VPP配置gre or IPSec IKEv2远端any

1、配置拓扑图

2、FW1配置（主动）

2.1、配置接口IP

set int state GigabitEthernet2/1/0 up

set int ip address GigabitEthernet2/1/0 20.20.20.1/24

set int state GigabitEthernet2/2/0 up

set int ip address GigabitEthernet2/2/0 30.30.30.1/24

2.2、配置IPSec IKEv2

1、创建名为pr1的IKEV2配置

ikev2 profile add pr1

配置说明：ikev2 profile [add|del] <id>

2、设置共享密钥认证方法

ikev2 profile set pr1 auth shared-key-mic string Vpp123

配置说明：ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex] <data>

3、设置本地id

ikev2 profile set pr1 id local fqdn vpp1.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

4、设置远端id

ikev2 profile set pr1 id remote fqdn vpp2.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

5、设置远端ip地址和协商是对应的网络接口

ikev2 profile set pr1 responder GigabitEthernet2/1/0 20.20.20.2

配置说明：ikev2 profile set <id> responder <interface> <addr>

6、设置IKE秘钥套件和ESP秘钥套件,可以只在请求秘钥协商方添加秘钥套件

ikev2 profile set pr1 ike-crypto-alg aes-cbc 128 ike-integ-alg sha1-96 ike-dh modp-1024

配置说明：ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>

ikev2 profile set pr1 esp-crypto-alg aes-cbc 128 esp-integ-alg sha1-96 esp-dh modp-1024

配置说明：ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> esp-integ-alg <integ alg> esp-dh <dh type>

7、设置IPSec内网IP地址和远端内网IP地址

ikev2 profile set pr1 traffic-selector local ip-range 40.40.40.0 - 40.40.40.254 port-range 0 - 65535 protocol 0

ikev2 profile set pr1 traffic-selector remote ip-range 40.40.40.0 - 40.40.40.254 port-range 0 - 65535 protocol 0

配置说明：ikev2 profile set <id> traffic-selector <local|remote> ip-range <start-addr> - <end-addr> port-range <start-port> - <end-port> protocol <protocol-number>

PS：Ikev2感兴趣流是ike协商时候的必选项，实际流量必须引路由到IPSec口，流量不会匹配感兴趣流到IPSec接口

8、发起IPSec协商请求

ikev2 initiate sa-init pr1

配置说明：ikev2 initiate sa-init <profile id>

PS：主动端必须手动发起IPSec协商

2.3、查看IKEv2 sa

show ikev2 sa

iip 20.20.20.1 ispi ad981dd6f3680601 rip 20.20.20.2 rspi cea2684dc017581e
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:b43f85f9e7b4b98a314d42931d1b1db7c97a7ae83a6f828f4a95c2cc96b9ff4e
        r:58213ddc27da8b2e54a7cac8f1beee95a4d2354f37f30e7217e02c18605d8689
  SK_d    2d9efeacab094d150723eb6f08ef68c876a27b428d9ed483a9ba3a89886990d4
  SK_a  i:bea08006860ea77fa73ae5bb37fa71caa13e4dce
        r:f0f776c668b5b6dbd4264f35e9b5200b93bf96f9
  SK_e  i:dc3c57b1b9e4aa6013805cf632e0ea70
        r:d21037f2904e4c1c46671e587d9a7e11
  SK_p  i:a836debbd009f69a4af5f5d159ebeceb960e23f98cfb5e8d4c400b6d5560df28
        r:943eebb758913c8876c6ead8dc2cabf03cb68b827fad7e2d386624f2a7c3b624
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) 18c7f7b spi(r) 363b88a8
    SK_e  i:45b674cfd333f65081a64bad970be404
          r:054435bd38f68758d91bbe13a44c57ec
    SK_a  i:3a612a2ed4edf9b2de8c5fa5f1d3fdd9846faebe
          r:6669c2481d360dc6ca85e981f792924ebd4ceaa7
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 40.40.40.0 - 40.40.40.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 40.40.40.0 - 40.40.40.254 port 0 - 65535
 iip 20.20.20.1 ispi ad981dd6f3680601 rip 20.20.20.2 rspi cea2684dc017581e

2.4、IPSec口配置IP

set int state ipsec0 up

set int ip address ipsec0 40.40.40.1/24

2.5、使用IPSec接口IP创建gre

create gre tunnel src 40.40.40.1 dst 40.40.40.2 instance 0

​​​​​​​2.6、gre口配置IP

set int state gre0 up

set int ip address gre0 50.50.50.1/24

​​​​​​​2.7、​​​​​​​配置静态路由

ip route 10.10.10.0/24 via gre0

3、FW2配置（被动）

3.1、配置接口IP

set int state GigabitEthernet2/1/0 up

set int ip address GigabitEthernet2/1/0 20.20.20.2/24

set int state GigabitEthernet2/2/0 up

set int ip address GigabitEthernet2/2/0 10.10.10.1/24

​​​​​​​3.2、配置IPSec IKEv2

1、创建名为pr1的IKEV2配置

ikev2 profile add pr1

配置说明：ikev2 profile [add|del] <id>

2、设置共享密钥认证方法

ikev2 profile set pr1 auth shared-key-mic string Vpp123

配置说明：ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex] <data>

3、设置本地id

ikev2 profile set pr1 id local fqdn vpp1.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

4、设置远端id

ikev2 profile set pr1 id remote fqdn vpp2.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

5、设置IPSec内网IP地址和远端内网IP地址

ikev2 profile set pr1 traffic-selector local ip-range 40.40.40.0 - 40.40.40.254 port-range 0 - 65535 protocol 0

ikev2 profile set pr1 traffic-selector remote ip-range 40.40.40.0 - 40.40.40.254 port-range 0 - 65535 protocol 0

配置说明：ikev2 profile set <id> traffic-selector <local|remote> ip-range <start-addr> - <end-addr> port-range <start-port> - <end-port> protocol <protocol-number>

PS：Ikev2感兴趣流是ike协商时候的必选项，实际流量必须引路由到IPSec口，流量不会匹配感兴趣流到IPSec接口

3.3、查看IKEv2 sa

show ikev2 sa

iip 20.20.20.1 ispi ad981dd6f3680601 rip 20.20.20.2 rspi cea2684dc017581e
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:b43f85f9e7b4b98a314d42931d1b1db7c97a7ae83a6f828f4a95c2cc96b9ff4e
        r:58213ddc27da8b2e54a7cac8f1beee95a4d2354f37f30e7217e02c18605d8689
  SK_d    2d9efeacab094d150723eb6f08ef68c876a27b428d9ed483a9ba3a89886990d4
  SK_a  i:bea08006860ea77fa73ae5bb37fa71caa13e4dce
        r:f0f776c668b5b6dbd4264f35e9b5200b93bf96f9
  SK_e  i:dc3c57b1b9e4aa6013805cf632e0ea70
        r:d21037f2904e4c1c46671e587d9a7e11
  SK_p  i:a836debbd009f69a4af5f5d159ebeceb960e23f98cfb5e8d4c400b6d5560df28
        r:943eebb758913c8876c6ead8dc2cabf03cb68b827fad7e2d386624f2a7c3b624
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) 18c7f7b spi(r) 363b88a8
    SK_e  i:45b674cfd333f65081a64bad970be404
          r:054435bd38f68758d91bbe13a44c57ec
    SK_a  i:3a612a2ed4edf9b2de8c5fa5f1d3fdd9846faebe
          r:6669c2481d360dc6ca85e981f792924ebd4ceaa7
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 40.40.40.0 - 40.40.40.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 40.40.40.0 - 40.40.40.254 port 0 - 65535
 iip 20.20.20.1 ispi ad981dd6f3680601 rip 20.20.20.2 rspi cea2684dc017581e

3.4、IPSec口配置IP

set int state ipsec0 up

set int ip address ipsec0 40.40.40.2/24

3.5、使用IPSec接口IP创建gre

create gre tunnel src 40.40.40.2 dst 40.40.40.1 instance 0

3.6、gre口配置IP

set int state gre0 up

set int ip address gre0 50.50.50.2/24

3.7、配置静态路由

ip route 30.30.30.0/24 via gre0

4、结果验证

PC1 ping PC2，add dpdk-input 100抓包查看报文封装流程如下：

00:05:44:114105: dpdk-input
  GigabitEthernet2/2/0 rx queue 0
  buffer 0xba35: current data 0, length 74, free-list 0, clone-count 0, totlen-nifb 0, trace 0x2
                 ext-hdr-valid 
                 l4-cksum-computed l4-cksum-correct 
  PKT MBUF: port 1, nb_segs 1, pkt_len 74
    buf_len 2176, data_len 74, ol_flags 0x0, data_off 128, phys_addr 0x26e8dc0
    packet_type 0x0 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
    rss 0x0 fdir.hi 0x0 fdir.lo 0x0
  IP4: 00:50:56:ac:06:c9 -> 00:50:56:ac:46:ae
  ICMP: 10.10.10.2 -> 30.30.30.2
    tos 0x00, ttl 64, length 60, checksum 0xeee8
    fragment id 0x3bad
  ICMP echo_request checksum 0x574
00:05:44:114134: ethernet-input
  frame: flags 0x3, hw-if-index 2, sw-if-index 2
  IP4: 00:50:56:ac:06:c9 -> 00:50:56:ac:46:ae
00:05:44:114149: ip4-input-no-checksum
  ICMP: 10.10.10.2 -> 30.30.30.2
    tos 0x00, ttl 64, length 60, checksum 0xeee8
    fragment id 0x3bad
  ICMP echo_request checksum 0x574
00:05:44:114160: ip4-lookup
  fib 0 dpo-idx 5 flow hash: 0x00000000
  ICMP: 10.10.10.2 -> 30.30.30.2
    tos 0x00, ttl 64, length 60, checksum 0xeee8
    fragment id 0x3bad
  ICMP echo_request checksum 0x574
00:05:44:114170: ip4-midchain
    GRE: 40.40.40.2 -> 40.40.40.1
      tos 0x00, ttl 254, length 84, checksum 0x1c28
      fragment id 0x0000
    GRE ip4
00:05:44:114183: adj-midchain-tx
  adj-midchain:[5]:ipv4 via 0.0.0.0 gre0: mtu:9000 4500000000000000fe2f1c7c282828022828280100000800
  stacked-on entry:21:                                                               
    [@3]: ipv4 via 0.0.0.0 ipsec0: mtu:9000                                          
00:05:44:114189: ip4-rewrite                                                         
  tx_sw_if_index 3 dpo-idx 4 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 flow hash: 0x00000000
  00000000: 4500005400000000fd2f1d282828280228282801000008004500003c3bad0000         
  00000020: 3f01efe80a0a0a021e1e1e0208000574000247e66162636465666768                 
00:05:44:114197: ipsec0-output                                                       
  ipsec0                                                                             
  00000000: 4500005400000000fd2f1d282828280228282801000008004500003c3bad0000         
  00000020: 3f01efe80a0a0a021e1e1e0208000574000247e66162636465666768696a6b6c         
  00000040: 6d6e6f7071727374757677616263646566676869000000000000000000000000         
  00000060: 00000000000000000000000000000000000000000000000000000000                 
00:05:44:114205: ipsec0-tx                                                           
  IPSec: spi 25984891 seq 14                                                         
00:05:44:114210: esp4-encrypt                                                        
  esp: spi 25984891 seq 14 crypto aes-cbc-128 integrity sha1-96                      
00:05:44:114248: ip4-lookup                                                          
  fib 0 dpo-idx 3 flow hash: 0x00000000                                              
  IPSEC_ESP: 20.20.20.2 -> 20.20.20.1                                                
    tos 0x00, ttl 254, length 152, checksum 0x6c09                                   
    fragment id 0x0000                                                               
00:05:44:114252: ip4-rewrite                                                         
  tx_sw_if_index 1 dpo-idx 3 : ipv4 via 20.20.20.1 GigabitEthernet2/1/0: mtu:9000 000c
298185d0005056ac9f1a0800 flow hash: 0x00000000                                       
  00000000: 000c298185d0005056ac9f1a08004500009800000000fd326d09141414021414         
  00000020: 1401018c7f7b0000000f870dbdc2abf702a7e33e3ca1ef1ff89d073a                 
00:05:44:114255: GigabitEthernet2/1/0-output                                         
  GigabitEthernet2/1/0                                                               
  IP4: 00:50:56:ac:9f:1a -> 00:0c:29:81:85:d0                                        
  IPSEC_ESP: 20.20.20.2 -> 20.20.20.1                                                
    tos 0x00, ttl 253, length 152, checksum 0x6d09                                   
    fragment id 0x0000                                                               
00:05:44:114263: GigabitEthernet2/1/0-tx                                             
  GigabitEthernet2/1/0 tx queue 1                                                    
  buffer 0x1d073: current data 0, length 166, free-list 0, clone-count 0, totlen-nifb 
0, trace 0x2                                                                         
  PKT MBUF: port 65535, nb_segs 1, pkt_len 166                                       
    buf_len 2176, data_len 166, ol_flags 0x0, data_off 128, phys_addr 0x2b41d40      
    packet_type 0x0 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0                  
    rss 0x0 fdir.hi 0x0 fdir.lo 0x0                                                  
  IP4: 00:50:56:ac:9f:1a -> 00:0c:29:81:85:d0                                        
  IPSEC_ESP: 20.20.20.2 -> 20.20.20.1                                                
    tos 0x00, ttl 253, length 152, checksum 0x6d09                                   
    fragment id 0x0000