組網(wǎng)及說明

注：如無特別說明，描述中的 FW1 或 MSR1 對應(yīng)拓?fù)渲性O(shè)備名稱末尾數(shù)字為 1 的設(shè)備，F(xiàn)W2 或 MSR2 對應(yīng)拓?fù)渲性O(shè)備名稱末尾數(shù)字為 2 的設(shè)備，以此類推；另外，同一網(wǎng)段中，IP 地址的主機(jī)位為其設(shè)備編號，如 FW1 的 g0/0 接口若在 192.168.1.0/24 網(wǎng)段，則其 IP 地址為 192.168.1.1/24，以此類推。

實(shí)驗(yàn)需求

由于GRE報(bào)文為明文封裝，在網(wǎng)絡(luò)中傳輸容易被監(jiān)聽導(dǎo)致信息泄漏?；诖?，本案例提供一種方案，使用NAT技術(shù)隱藏客戶端源地址。

配置步驟

FW1

?

#

?nat?static?inbound?192.168.13.3?1.1.1.1?acl?3000?reversible

#

interface?LoopBack0

?ip?address?192.168.12.1?255.255.255.255

#

interface?GigabitEthernet1/0/0

?port?link-mode?route

?combo?enable?copper

?ip?address?192.168.1.1?255.255.255.0

?nat?outbound

#

interface?GigabitEthernet1/0/1

?port?link-mode?route

?combo?enable?copper

?ip?address?192.168.13.1?255.255.255.0

?nat?static?enable

#

interface?Tunnel0?mode?gre

?ip?address?10.1.1.1?255.255.255.0

?source?192.168.12.1

?destination?192.168.12.2

#

security-zone?name?Local

#

security-zone?name?Trust

?import?interface?GigabitEthernet1/0/1

#

security-zone?name?DMZ

#

security-zone?name?Untrust

?import?interface?GigabitEthernet1/0/0

?import?interface?Tunnel0

#

security-zone?name?Management

#

?ip?route-static?1.1.1.1?32?192.168.13.3

?ip?route-static?1.1.1.2?32?Tunnel0

?ip?route-static?192.168.12.2?32?192.168.1.2

?ip?route-static?192.168.24.4?32?Tunnel0

#

acl?advanced?3000

?rule?5?permit?ip?source?192.168.13.3?0?destination?1.1.1.2?0

#

?session?statistics?enable

#?????????????

?ip?http?enable

?ip?https?enable

#

security-policy?ip

?rule?0?name?any

??action?pass

?

FW2

?

#

?nat?static?inbound?192.168.24.4?1.1.1.2?acl?3000?reversible

#

interface?LoopBack0

?ip?address?192.168.12.2?255.255.255.255

#

interface?GigabitEthernet1/0/0

?port?link-mode?route

?combo?enable?copper

?ip?address?192.168.1.2?255.255.255.0

?nat?outbound

#

interface?GigabitEthernet1/0/1

?port?link-mode?route

?combo?enable?copper

?ip?address?192.168.24.2?255.255.255.0

?nat?static?enable

#

interface?Tunnel0?mode?gre

?ip?address?10.1.1.2?255.255.255.0

?source?192.168.12.2

?destination?192.168.12.1

#

security-zone?name?Local

#

security-zone?name?Trust

?import?interface?GigabitEthernet1/0/1

#

security-zone?name?DMZ

#

security-zone?name?Untrust

?import?interface?GigabitEthernet1/0/0

?import?interface?Tunnel0

#

security-zone?name?Management

#

?ip?route-static?1.1.1.1?32?Tunnel0

?ip?route-static?1.1.1.2?32?192.168.24.4

?ip?route-static?192.168.12.1?32?192.168.1.1

?ip?route-static?192.168.13.3?32?Tunnel0

#

acl?advanced?3000

?rule?5?permit?ip?source?192.168.24.4?0?destination?1.1.1.1?0

#

?session?statistics?enable

#?????????????

?ip?http?enable

?ip?https?enable

#

security-policy?ip

?rule?0?name?any

??action?pass

?

配置關(guān)鍵點(diǎn)

注意事項(xiàng)：需要注意添加對應(yīng)的靜態(tài)路由

以R3訪問R4為例，訪問過程如下：

FW1上的業(yè)務(wù)點(diǎn)

NAT轉(zhuǎn)換：

?

?192.168.13.3:10965?-?????????1.1.1.2:?2048(VPN:????0)?------>

?????????1.1.1.1:10965?-?????????1.1.1.2:?2048(VPN:????0)

?

GRE封裝：

?

192.168.12.1??-???????????192.168.12.2

?

W2上的業(yè)務(wù)點(diǎn)

GRE解封裝：

?

192.168.12.1??-???????????192.168.12.2

?

NAT轉(zhuǎn)換：

?

1.1.1.1:10965?-?????????1.1.1.2:?2048(VPN:????0)?------>

1.1.1.1:10965?-????192.168.24.4:?2048(VPN:????0)

?

審核編輯：劉清