作者infosec (InfoSEC)
看板Network
标题Re: [除错] Site to Site VPN(更新资讯)
时间Mon Jan 17 17:08:18 2011
上周比较忙 没办法做lab
今天稍微喘口气 测试了一下 看来是ok的
我是用Trust建VPN, 用Untrust当测试的网段
1.1.1.1/24-Untrust-5GT1-Trust-9.9.9.1---9.9.9.2-Trust-5GT2-Untrust-2.2.2.2/24
(vpnspoke) (vpnhub)
config of vpnspoke:
set interface trust ip 9.9.9.1/24
set interface untrust ip 1.1.1.1/24
set interface tunnel.1 ip unnumbered interface trust
set address "Untrust" "1.1.1.0/24" 1.1.1.0 255.255.255.0
set ike gateway "test" address 9.9.9.2 Main outgoing-interface "trust"
preshare "hashed" sec-level standard
set vpn "test" gateway "test" no-replay tunnel idletime 0 sec-level standard
set vpn "test" monitor
set vpn "test" id 1 bind interface tunnel.1
set policy id 1 from "Untrust" to "Trust" "1.1.1.0/24" "Any" "ANY" permit
log
set route 0.0.0.0/0 interface tunnel.1 preference 20
#这是重点#
#这里没加的是VPN Peer的route, 实际上接上Internet会需要一笔"host route"
config of vpnhub:
set interface trust ip 9.9.9.2/24
set interface untrust ip 2.2.2.2/24
set interface tunnel.1 ip unnumbered interface trust
set address "Trust" "1.1.1.0/24" 1.1.1.0 255.255.255.0
set ike gateway "test" address 9.9.9.1 Main outgoing-interface "trust"
preshare "hashed" sec-level standard
set vpn "test" gateway "test" no-replay tunnel idletime 0 sec-level standard
set vpn "test" monitor
set vpn "test" id 1 bind interface tunnel.1
set policy id 1 from "Trust" to "Trust" "1.1.1.0/24" "Any" "ANY" nat src
permit log
set route 0.0.0.0/0 interface trust gateway 9.9.9.254 #这里就要加default#
set route 1.1.1.0/24 interface tunnel.1
从vpnspoke的policy log 可以看到1.1.1.2上 Internet时没有NAT 正常存取
从vpnhub的policy log则看到1.1.1.2在上Internet时，source会变成9.9.9.2
--
※ 发信站: 批踢踢实业坊(ptt.cc)
◆ From: 203.70.214.8
※ 编辑: infosec 来自: 203.70.214.8 (01/17 17:09)
1F：→ wst2080:M起来 这个很有帮助 辛苦啦!!! 01/17 17:19