit
interface lan 1
ip address 192.168.0.254 255.255.255.0
exit
interface pppoe 1
ip nat inside source list 99 interface
pppoe server FLETS-ADSL
pppoe account abc345@***.***.ne.jp zzzyyyxxx
pppoe type host
exit
!
crypto isakmp policy 1
authentication prekey
encryption aes 256
group 14
hash sha
idtype-pre userfqdn
key ascii SECRET-VPN
lifetime 86400
my-identity id-kyoten
negotiation-mode aggressive
peer-identity address 192.0.2.1
exit
crypto map CENTER 1
match address 1
set peer address 192.0.2.1
set pfs group14
set security-association lifetime seconds 28800
set security-association always-up
set transform-set P2-POLICY
exit
!
end
</pre>

crypto ipsec policy P2-POLICY
set pfs group14
set security-association always-up
set security-association lifetime seconds 28800
set security-association transform-keysize aes 256 256 256
set security-association transform esp-aes esp-sha-hmac
set mtu 1454
set ip df-bit 0
set ip fragment post
exit
!
crypto ipsec selector SELECTOR
src 1 ipv4 any
dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLICY
authentication pre-share
encryption aes
encryption-keysize aes 256 256 256
group 14
lifetime 86400
hash sha
initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
self-identity user-fqdn id-kyoten
set peer 192.0.2.1
set isakmp-policy P1-POLICY
set ipsec-policy P2-POLICY
ike-version 1
local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
match address SELECTOR
set isakmp-profile PROF0001
exit
!
vlan any 10 20
!
interface GigaEthernet 1/1
vlan-id any
bridge-group 1
exit
!
interface GigaEthernet 1/2
vlan-id any
bridge-group 1
exit
!
interface GigaEthernet 2/1
vlan-id 2
bridge-group 2
pppoe enable
exit
!
interface Loopback 1
ip address 10.0.0.2
exit
!
interface Tunnel 1
description FLETS
ip access-group 100 in
ip access-group 111 in
ip access-group 121 out
tunnel mode pppoe profile PPPOE_PROF
pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
tunnel mode ipsec map CENTER
exit
!
interface Tunnel 3
tunnel mode ether-ip tunnel-profile etherip-prof
bridge-group 1
exit
!
ether-ip tunnel-profile etherip-prof
tunnel source 10.0.0.2
tunnel destination 10.0.0.1
exit
!
pppoe profile PPPOE_PROF
account abc345@***.***.ne.jp zzzyyyxxx
exit
!
end
</pre>

<pre>
access-list 100 permit udp any eq 500 192.0.2.1 0.0.0.0 eq 500
access-list 100 permit 50 any 192.0.2.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 10.0.0.2 255.255.255.255 tunnel 2
ip route 10.0.0.3 255.255.255.255 tunnel 3
!
hostname CENTER
!
crypto ipsec policy P2-POLICY
set pfs group14
set security-association lifetime seconds 28800
set security-association transform-keysize aes 256 256 256
set security-association transform esp-aes esp-sha-hmac
set mtu 1454
set ip df-bit 0
set ip fragment post
exit
!
crypto ipsec selector SELECTOR
src 1 ipv4 any
dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
l2tpv3 log session
!
crypto isakmp policy P1-POLICY
authentication pre-share
encryption aes
encryption-keysize aes 256 256 256
group 14
lifetime 86400
hash sha
initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
match identity user id-kyoten1
local-address 192.0.2.1
set isakmp-policy P1-POLICY
set ipsec-policy P2-POLICY
ike-version 1
local-key SECRET-VPN
exit
!
crypto isakmp profile PROF0002
match identity user id-kyoten2
local-address 192.0.2.1
set isakmp-policy P1-POLICY
set ipsec-policy P2-POLICY
ike-version 1
local-key SECRET-VPN
exit
!
crypto map KYOTEN1 ipsec-isakmp
match address SELECTOR
set isakmp-profile PROF0001
exit
!
crypto map KYOTEN2 ipsec-isakmp
match address SELECTOR
set isakmp-profile PROF0002
exit
!
interface GigaEthernet 1/1
vlan-id 1
bridge-group 1
exit
!
interface GigaEthernet 2/1
vlan-id 2
bridge-group 2
pppoe enable
exit
!
interface Loopback 1
ip address 10.0.0.1
exit
!
interface Tunnel 1
description FLETS
ip address 192.0.2.1 255.255.255.255
ip access-group 100 in
ip access-group 111 in
ip access-group 121 out
tunnel mode pppoe profile PPPOE_PROF
pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
tunnel mode ipsec map KYOTEN1
exit
!
interface Tunnel 3
tunnel mode ipsec map KYOTEN2
exit
!
interface Tunnel 4
tunnel mode l2tpv3 pseudowire L2TPv3_kyoten1
bridge-group 1 client
exit
interface Tunnel 5
tunnel mode l2tpv3 pseudowire L2TPv3_kyoten2
bridge-group 1 client
exit
!
l2tpv3 tunnel-profile L2TPv3_PROF_kyoten1
mode l2tpv3
tunnel source 10.0.0.1
tunnel destination 10.0.0.2
tunnel protection ipsec tunnel 2
hostname local CENTER
hostname remote KYOTEN1
hello interval 10
exit
!
l2tpv3 tunnel-profile L2TPv3_PROF_kyoten2
mode l2tpv3
tunnel source 10.0.0.1
tunnel destination 10.0.0.3
tunnel protection ipsec tunnel 3
hostname local CENTER
hostname remote KYOTEN2
hello interval 10
exit
!
l2tpv3 pseudowire L2TPv3_kyoten1
set profile L2TPv3_PROF_kyoten1
remote-end-id ascii ID_center_kyoten1
exit
!
l2tpv3 pseudowire L2TPv3_kyoten2
set profile L2TPv3_PROF_kyoten2
remote-end-id ascii ID_center_kyoten2
exit
!
pppoe profile PPPOE_PROF
account abc012@***.***.ne.jp xxxyyyzzz
exit
!
end

</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 10.0.0.1 255.255.255.255 tunnel 2
!
hostname KYOTEN1
!
crypto ipsec policy P2-POLICY
set pfs group14
set security-association always-up
set security-association lifetime seconds 28800
set security-association transform-keysize aes 256 256 256
set security-association transform esp-aes esp-sha-hmac
set mtu 1454
set ip df-bit 0
set ip fragment post
exit
!
crypto ipsec selector SELECTOR
src 1 ipv4 any
dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
l2tpv3 log session
!
crypto isakmp policy P1-POLICY
authentication pre-share
encryption aes
encryption-keysize aes 256 256 256
group 14
lifetime 86400
hash sha
initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
self-identity user-fqdn id-kyoten1
set peer 192.0.2.1
set isakmp-policy P1-POLICY
set ipsec-policy P2-POLICY
ike-version 1
local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
match address SELECTOR
set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
vlan-id 1
bridge-group 1
exit
!
interface GigaEthernet 2/1
vlan-id 2
bridge-group 2
pppoe enable
exit
!
interface Loopback 1
ip address 10.0.0.2
exit
!
interface Tunnel 1
description FLETS
ip access-group 100 in
ip access-group 111 in
ip access-group 121 out
tunnel mode pppoe profile PPPOE_PROF
pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
tunnel mode ipsec map CENTER
exit
!
interface Tunnel 3
tunnel mode l2tpv3 pseudowire L2TPv3_center
bridge-group 1
exit
!
l2tpv3 tunnel-profile L2TPv3_PROF_center
mode l2tpv3
tunnel source 10.0.0.2
tunnel destination 10.0.0.1
tunnel protection ipsec tunnel 2
hostname local KYOTEN1
hostname remote CENTER
hello interval 10
exit
!
l2tpv3 pseudowire L2TPv3_center
set profile L2TPv3_PROF_center
remote-end-id ascii ID_center_kyoten1
always-up
exit

pppoe profile PPPOE_PROF
account abc345@***.***.ne.jp zzzyyyxxx
exit
!
end

</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 10.0.0.1 255.255.255.255 tunnel 2
!
hostname KYOTEN2
!
crypto ipsec policy P2-POLICY
set pfs group14
set security-association always-up
set security-association lifetime seconds 28800
set security-association transform-keysize aes 256 256 256
set security-association transform esp-aes esp-sha-hmac
set mtu 1454
set ip df-bit 0
set ip fragment post
exit
!
crypto ipsec selector SELECTOR
src 1 ipv4 any
dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
l2tpv3 log session
!
crypto isakmp policy P1-POLICY
authentication pre-share
encryption aes
encryption-keysize aes 256 256 256
group 14
lifetime 86400
hash sha
initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
self-identity user-fqdn id-kyoten2
set peer 192.0.2.1
set isakmp-policy P1-POLICY
set ipsec-policy P2-POLICY
ike-version 1
local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
match address SELECTOR
set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
vlan-id 1
bridge-group 1
exit
!
interface GigaEthernet 2/1
vlan-id 2
bridge-group 2
pppoe enable
exit
!
interface Loopback 1
ip address 10.0.0.3
exit
!
interface Tunnel 1
description FLETS
ip access-group 100 in
ip access-group 111 in
ip access-group 121 out
tunnel mode pppoe profile PPPOE_PROF
pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
tunnel mode ipsec map CENTER
exit
!
interface Tunnel 3
tunnel mode l2tpv3 pseudowire L2TPv3_center
bridge-group 1
exit
!
l2tpv3 tunnel-profile L2TPv3_PROF_center
mode l2tpv3
tunnel source 10.0.0.3
tunnel destination 10.0.0.1
tunnel protection ipsec tunnel 2
hostname local KYOTEN2
hostname remote CENTER
hello interval 10
exit
!
l2tpv3 pseudowire L2TPv3_center
set profile L2TPv3_PROF_center
remote-end-id ascii ID_center_kyoten2
always-up
exit
!
pppoe profile PPPOE_PROF
account abc678@***.***.ne.jp yyyzzzxxx
exit
!
end

</pre>

ページの先頭へ

機能IPsecの設定