VPP系统 配置IPSec IKEv2 远端地址any

1、配置拓扑

PS: VPP1主动发起IKEv2协商并建立IPSec隧道，VPP2被动和VPP1建立IPSec隧道。

2、VPP1配置（主动）

2.1、接口配置

1、启用GigabitEthernet2/1/0

set int state GigabitEthernet2/1/0 up

2、GigabitEthernet2/1/0口配置IP

set int ip address GigabitEthernet2/1/0 10.66.0.1/24

3、启用GigabitEthernet2/4/0

set int state GigabitEthernet2/4/0 up

4、GigabitEthernet2/4/0口配置IP

set int ip address GigabitEthernet2/4/0 10.0.0.1/24

2.2、IKEv2配置

1、创建名为pr1的IKEV2配置

ikev2 profile add pr1

配置说明：ikev2 profile [add|del] <id>

2、设置共享密钥认证方法

ikev2 profile set pr1 auth shared-key-mic string Vpp123

配置说明：ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex] <data>

3、设置本地id

ikev2 profile set pr1 id local fqdn vpp1.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

4、设置远端id

ikev2 profile set pr1 id remote fqdn vpp2.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

5、设置远端ip地址和协商是对应的网络接口

ikev2 profile set pr1 responder GigabitEthernet2/1/0 10.66.0.2

配置说明：ikev2 profile set <id> responder <interface> <addr>

6、设置IKE秘钥套件和ESP秘钥套件,可以只在请求秘钥协商方添加秘钥套件

ikev2 profile set pr1 ike-crypto-alg aes-cbc 128 ike-integ-alg sha1-96 ike-dh modp-1024

配置说明：ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>

ikev2 profile set pr1 esp-crypto-alg aes-cbc 128 esp-integ-alg sha1-96 esp-dh modp-1024

配置说明：ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> esp-integ-alg <integ alg> esp-dh <dh type>

7、设置IPSec内网IP地址和远端内网IP地址

ikev2 profile set pr1 traffic-selector local ip-range 10.0.0.0 - 10.0.0.254 port-range 0 - 65535 protocol 0

Ikev2 profile set pr1 traffic-selector remote ip-range 11.0.0.0 - 11.0.0.254 port-range 0 - 65535 protocol 0

配置说明：ikev2 profile set <id> traffic-selector <local|remote> ip-range <start-addr> - <end-addr> port-range <start-port> - <end-port> protocol <protocol-number>

8、发起IPSec协商请求

ikev2 initiate sa-init pr1

配置说明：ikev2 initiate sa-init <profile id>

2.3、查看IKEv2配置

show ikev2 profile

profile pr1
  auth-method shared-key-mic auth data Vpp123
  local id-type fqdn data vpp1.home
  remote id-type fqdn data vpp2.home
  local traffic-selector addr 10.0.0.0 - 10.0.0.254 port 0 - 65535 protocol 0
  remote traffic-selector addr 11.0.0.0 - 11.0.0.254 port 0 - 65535 protocol 0

2.4、查看IKEv2协商结果

show ikev2 sa

 iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:9d78d097d4fa46dbf4d078b4f940346f312b593c9b368f0cc133de0516b19a6b
        r:9fe1386b1cd18c661ef99783936f7816914f5241c8d1bb0029c0254303fa75be
  SK_d    d2bdb93d225adbea26b71cdfd415029f6baa2bc6497f311c91b06f75f9156287
  SK_a  i:56b8ee31a1caf65540bece8c5aca86165ad76b69
        r:c0cfc2e201c8c8d1f3a86756cfda78a08e1a2a05
  SK_e  i:407c57bc5a82ed6d5f95e2923f724749
        r:b6ba1d40691b0537a0402a6ffb4fffa1
  SK_p  i:be12bb9e22c5d1972d97fca1f29f94d37deeb99c0ff7d005fa4118e95feb3d25
        r:15f2df15daac20fb288055b385996b9ee12b903bb6654c9158a27b8803e9491e
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) c3413186 spi(r) e01f01ea
    SK_e  i:00a6544deb5ddee0ded094a35afab94e
          r:2b018822f1c250c02ff3e29c0351b332
    SK_a  i:9f3f8f2f48a15be2bfa70da238d6086d60ef209c
          r:9e7544bd5f6efb78078e98c66f23274d42b12acf
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 10.0.0.0 - 10.0.0.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 11.0.0.0 - 11.0.0.254 port 0 - 65535
 iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069
 iip 10.66.0.1 ispi 6bdf481a03bb986e rip 10.66.0.2 rspi b3e02e3efe27bce5
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:1a8c9fb1c4190d5c7dc9c754bcbd4c465f713f9638fb1150d4534b4d84b934b4
        r:7ebeb7b7b40c46a90cc3721001f82e623d9c9b8d023543559abe5dcaaf60c97c
  SK_d    9e1a0ee4dd691fb24acb886b1091e194536cccb2a37250a7a22d963bccf72640
  SK_a  i:692e435ddc08978bfbe571281642cb80ac6dc24b
        r:6cd455930a75f57f99ded4d538b985dc0872d4d2
  SK_e  i:fbf52709abd5462cbac89aca1d9113a9
        r:f64ff82494edcb279e66a37f5502c243
  SK_p  i:7d747bde1d24e044b887d9c58403c99f25c0d4e064eb42f060f11bb4bd4d987c
        r:9ea987ed01e0d71ab0fd951b6ee70a1311665ae08703477ba3184ac66e76cc2a
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) d9658ef spi(r) 62c03297
    SK_e  i:35857ab4e8da39ee8fe8fa5f86d174a4
          r:03b51ca07283f338b0c82c3bd53c1870
    SK_a  i:2e671df7741623b0744c1dd6f2836204645c85cb
          r:d99d4ebbaefe66e6eb277f3a075a45a761386a72
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 10.0.0.0 - 10.0.0.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 11.0.0.0 - 11.0.0.254 port 0 - 65535                                                               
 iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069

2.5、启用IPSec接口

set int state ipsec0 up

2.6、路由引到IPSec接口

ip route add 11.0.0.0/24 via ipsec0

2.7、IPSec接口绑定物理接口

set int unnumbered ipsec0 use GigabitEthernet2/1/0

3、VPP2配置（被动）

3.1、接口配置

1、启用GigabitEthernet2/2/0

set int state GigabitEthernet2/2/0 up

2、GigabitEthernet2/2/0接口配置IP

set int ip address GigabitEthernet2/2/0 11.0.0.1/24

3、启用GigabitEthernet2/3/0

set int state GigabitEthernet2/3/0 up

4、GigabitEthernet2/3/0接口配置IP

set int ip address GigabitEthernet2/3/0 10.66.0.2/24

3.2、IKEv2配置

1、创建名为pr1的IKEV2配置

ikev2 profile add pr1

配置说明：ikev2 profile [add|del] <id>

2、设置预共享密钥认证方法

ikev2 profile set pr1 auth shared-key-mic string Vpp123

配置说明：ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex] <data>

3、设置本地id

ikev2 profile set pr1 id local fqdn vpp2.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

4、设置远端id

ikev2 profile set pr1 id remote fqdn vpp1.home

配置说明：ikev2 profile set <id> id <local|remote> <type> <data>

5、设置IPSec内网IP地址和远端内网IP地址

ikev2 profile set pr1 traffic-selector local ip-range 11.0.0.0 - 11.0.0.254 port-range 0 - 65535 protocol 0

ikev2 profile set pr1 traffic-selector remote ip-range 10.0.0.0 - 10.0.0.254 port-range 0 - 65535 protocol 0

配置说明：ikev2 profile set <id> traffic-selector <local|remote> ip-range <start-addr> - <end-addr> port-range <start-port> - <end-port> protocol <protocol-number>

3.3、查看IKEv2配置

show ikev2 profile

profile pr1
  auth-method shared-key-mic auth data Vpp123
  local id-type fqdn data vpp2.home
  remote id-type fqdn data vpp1.home
  local traffic-selector addr 11.0.0.0 - 11.0.0.254 port 0 - 65535 protocol 0
  remote traffic-selector addr 10.0.0.0 - 10.0.0.254 port 0 - 65535 protocol 0

3.4、查看IKEv2协商结果

show ikev2 sa

iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:9d78d097d4fa46dbf4d078b4f940346f312b593c9b368f0cc133de0516b19a6b
        r:9fe1386b1cd18c661ef99783936f7816914f5241c8d1bb0029c0254303fa75be
  SK_d    d2bdb93d225adbea26b71cdfd415029f6baa2bc6497f311c91b06f75f9156287
  SK_a  i:56b8ee31a1caf65540bece8c5aca86165ad76b69
        r:c0cfc2e201c8c8d1f3a86756cfda78a08e1a2a05
  SK_e  i:407c57bc5a82ed6d5f95e2923f724749
        r:b6ba1d40691b0537a0402a6ffb4fffa1
  SK_p  i:be12bb9e22c5d1972d97fca1f29f94d37deeb99c0ff7d005fa4118e95feb3d25
        r:15f2df15daac20fb288055b385996b9ee12b903bb6654c9158a27b8803e9491e
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) c3413186 spi(r) e01f01ea
    SK_e  i:00a6544deb5ddee0ded094a35afab94e
          r:2b018822f1c250c02ff3e29c0351b332
    SK_a  i:9f3f8f2f48a15be2bfa70da238d6086d60ef209c
          r:9e7544bd5f6efb78078e98c66f23274d42b12acf
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 10.0.0.0 - 10.0.0.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 11.0.0.0 - 11.0.0.254 port 0 - 65535
 iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069
 iip 10.66.0.1 ispi 6bdf481a03bb986e rip 10.66.0.2 rspi b3e02e3efe27bce5
 encr:aes-cbc-128 prf:hmac-sha2-256 integ:sha1-96 dh-group:modp-1024 
  nonce i:1a8c9fb1c4190d5c7dc9c754bcbd4c465f713f9638fb1150d4534b4d84b934b4
        r:7ebeb7b7b40c46a90cc3721001f82e623d9c9b8d023543559abe5dcaaf60c97c
  SK_d    9e1a0ee4dd691fb24acb886b1091e194536cccb2a37250a7a22d963bccf72640
  SK_a  i:692e435ddc08978bfbe571281642cb80ac6dc24b
        r:6cd455930a75f57f99ded4d538b985dc0872d4d2
  SK_e  i:fbf52709abd5462cbac89aca1d9113a9
        r:f64ff82494edcb279e66a37f5502c243
  SK_p  i:7d747bde1d24e044b887d9c58403c99f25c0d4e064eb42f060f11bb4bd4d987c
        r:9ea987ed01e0d71ab0fd951b6ee70a1311665ae08703477ba3184ac66e76cc2a
  identifier (i) fqdn vpp1.home
  identifier (r) fqdn vpp2.home
  child sa 0:
    encr:aes-cbc-128 integ:sha1-96 esn:yes 
    spi(i) d9658ef spi(r) 62c03297
    SK_e  i:35857ab4e8da39ee8fe8fa5f86d174a4
          r:03b51ca07283f338b0c82c3bd53c1870
    SK_a  i:2e671df7741623b0744c1dd6f2836204645c85cb
          r:d99d4ebbaefe66e6eb277f3a075a45a761386a72
    traffic selectors (i):
      0 type 7 protocol_id 0 addr 10.0.0.0 - 10.0.0.254 port 0 - 65535
    traffic selectors (r):
      0 type 7 protocol_id 0 addr 11.0.0.0 - 11.0.0.254 port 0 - 65535                                                                
 iip 10.66.0.1 ispi e1bd965df0be49d rip 10.66.0.2 rspi 2c503a83ce480069

3.5、启用IPSec接口

set int state ipsec0 up

3.6、路由引到IPSec接口

ip route add 10.0.0.0/24 via ipsec0

3.7、IPSec接口绑定物理接口

set int unnumbered ipsec0 use GigabitEthernet2/3/0

4、结果验证

PC1 ping PC2，可以ping通，抓包可以看到报文进行封装发送。

封装报文如下：

16:15:22:373238: dpdk-input
  GigabitEthernet2/2/0 rx queue 0
  buffer 0x6663: current data 0, length 74, free-list 0, clone-count 0, totlen-nifb 0, trace 0x2
                 ext-hdr-valid 
                 l4-cksum-computed l4-cksum-correct 
  PKT MBUF: port 0, nb_segs 1, pkt_len 74
    buf_len 2176, data_len 74, ol_flags 0x0, data_off 128, phys_addr 0xc1799940
    packet_type 0x0 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
    rss 0x0 fdir.hi 0x0 fdir.lo 0x0
  IP4: 00:0c:29:37:da:f3 -> 00:0c:29:2a:f6:9f
  ICMP: 11.0.0.2 -> 10.0.0.2
    tos 0x00, ttl 64, length 60, checksum 0xff20
    fragment id 0x669d
  ICMP echo_request checksum 0xb0da
16:15:22:373253: ethernet-input
  frame: flags 0x3, hw-if-index 1, sw-if-index 1
  IP4: 00:0c:29:37:da:f3 -> 00:0c:29:2a:f6:9f
16:15:22:373259: ip4-input-no-checksum
  ICMP: 11.0.0.2 -> 10.0.0.2
    tos 0x00, ttl 64, length 60, checksum 0xff20
    fragment id 0x669d
  ICMP echo_request checksum 0xb0da
16:15:22:373263: ip4-lookup
  fib 0 dpo-idx 3 flow hash: 0x00000000
  ICMP: 11.0.0.2 -> 10.0.0.2
    tos 0x00, ttl 64, length 60, checksum 0xff20
    fragment id 0x669d
  ICMP echo_request checksum 0xb0da                                                  
16:15:22:373283: ip4-rewrite                                                         
  tx_sw_if_index 3 dpo-idx 3 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 flow hash: 0x00000000
  00000000: 4500003c669d00003f0100210b0000020a0000020800b0da00029c7f61626364         
  00000020: 65666768696a6b6c6d6e6f7071727374757677616263646566676869                 
16:15:22:373285: ipsec0-output                                                       
  ipsec0                                                                             
  00000000: 4500003c669d00003f0100210b0000020a0000020800b0da00029c7f61626364         
  00000020: 65666768696a6b6c6d6e6f707172737475767761626364656667686900000000         
  00000040: 0ce642bc972f6cf16dfbbf0ea77da6cbc561db707d4e81b1827e8a0334db5be5         
  00000060: 4b876874e85c1534895d6f7b73d94f811c6c9b987d39ef10bb504546                 
16:15:22:373289: ipsec0-tx                                                           
  IPSec: spi 3275829638 seq 1237                                                     
16:15:22:373290: esp4-encrypt                                                        
  esp: spi 3275829638 seq 1237 crypto aes-cbc-128 integrity sha1-96                  
16:15:22:373313: ip4-lookup                                                          
  fib 0 dpo-idx 4 flow hash: 0x00000000                                              
  IPSEC_ESP: 10.66.0.2 -> 10.66.0.1                                                  
    tos 0x00, ttl 254, length 120, checksum 0xa7cd                                   
    fragment id 0x0000                                                               
16:15:22:373313: ip4-rewrite                                                         
  tx_sw_if_index 2 dpo-idx 4 : ipv4 via 10.66.0.1 GigabitEthernet2/3/0: mtu:9000 000c2
9c85fdb000c292af6a90800 flow hash: 0x00000000                                        
  00000000: 000c29c85fdb000c292af6a908004500007800000000fd32a8cd0a4200020a42         
  00000020: 0001c3413186000004d6e3f0e921da3bc3191a1bcdf8aa86e0a76d66                 
16:15:22:373314: GigabitEthernet2/3/0-output                                         
  GigabitEthernet2/3/0                                                               
  IP4: 00:0c:29:2a:f6:a9 -> 00:0c:29:c8:5f:db                                        
  IPSEC_ESP: 10.66.0.2 -> 10.66.0.1                                                  
    tos 0x00, ttl 253, length 120, checksum 0xa8cd                                   
    fragment id 0x0000                                                               
16:15:22:373315: GigabitEthernet2/3/0-tx                                             
  GigabitEthernet2/3/0 tx queue 1                                                    
  buffer 0xa778: current data 0, length 134, free-list 0, clone-count 0, totlen-nifb 0
, trace 0x2                                                                          
  PKT MBUF: port 65535, nb_segs 1, pkt_len 134                                       
    buf_len 2176, data_len 134, ol_flags 0x0, data_off 128, phys_addr 0xc149de80     
    packet_type 0x0 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0                  
    rss 0x0 fdir.hi 0x0 fdir.lo 0x0                                                  
  IP4: 00:0c:29:2a:f6:a9 -> 00:0c:29:c8:5f:db                                        
  IPSEC_ESP: 10.66.0.2 -> 10.66.0.1                                                  
    tos 0x00, ttl 253, length 120, checksum 0xa8cd                                   
    fragment id 0x0000