IPsec トンネル

1.1 インターフェース IP設定

IP インターフェース

set network interface ethernet 1/1 layer3 ip <公認IP>
set network interface ethernet 1/2 layer3 ip<内部プライベートIP>

インターフェース zone 割当

-> trust
set zone trust network layer3 ethernet1/2

-> untrust
set zone Untrust network layer3 ethernet1/1

トンネルインターフェース

set network interface tunnel units tunnel.1

ZONE作成

set zone [ZONE-NAME] network layer3 tunnel.1

ZONE ルール(rule) 設定(ex> any any)

set rulebase security rules [RULE-NAME] from [ZONE-NAME]
set rulebase security rules [RULE-NAME] to trust
set rulebase security rules [RULE-NAME] source any
set rulebase security rules [RULE-NAME] destination any
set rulebase security rules [RULE-NAME] service any
set rulebase security rules [RULE-NAME] application any
set rulebase security rules [RULE-NAME] action allow
set rulebase security rules [RULE-NAME] log-end yes

※ move rulebase security rules [RULE-NAME] top (ルール修正時)

1.2 ルーティング設定

ルーティング用インターフェース宣言

set network virtual-router default interface [ ethernet1/1 ethernet1/2 tunnel.1 ]

外部ルーティング

set network virtual-router default routing-table ip static-route default nexthop ip-address <公認 IP GW>
set network virtual-router default routing-table ip static-route default interface (外部インターフェース) ex> Ethernet 1/1
set network virtual-router default routing-table ip static-route default metric 10
set network virtual-router default routing-table ip static-route default destination 0.0.0.0/0
set network virtual-router default routing-table ip static-route default route-table unicast

内部ルーティング or traffic-selector

set network virtual-router default routing-table ip static-route [ローカルプライベートIP-NAME] metric 10
set network virtual-router default routing-table ip static-route [ローカルプライベートIP-NAME] destination  172.16.1.0/24 [ローカルプライベートIP 目的地]
set network virtual-router default routing-table ip static-route [ローカルプライベートIP-NAME] nexthop ip-address <プライベート IP peer>
set network virtual-router default routing-table ip static-route [ローカルプライベートIP-NAME] route-table unicast

peer トンネルプライベートルーティング(proxy-id)

set network virtual-router default routing-table ip static-route [IPSEC-NAME] interface tunnel.1
set network virtual-router default routing-table ip static-route [IPSEC-NAME] metric 10
set network virtual-router default routing-table ip static-route [IPSEC-NAME] destination [Peer 内部帯域]
set network virtual-router default routing-table ip static-route [IPSEC-NAME] route-table unicast

1.3 IKEv1/2 設定

IKEv1

  • グループ: 2
  • 認証方式: sha-1
  • 暗号化方式: aes-128
  • lifetime: 28800
set network ike crypto-profiles ike-crypto-profiles [IPSECv1-NAME] hash sha1
set network ike crypto-profiles ike-crypto-profiles [IPSECv1-NAME] dh-group group2
set network ike crypto-profiles ike-crypto-profiles [IPSECv1-NAME] encryption aes-128-cbc
set network ike crypto-profiles ike-crypto-profiles [IPSECv1-NAME] lifetime seconds 28800

set network ike gateway [IPSEC-GWNAME] authentication pre-shared-key key 1234567890
set network ike gateway [IPSEC-GWNAME] protocol ikev1 dpd enable yes
set network ike gateway [IPSEC-GWNAME] protocol ikev1 ike-crypto-profile [IPSECv1-NAME]
set network ike gateway [IPSEC-GWNAME] protocol ikev2 dpd enable yes
set network ike gateway [IPSEC-GWNAME] protocol version ikev1
set network ike gateway [IPSEC-GWNAME] local-address ip [Local 公認IP]
set network ike gateway [IPSEC-GWNAME] local-address interface ethernet1/1
set network ike gateway [IPSEC-GWNAME] protocol-common nat-traversal enable no
set network ike gateway [IPSEC-GWNAME] protocol-common fragmentation enable no
set network ike gateway [IPSEC-GWNAME] peer-address ip [Peer 公認IP]

IKEv2

  • プロトコル: esp
  • 認証方式: sha-1
  • 暗号化方式: aes-128
  • lifetime: 3600
set network ike crypto-profiles ipsec-crypto-profiles [IPSECv2-NAME] esp authentication sha1
set network ike crypto-profiles ipsec-crypto-profiles [IPSECv2-NAME] esp encryption aes-128-cbc
set network ike crypto-profiles ipsec-crypto-profiles [IPSECv2-NAME] lifetime seconds 3600
set network ike crypto-profiles ipsec-crypto-profiles [IPSECv2-NAME] dh-group no-pfs

set network tunnel ipsec [IPSEC-TNAME] auto-key ike-gateway [IPSEC-GWNAME]
set network tunnel ipsec [IPSEC-TNAME] auto-key proxy-id [PROXY-ID-NAME] protocol any
set network tunnel ipsec [IPSEC-TNAME] auto-key proxy-id [PROXY-ID-NAME] local [Local 内部帯域]
set network tunnel ipsec [IPSEC-TNAME] auto-key proxy-id [PROXY-ID-NAME] remote [Peer 内部帯域]
set network tunnel ipsec [IPSEC-TNAME] auto-key ipsec-crypto-profile [IPSECv2-NAME]
set network tunnel ipsec [IPSEC-TNAME] tunnel-monitor enable no
set network tunnel ipsec [IPSEC-TNAME] tunnel-interface tunnel.1

トンネル作成 (phase-1)

test vpn ike-sa gateway [IPSEC-GWNAME]

トンネル作成 (phase-2)

test vpn ipsec-sa tunnel [IPSEC-TNAME]:[PROXY-ID-NAME]

1.4 IKEv1/2 トンネル確認

IKEv1/2 確認

show vpn flow name [IPSEC-NAME]:[PROXY-ID-NAME]

コンピグモード進入

newen@PA-220-Active(active)> configure
Entering configuration mode
[edit]

設定完了

newen@PA-220-Active(active)# commit

に対する検索結果は~件です。 ""

    に対する検索結果がありません。 ""

    処理中...