Два маршрутизатора ESR-200:
Код: Выделить всё
e200-1# sh ver
SW version:
1.0.7 build 111[7c364b9] (date 29/03/2016 time 16:53:58)
HW version:
1v4
e200-2# sh ver
SW version:
1.0.7 build 111[7c364b9] (date 29/03/2016 time 16:53:58)
HW version:
1v4
Между ними настроен IPSEC тоннель.
Конфигурация e200-1:
Код: Выделить всё
interface gigabitethernet 1/0/1
security-zone untrusted
ip address 172.16.x.9/30
exit
tunnel vti 1
mtu 1420
security-zone trusted
local address 172.16.x.9
remote address 172.16.x.10
ip tcp adjust-mss 1380
enable
exit
security ike proposal IKE_proposal
authentication algorithm md5
encryption algorithm aes128
dh-group 2
lifetime 86400
exit
security ike policy IKE_policy
pre-shared-key ascii-text <password>
proposal IKE_proposal
exit
security ike gateway IKE_gateway
version v2-only
ike-policy IKE_policy
mode route-based
bind-interface vti 1
dead-peer-detection action restart
dead-peer-detection interval 60
dead-peer-detection timeout 180
exit
security ipsec proposal IPSEC_proposal
authentication algorithm md5
encryption algorithm blowfish128
exit
security ipsec policy IPSEC_policy
proposal IPSEC_proposal
exit
security ipsec vpn IPSEC_1
mode ike
ike establish-tunnel immediate
ike gateway IKE_gateway
ike ipsec-policy IPSEC_policy
enable
exit
ip route 172.16.y.0/21 tunnel vti 1
ip route 0.0.0.0/0 172.17.a.6
Конфигурация e200-2:
Код: Выделить всё
interface gigabitethernet 1/0/1
security-zone untrusted
ip address 172.16.x.10/30
exit
tunnel vti 1
mtu 1420
security-zone trusted
local address 172.16.x.10
remote address 172.16.x.9
ip tcp adjust-mss 1380
enable
exit
security ike proposal IKE_proposal
authentication algorithm md5
encryption algorithm aes128
dh-group 2
lifetime 86400
exit
security ike policy IKE_policy
pre-shared-key ascii-text <password>
proposal IKE_proposal
exit
security ike gateway IKE_gateway
version v2-only
ike-policy IKE_policy
mode route-based
bind-interface vti 1
exit
security ipsec proposal IPSEC_proposal
authentication algorithm md5
encryption algorithm blowfish128
exit
security ipsec policy IPSEC_policy
proposal IPSEC_proposal
exit
security ipsec vpn IPSEC_1
mode ike
ike establish-tunnel immediate
ike gateway IKE_gateway
ike ipsec-policy IPSEC_policy
enable
exit
ip route 172.16.0.0/14 tunnel vti 1
Со стороны пользователя подключенного к e200-2 запускаем пинг
ping 172.17.2.1 count 1000 size 1518
Pinging 172.17.2.1 with 1472 bytes of data:
----172.17.2.1 PING Statistics----
1000 packets transmitted, 917 packets received, 9% packet loss
round-trip (ms) min/avg/max = 0/9/76
добавляем маршрут на сеть 172.17.2.0/24 в обход тоннеля на обоих ESR.
Запускаем пинг
ping 172.17.2.1 count 1000 size 1518
Pinging 172.17.2.1 with 1472 bytes of data:
----172.17.2.1 PING Statistics----
1000 packets transmitted, 1000 packets received, 0% packet loss
round-trip (ms) min/avg/max = 3/12/122
Со стороны пользователей имеем постоянные жалобы на разрывы связи т.д. и т.п.