.
This commit is contained in:
commit
46c5ff0cec
62
FlexVPN/FlexVPN_Remote_Access_AnyConnect.txt
Normal file
62
FlexVPN/FlexVPN_Remote_Access_AnyConnect.txt
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
R1(config)#ip http server
|
||||||
|
|
||||||
|
R1(config)#crypto pki server R1CA
|
||||||
|
R1(cs-server)#issuer-name cn="R1CA"
|
||||||
|
R1(cs-server)#grant auto
|
||||||
|
R1(cs-server)#no shutdown
|
||||||
|
|
||||||
|
R1(config)#ip domain name NWL.LAB
|
||||||
|
R1(config)#crypto pki trustpoint R1CLIENT
|
||||||
|
R1(ca-trustpoint)#enrollment url http://192.168.1.1
|
||||||
|
R1(ca-trustpoint)#subject-name cn=R1CLIENT.CONTOSO.COM
|
||||||
|
R1(config)#crypto pki authenticate R1CLIENT
|
||||||
|
R1(config)#crypto pki enroll R1CLIENT
|
||||||
|
|
||||||
|
|
||||||
|
R1(config)#aaa new-model
|
||||||
|
|
||||||
|
R1(config)#aaa authentication login AAA_AUTHENTICATION_LOGIN local
|
||||||
|
R1(config)#aaa authorization network AAA_AUTHORIZATION_NETWORK local
|
||||||
|
|
||||||
|
R1(config)#username test password mojehaslo
|
||||||
|
|
||||||
|
R1(config)#crypto ikev2 authorization policy IKEV2_AUTHORIZATION_POLICY
|
||||||
|
R1(config-ikev2-author-policy)#pool VPN_POOL
|
||||||
|
R1(config-ikev2-author-policy)#def-domain CONTOSO.COM
|
||||||
|
R1(config-ikev2-author-policy)#route set remote ipv4 1.1.1.1 255.255.255.255
|
||||||
|
R1(config-ikev2-author-policy)#dns 1.1.1.1
|
||||||
|
R1(config)#ip local pool VPN_POOL 192.168.10.5 192.168.10.10
|
||||||
|
|
||||||
|
|
||||||
|
R1(config)#crypto ikev2 proposal IKEV2_PROPOSAL
|
||||||
|
R1(config-ikev2-proposal)#encryption aes-cbc-256
|
||||||
|
R1(config-ikev2-proposal)#integrity sha256
|
||||||
|
R1(config-ikev2-proposal)#group 14
|
||||||
|
|
||||||
|
R1(config)#crypto ikev2 policy default
|
||||||
|
R1(config-ikev2-policy)#proposal IKEV2_PROPOSAL
|
||||||
|
|
||||||
|
R1(config)#crypto ikev2 profile IKEV2_PROFILE
|
||||||
|
R1(config-ikev2-profile)#match identity remote key-id *$AnyConnectClient$*
|
||||||
|
R1(config-ikev2-profile)#authentication local rsa-sig
|
||||||
|
R1(config-ikev2-profile)#authentication remote anyconnect-eap aggregate
|
||||||
|
R1(config-ikev2-profile)#pki trustpoint R1-CLIENT
|
||||||
|
R1(config-ikev2-profile)#aaa authentication anyconnect-eap AAA_AUTHENTICATION_LOGIN
|
||||||
|
R1(config-ikev2-profile)#aaa authorization group anyconnect-eap list AAA_AUTHORIZATION_NETWORK IKEV2_AUTHORIZATION_POLICY
|
||||||
|
R1(config-ikev2-profile)#virtual-template 1
|
||||||
|
|
||||||
|
R1(config)#crypto ipsec transform-set TRANSFORM_SET esp-aes 256 esp-sha256-hmac
|
||||||
|
R1(cfg-crypto-trans)#mode tunnel
|
||||||
|
|
||||||
|
R1(config)#crypto ipsec profile IKEV2_PROFILE
|
||||||
|
R1(ipsec-profile)#set transform-set TRANSFORM_SET
|
||||||
|
R1(ipsec-profile)#set ikev2-profile IKEV2_PROFILE
|
||||||
|
|
||||||
|
R1(config)#interface Virtual-Template1 type tunnel
|
||||||
|
R1(config-if)#ip unnumbered Loopback0
|
||||||
|
R1(config-if)#ip mtu 1400
|
||||||
|
R1(config-if)#tunnel mode ipsec ipv4
|
||||||
|
R1(config-if)#tunnel protection ipsec profile IKEV2_PROFILE
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
37
FlexVPN/flexvpn1.txt
Normal file
37
FlexVPN/flexvpn1.txt
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer R2
|
||||||
|
address 198.51.100.2
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 198.51.100.2 255.255.255.255
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 proposal ikeprop1
|
||||||
|
integrity sha256 sha384 sha512
|
||||||
|
group 14 15
|
||||||
|
encryption aes-cbc-128 aes-cbc-256
|
||||||
|
|
||||||
|
crypto ikev2 policy ikepol1
|
||||||
|
proposal ikeprop1
|
||||||
|
|
||||||
|
ip access-list extended ACLR2
|
||||||
|
permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto map CM1 10 ipsec-isakmp
|
||||||
|
match address ACLR2
|
||||||
|
set peer 198.51.100.2
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
int g0/1
|
||||||
|
crypto map CM1
|
||||||
|
|
||||||
87
FlexVPN/flexvpn2.txt
Normal file
87
FlexVPN/flexvpn2.txt
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
Dla R1 i R2:
|
||||||
|
|
||||||
|
no int tunnel 1
|
||||||
|
no router ospf 1
|
||||||
|
|
||||||
|
|
||||||
|
Dla R1:
|
||||||
|
interface Loopback1
|
||||||
|
ip address 172.16.1.1 255.255.255.0
|
||||||
|
|
||||||
|
############################################
|
||||||
|
Dla R1:
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer R2
|
||||||
|
address 198.51.100.2
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 198.51.100.2 255.255.255.255
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer R1
|
||||||
|
address 192.0.2.1
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 192.0.2.1 255.255.255.255
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Dla R1:
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
int tun 12
|
||||||
|
ip add 10.0.12.1 255.255.255.0
|
||||||
|
tunnel source 192.0.2.1
|
||||||
|
tunnel destination 198.51.100.2
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
tunnel mode ipsec ipv4
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
int tun 12
|
||||||
|
ip add 10.0.12.2 255.255.255.0
|
||||||
|
tunnel source 198.51.100.2
|
||||||
|
tunnel destination 192.0.2.1
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
tunnel mode ipsec ipv4
|
||||||
|
|
||||||
|
|
||||||
|
Dla R1:
|
||||||
|
router eigrp 1
|
||||||
|
network 10.0.12.0 0.0.0.255
|
||||||
|
network 172.16.1.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
router eigrp 1
|
||||||
|
network 10.0.12.0 0.0.0.255
|
||||||
|
network 172.16.2.0 0.0.0.255
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
105
FlexVPN/flexvpn3.txt
Normal file
105
FlexVPN/flexvpn3.txt
Normal file
@ -0,0 +1,105 @@
|
|||||||
|
FLexVPN HUB-SPOKE
|
||||||
|
Dla R2, R3, R4:
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer R1
|
||||||
|
address 192.0.2.1
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 192.0.2.1 255.255.255.255
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
#####
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
int loopback 3
|
||||||
|
ip add 2.2.2.2 255.255.255.255
|
||||||
|
|
||||||
|
Dla R3:
|
||||||
|
int loopback 3
|
||||||
|
ip add 3.3.3.3 255.255.255.255
|
||||||
|
|
||||||
|
Dla R4:
|
||||||
|
int loopback 3
|
||||||
|
ip add 4.4.4.4 255.255.255.255
|
||||||
|
|
||||||
|
Dla wszystkich Spoke (R2, R3, R4):
|
||||||
|
int tun 12
|
||||||
|
ip unnumbered loopback 3
|
||||||
|
tunnel source g0/1
|
||||||
|
tunnel destination 192.0.2.1
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
|
||||||
|
#####
|
||||||
|
Koncentrator (R1):
|
||||||
|
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer ANYROUTER
|
||||||
|
address 0.0.0.0
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 0.0.0.0 0.0.0.0
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
virtual-template 1
|
||||||
|
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
int loopback 3
|
||||||
|
ip add 1.1.1.1 255.255.255.255
|
||||||
|
|
||||||
|
interface virtual-template 1 type tunnel
|
||||||
|
tunnel source g0/1
|
||||||
|
ip unnumbered loopback 3
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
|
||||||
|
####
|
||||||
|
Dla R1:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.1 0.0.0.0
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
router eigrp 1
|
||||||
|
network 2.2.2.2 0.0.0.0
|
||||||
|
network 172.16.2.0 0.0.0.255
|
||||||
|
network 192.168.2.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R3:
|
||||||
|
router eigrp 1
|
||||||
|
network 3.3.3.3 0.0.0.0
|
||||||
|
network 172.16.3.0 0.0.0.255
|
||||||
|
network 192.168.3.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R4:
|
||||||
|
router eigrp 1
|
||||||
|
network 4.4.4.4 0.0.0.0
|
||||||
|
network 172.16.4.0 0.0.0.255
|
||||||
|
network 192.168.4.0 0.0.0.255
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
116
FlexVPN/flexvpn4.txt
Normal file
116
FlexVPN/flexvpn4.txt
Normal file
@ -0,0 +1,116 @@
|
|||||||
|
FLexVPN HUB-SPOKE
|
||||||
|
Dla R2, R3, R4:
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer R1
|
||||||
|
address 192.0.2.1
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 192.0.2.1 255.255.255.255
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
aaa authorization group override psk list AUTHPOLICY1 AUTHPOLICY1
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
aaa new-model
|
||||||
|
aaa authorization network default local
|
||||||
|
|
||||||
|
crypto ikev2 authorization policy AUTHPOLICY1
|
||||||
|
route set interface
|
||||||
|
|
||||||
|
|
||||||
|
#####
|
||||||
|
|
||||||
|
|
||||||
|
Dla wszystkich Spoke (R2, R3, R4):
|
||||||
|
int tun 12
|
||||||
|
ip address negotiated
|
||||||
|
tunnel source g0/1
|
||||||
|
tunnel destination 192.0.2.1
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
|
||||||
|
#####
|
||||||
|
Koncentrator (R1):
|
||||||
|
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer ANYROUTER
|
||||||
|
address 0.0.0.0
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
int loopback 3
|
||||||
|
ip add 1.1.1.1 255.255.255.0
|
||||||
|
|
||||||
|
interface virtual-template 1 type tunnel
|
||||||
|
tunnel source g0/1
|
||||||
|
ip unnumbered loopback 3
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
|
||||||
|
|
||||||
|
ip local pool PULAIP 1.1.1.2 1.1.1.10
|
||||||
|
|
||||||
|
aaa new-model
|
||||||
|
aaa authorization network default local
|
||||||
|
|
||||||
|
crypto ikev2 authorization policy AUTHPOLICY1
|
||||||
|
pool PULAIP
|
||||||
|
route set interface
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 0.0.0.0 0.0.0.0
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
virtual-template 1
|
||||||
|
aaa authorization group override psk list AUTHPOLICY1 AUTHPOLICY1
|
||||||
|
|
||||||
|
|
||||||
|
####
|
||||||
|
Dla R1:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.2.0 0.0.0.255
|
||||||
|
network 192.168.2.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R3:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.3.0 0.0.0.255
|
||||||
|
network 192.168.3.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R4:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.4.0 0.0.0.255
|
||||||
|
network 192.168.4.0 0.0.0.255
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
138
FlexVPN/flexvpn5.txt
Normal file
138
FlexVPN/flexvpn5.txt
Normal file
@ -0,0 +1,138 @@
|
|||||||
|
FLexVPN SPOKE-SPOKE
|
||||||
|
Dla R2, R3, R4:
|
||||||
|
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer ANYPEER
|
||||||
|
address 0.0.0.0
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 0.0.0.0 0.0.0.0
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
aaa authorization group override psk list AUTHPOLICY1 AUTHPOLICY1
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
aaa new-model
|
||||||
|
aaa authorization network default local
|
||||||
|
|
||||||
|
crypto ikev2 authorization policy AUTHPOLICY1
|
||||||
|
route set interface
|
||||||
|
|
||||||
|
|
||||||
|
#####
|
||||||
|
|
||||||
|
|
||||||
|
Dla wszystkich Spoke (R2, R3, R4):
|
||||||
|
int tun 12
|
||||||
|
ip address negotiated
|
||||||
|
tunnel source g0/1
|
||||||
|
tunnel destination 192.0.2.1
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
ip nhrp network-id 1
|
||||||
|
ip nhrp shortcut virtual-template 12
|
||||||
|
|
||||||
|
|
||||||
|
int virtual-template 12 type tunnel
|
||||||
|
ip unnumbered tunnel 12
|
||||||
|
tunnel source g0/1
|
||||||
|
ip nhrp network-id 1
|
||||||
|
ip nhrp shortcut virtual-template 12
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#####
|
||||||
|
Koncentrator (R1):
|
||||||
|
|
||||||
|
|
||||||
|
int loopback 3
|
||||||
|
ip add 1.1.1.1 255.255.255.0
|
||||||
|
|
||||||
|
ip local pool PULAIP 1.1.1.2 1.1.1.10
|
||||||
|
|
||||||
|
aaa new-model
|
||||||
|
aaa authorization network default local
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 authorization policy AUTHPOLICY1
|
||||||
|
pool PULAIP
|
||||||
|
route set interface
|
||||||
|
|
||||||
|
|
||||||
|
crypto ikev2 keyring KEYR1
|
||||||
|
peer ANYPEER
|
||||||
|
address 0.0.0.0
|
||||||
|
pre-shared-key local Cisco
|
||||||
|
pre-shared-key remote Cisco
|
||||||
|
|
||||||
|
crypto ikev2 profile Profil1
|
||||||
|
match identity remote address 0.0.0.0 0.0.0.0
|
||||||
|
authentication local pre-share
|
||||||
|
authentication remote pre-share
|
||||||
|
keyring local KEYR1
|
||||||
|
virtual-template 1
|
||||||
|
aaa authorization group override psk list AUTHPOLICY1 AUTHPOLICY1
|
||||||
|
|
||||||
|
crypto ipsec transform-set TR1 esp-sha256-hmac esp-aes
|
||||||
|
|
||||||
|
crypto ipsec profile IPprof1
|
||||||
|
set transform-set TR1
|
||||||
|
set ikev2-profile Profil1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
interface virtual-template 1 type tunnel
|
||||||
|
tunnel source g0/1
|
||||||
|
ip unnumbered loopback 3
|
||||||
|
tunnel protection ipsec profile IPprof1
|
||||||
|
ip nhrp network-id 1
|
||||||
|
ip nhrp redirect
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
####
|
||||||
|
Dla R1:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R2:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.2.0 0.0.0.255
|
||||||
|
network 192.168.2.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R3:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.3.0 0.0.0.255
|
||||||
|
network 192.168.3.0 0.0.0.255
|
||||||
|
|
||||||
|
Dla R4:
|
||||||
|
router eigrp 1
|
||||||
|
network 1.1.1.0 0.0.0.255
|
||||||
|
network 172.16.4.0 0.0.0.255
|
||||||
|
network 192.168.4.0 0.0.0.255
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
91
ip_source_guard.txt
Normal file
91
ip_source_guard.txt
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
Router:
|
||||||
|
hostname R1
|
||||||
|
!
|
||||||
|
ip dhcp pool MY_POOL
|
||||||
|
network 192.168.1.0 255.255.255.0
|
||||||
|
!
|
||||||
|
ip cef
|
||||||
|
!
|
||||||
|
interface FastEthernet0/0
|
||||||
|
ip address 192.168.1.254 255.255.255.0
|
||||||
|
!
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
Przełącznik (router podłączony na porcie g0/1):
|
||||||
|
hostname SW1
|
||||||
|
!
|
||||||
|
ip dhcp snooping vlan 1
|
||||||
|
no ip dhcp snooping information option
|
||||||
|
ip dhcp snooping
|
||||||
|
!
|
||||||
|
interface GigabitEthernet0/1
|
||||||
|
switchport mode access
|
||||||
|
spanning-tree portfast
|
||||||
|
ip dhcp snooping trust
|
||||||
|
!
|
||||||
|
interface GigabitEthernet0/2
|
||||||
|
switchport mode access
|
||||||
|
spanning-tree portfast
|
||||||
|
!
|
||||||
|
interface GigabitEthernet0/3
|
||||||
|
switchport mode access
|
||||||
|
spanning-tree portfast
|
||||||
|
!
|
||||||
|
interface GigabitEthernet0/4
|
||||||
|
switchport mode access
|
||||||
|
spanning-tree portfast
|
||||||
|
!
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
Konfigurujemy "IP Source Guard" dla komputera podłączonego na porcie g0/2:
|
||||||
|
SW1(config)#interface GigabitEthernet 0/2
|
||||||
|
SW1(config-if)#ip verify source
|
||||||
|
|
||||||
|
SW1#show ip verify source
|
||||||
|
Interface Filter-type Filter-mode IP-address Mac-address Vlan Log
|
||||||
|
--------- ----------- ----------- --------------- ----------------- ---- ---
|
||||||
|
Gi0/2 ip active 192.168.1.1 1 disabled
|
||||||
|
|
||||||
|
|
||||||
|
SW1 zezwala teraz tylko na źródłowy adres IP 192.168.1.1 (bo taki PC dostanie pierwszy z brzegu) na interfejsie GigabitEthernet 0/2. Pole adresu MAC jest puste, także w tej chwili przełącznik sprawdza tylko źródłowy adres IP. Można jednak również sprawdzać źródłowy adres MAC.
|
||||||
|
Do tego celu trzeba wykorzystać jeszcze mechanizm port-security:
|
||||||
|
SW1(config)#interface GigabitEthernet 0/2
|
||||||
|
SW1(config-if)#switchport port-security
|
||||||
|
SW1(config-if)#ip verify source port-security
|
||||||
|
|
||||||
|
SW1#show ip verify source
|
||||||
|
Interface Filter-type Filter-mode IP-address Mac-address Vlan Log
|
||||||
|
--------- ----------- ----------- --------------- ----------------- ---- ---
|
||||||
|
Gi0/2 ip-mac active 192.168.1.1 00:11:22:44:33:AA 1 disabled
|
||||||
|
|
||||||
|
|
||||||
|
Załóżmy, że skonfigurujemy na porcie G0/3 kolejny PC, który będzie mieć statycznie przypisane dane adresowe:
|
||||||
|
SW1(config)#interface GigabitEthernet 0/3
|
||||||
|
SW1(config-if)#switchport port-security
|
||||||
|
SW1(config-if)#ip verify source port-security
|
||||||
|
|
||||||
|
SW1#show ip verify source
|
||||||
|
Interface Filter-type Filter-mode IP-address Mac-address Vlan Log
|
||||||
|
--------- ----------- ----------- --------------- ----------------- ---- ---
|
||||||
|
Gi0/2 ip-mac active 192.168.1.1 00:11:22:44:33:AA 1 disabled
|
||||||
|
Gi0/3 ip-mac active deny-all deny-all 1
|
||||||
|
|
||||||
|
Jeżeli teraz z tego powyższego komputera spróbujemy wykonać jakąkolwiek transmisję (choćby ping), to nie pwoiedzie się, będzie blokowane.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Możemy również przypisać statycznie adres mac oraz adres IP do zadanego portu, np. dla portu G0/4:
|
||||||
|
SW1(config)#interface GigabitEthernet 0/4
|
||||||
|
SW1(config-if)#switchport port-security
|
||||||
|
SW1(config-if)#ip verify source port-security
|
||||||
|
SW1(config)#ip source binding 0011.aabb.0088 vlan 1 192.168.1.200 interface GigabitEthernet 0/4
|
||||||
|
|
||||||
|
|
||||||
|
SW1#show ip verify source
|
||||||
|
Interface Filter-type Filter-mode IP-address Mac-address Vlan Log
|
||||||
|
--------- ----------- ----------- --------------- ----------------- ---- ---
|
||||||
|
Gi0/2 ip-mac active 192.168.1.1 00:11:22:44:33:AA 1 disabled
|
||||||
|
Gi0/3 ip-mac active deny-all deny-all 1
|
||||||
|
Gi0/4 ip-mac active 192.168.1.200 00:16:C7:BE:0E:C8 1 disabled
|
||||||
Loading…
Reference in New Issue
Block a user