【NEC UNIVERGE IX2106】IKEv2 による IPsec の設定方法

#対向装置の認証情報の設定
ikev2 authentication psk id ipv4 200.1.4.1 key char ikev2pass

#デフォルトプロファイルの設定
ikev2 default-profile
  child-pfs off
  dpd interval 10
  sa-proposal dh 1024-bit

#IPsec トンネルインターフェースの設定
interface Tunnel3.0
  tunnel mode ipsec-ikev2
  ip address 10.200.0.1/24
  ip tcp adjust-mss auto
  ikev2 connect-type auto
  ikev2 ipsec pre-fragment
  ikev2 peer 200.1.4.1 authentication psk id ipv4 200.1.4.1
  no shutdown

#IPsec 構築用ルートの設定
ip route 200.1.4.0/30 200.1.1.2

#BGP設定
router bgp 100
  neighbor 10.200.0.254 remote-as 100
  neighbor 10.200.0.254 timers 10 30
  address-family ipv4 unicast
    redistribute connected

#IKEv2 プロポーザルの設定
crypto ikev2 proposal ikev2proposal
 encryption 3des
 integrity sha1
 group 2

#IKEv2 ポリシーの設定
crypto ikev2 policy ikev2policy
 match address local 200.1.4.1
 proposal ikev2proposal

#IKEv2 キーリングの設定
crypto ikev2 keyring keys
 peer 200.1.1.1
  address 200.1.1.1
  pre-shared-key ikev2pass

#IKEv2 プロファイルの設定
crypto ikev2 profile ikev2profile
 match identity remote address 200.1.1.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local keys

#IPsec トランスフォームセットの設定
crypto ipsec transform-set TF-SET esp-3des esp-sha-hmac
 mode tunnel

#IPsec プロファイルの設定
crypto ipsec profile IPS-PRF3
 set security-association lifetime kilobytes 1000000
 set transform-set TF-SET

#IPsecトンネルインターフェースの設定
interface Tunnel2
 ip address 10.200.0.254 255.255.255.0
 tunnel source Vlan204
 tunnel mode ipsec ipv4
 tunnel destination 200.1.1.1
 tunnel protection ipsec profile IPS-PRF3 ikev2-profile ikev2profile

#WAN側物理インターフェースの設定
interface GigabitEthernet5
 switchport access vlan 204
 no ip address

interface Vlan204
 ip address 200.1.4.1 255.255.255.252

#IPsec 構築用ルートの設定
ip route 200.1.1.0 255.255.255.252 200.1.4.2

#BGP設定
router bgp 100
 bgp log-neighbor-changes
 timers bgp 10 30
 redistribute connected
 neighbor 10.200.0.1 remote-as 100
 neighbor 10.200.0.1 soft-reconfiguration inbound

C:\WINDOWS\system32>tracert -d 10.11.0.1

10.11.0.1 へのルートをトレースしています。経由するホップ数は最大 30 です

  1     1 ms    <1 ms    <1 ms  192.168.1.254
  2     1 ms     1 ms     1 ms  10.200.0.254
  3     2 ms     2 ms     2 ms  10.11.0.1

トレースを完了しました。

C:\WINDOWS\system32>tracert -d 192.168.1.1

192.168.1.1 へのルートをトレースしています。経由するホップ数は最大 30 です

  1     1 ms     1 ms     1 ms  10.11.0.254
  2     2 ms     1 ms     2 ms  10.200.0.1
  3     2 ms     2 ms     2 ms  192.168.1.1

トレースを完了しました。

Router(config)# show ikev2 sa
IKEv2 SA - 1 created
Interface Tunnel3.0
  SPI (I)0xb598395e7153f9e3  (R)0xf8f17cc4737879a5
    Remain lifetime[sec] : 25441
    Serial : 33
    Direction : initiator
    Local Addr : 200.1.1.1:500
    Peer Addr  : 200.1.4.1:500
    Local ID : IPV4-ADDR 200.1.1.1
    Peer ID  : IPV4-ADDR 200.1.4.1
    Status : establish
    Local message ID : 6097
    Peer message ID  : 34
    Encryption alg : 3DES-CBC
      initiator key : 0x4a3bf68fca40d6cf7eb2a8d4ebe32e1cbbbe0d1e9bdbf835
      responder key : 0xc5ede5a97e5ded3f22c6eb24d7ee67a193b9bd45d4746b6c
    Integrity alg : HMAC-SHA1-96
      initiator key : 0x9d492d3c1dc7aaf27589ecd8ec30fb8d01d392f0
      responder key : 0x15eb8906de926cb3e10e8065bbf92f43d9357a49
    PRF alg  : HMAC-SHA1
    DH group : MODP-1024
    PFS : off
    DPD : interval 10[sec]
    Child
      Prot SPI(IN)    SPI(OUT)   Lifetime[sec]
      ESP  0x31105ebd 0xd976b38e 26796

Router(config)# show ikev2 child-sa
Child SA - 1 connected
Interface Tunnel3.0
  IKE Peer ID : IPV4-ADDR 200.1.4.1
    IKE SPI (I)0xb2495f148065b8f5  (R)0xe29ae85b8e0067e8
    IKE SA serial : 34
    Child SA
      Protocol : ESP
      Local Addr : 200.1.1.1
      Peer Addr  : 200.1.4.1
      Enc alg  : 3DES-CBC
      Hash alg : HMAC-SHA1-96
      Remain lifetime[sec] : 28698
      Anti-replay : on
      Direction is outbound
        SPI : 0xbc306b2b
        Serial : 73
        Authkey : 0x12f27a77a6b2289940123722021461acc2cb52f6
        Enckey  : 0x39b06a5eefb93557ba471c8a82bb072b5380ac3aa22a0d68
      Direction is inbound
        SPI : 0xdc53f027
        Serial : 72
        Authkey : 0x224d25ce59dd87454a56ebe00e39774c20ed8f93
        Enckey  : 0x062bd04b461f85249df86ded75b851d953f3d3b285831470
      Local TS:
        TS type : IPV4-ADDR-RANGE
          Protocol any
            Address Range 0.0.0.0 to 255.255.255.255
            Port Range 0 to 65535
      Peer TS:
        TS type : IPV4-ADDR-RANGE
          Protocol any
            Address Range 0.0.0.0 to 255.255.255.255
            Port Range 0 to 65535
    Statistics
      Outbound
        43 packets, 1970 octets
        0 cipher failure, 0 out of memory, 0 ts unacceptable
        0 misc error, 0 invalid packet, 0 packet too big
      Inbound
        42 packets, 2025 octets
        0 invalid sa, 0 replay detected, 0 integrity failure
        0 cipher failure, 0 packet truncated, 0 invalid padding
        0 unknown protocol, 0 out of memory, 0 ts unacceptable
        0 misc error, 0 tcp chksum error, 0 invalid packet
        0 recv error
    History
      Time                Event
      2020/10/22 06:25:41 Delete : Delete IKE SA by command
      2020/10/22 06:25:41 Create

Router(config)# show ikev2 statistics
IKEv2 Statistics
  Informational     : Initiator 13 success, 0 fail
                      Responder 0 success, 0 fail

  Exchange
    INFORMATIONAL   : 13 send request, 13 recv response
                      0 recv request, 0 send response
                      0 resend, 0 timeout

Router(config)# show ip bgp
BGP table version is 10, local router ID is 10.150.0.1
Local AS number 100
Status codes: s - suppressed, * - valid, h - history, l - looped
              > - best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network            Next Hop            Metric     LocPrf  Path
*> 10.7.254.0/24      0.0.0.0                  0             ?
*> 10.7.255.0/24      0.0.0.0                  0             ?
*>i10.11.0.0/24       10.200.0.254             0        100  ?
*> 10.150.0.0/30      0.0.0.0                  0             ?
*> 10.200.0.0/24      0.0.0.0                  0             ?
* i                   10.200.0.254             0        100  ?
*> 192.168.1.0/24     0.0.0.0                  0             ?
*> 200.1.1.0/30       0.0.0.0                  0             ?
*>i200.1.4.0/30       10.200.0.254             0        100  ?

Total number of prefixes 9

Router(config)# show ip bgp summary
BGP router ID 10.150.0.1, local AS number 100
1 BGP AS-PATH entries

Neighbor         V    AS    MsgRcvd MsgSent Up/DownTime   State
 10.200.0.254    4    100   302     285     0:47:05       ESTABLISHED

Router(config)# show ip bgp neighbors
BGP neighbor is 10.200.0.254, remote AS 100, local AS 100, internal link
  BGP version 4, remote router ID 200.1.4.1
  BGP state is ESTABLISHED, up for 0:49:04
  Last read 0:00:09, last sent 0:00:04
  Received 314 messages, 0 notifications
  Sent 297 messages, 0 notifications
  Minimum time between advertisement runs is 5 seconds
  Minimum time between origination runs is 15 seconds
  Hold time is 30, keepalive interval is 10 seconds
  Neighbor capabilities:
    Address family IPv4 unicast: advertised, received, supported
    Address family IPv6 unicast: not advertised, not received, not supported
    Route refresh capability: advertised (new), received (old & new), supported (old & new)
  For address family: IPv4 unicast
    BGP table version 10, advertised table version 10
    3 accepted prefixes
    Send default route is enabled
    Next-hop self is disabled
    Inbound policy: None
    Outbound policy: None
  Connections established 1, dropped 0
    Local host: 10.200.0.1, port: 32292
    Foreign host: 10.200.0.254, port: 179
    TTL is 254

Router(config)# show ip route bgp
IP Routing Table - 1 entries, 19 hidden, 2028 frees
Entries: 0 Connected, 0 Static, 0 RIP, 0 OSPF, 1 BGP
Codes: C - Connected, S - Static, R - RIP, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, B - BGP
       * - Candidate default, s - Summary
Timers: Age
B      10.11.0.0/24 [200/0] via 10.200.0.254, Tunnel3.0, 0:05:13