DVPN_配置注意事项以及配置思路
DVPN_配置注意事项
一、DVPN配置有两种组网方式
[Hub1-Tunnel2] tunnel-protocol dvpn gre
[Hub1-Tunnel2] vam client dvpn2hub1
[Hub1-Tunnel2] ip address 10.0.2.1 255.255.255.0
[Hub1-Tunnel2] source gigabitethernet 0/1
[Hub1-Tunnel2] ospf network-type broadcast
[Hub1-Tunnel2] ipsec profile vamp
[Hub1-Tunnel2] quit
[Hub1-Tunnel1] tunnel-protocol dvpn udp
[Hub1-Tunnel1] vam client dvpn1hub1
[Hub1-Tunnel1] ip address 10.0.1.1 255.255.255.0
[Hub1-Tunnel1] source gigabitethernet 0/1
[Hub1-Tunnel1] ospf network-type p2mp
[Hub1-Tunnel1] ipsec profile vamp
[Hub1-Tunnel1] quit
二、VAM Server上面的配置
1、在VAM server上创建账号，如果不用本地账号方式，可以通过配置AAA的方式来进行。
2、指定VAM Server上的监听IP地址（这个地址就是 VAM Server的接口地址）
3、创建VPN域、
配置预共享密钥、
配置验证方式、
指定vpn域的HUB地址（一般总部、分支都在一个vpn域里面,这里要注意在VAM上指定的HUB那个地址最好是HUB私网地址，如果指公网的地址一般情况下有问题。）
4、使能vpn域的VAM Server功能
三、HUB配置
1、创建vpn域的客户端、
指定VAM Server地址、
与共享密钥（这个和VAM Server上面配置的一样）、
配置本地用户名和密码（这里和VAM Server 上面创建的账号一样，或者与AAA上面的一致）、
使能客户端client enable
2、创建ipsec安全提议
[Hub1] ipsec transform-set vam[Hub1-ipsec-transform-set-vam] encapsulation-mode tunnel[Hub1-ipsec-transform-set-vam] transform esp
[Hub1-ipsec-transform-set-vam] esp encryption-algorithm des
[Hub1-ipsec-transform-set-vam] esp authentication-algorithm sha1
[Hub1-ipsec-transform-set-vam] quit
3、配置IKE对等体Peer、这里面只需要配置与共享密钥。
[Hub1] ike peer vam
[Hub1-ike-peer-vam] pre-shared-key abcde
[Hub1-ike-peer-vam] quit
4、配置IPsec安全框架。
[Hub1] ipsec profile vamp
[Hub1-ipsec-profile-vamp] transform-set vam
[Hub1-ipsec-profile-vamp] ike-peer vam
[Hub1-ipsec-profile-vamp] sa duration time-based 600
[Hub1-ipsec-profile-vamp] pfs dh-group2
[Hub1-ipsec-profile-vamp] quit
5、 配置DVPN隧道
# 配置VPN域1的隧道接口Tunnel1。如果采用UDP封装，则配置方法如下：
[Hub1] interface tunnel 1
[Hub1-Tunnel1] tunnel-protocol dvpn udp
[Hub1-Tunnel1] vam client dvpn1hub1
[Hub1-Tunnel1] ip address 10.0.1.1 255.255.255.0
[Hub1-Tunnel1] source ethernet 1/1
[Hub1-Tunnel1] ospf network-type p2mp
[Hub1-Tunnel1] ipsec profile vamp
[Hub1-Tunnel1] quit
# 如果采用GRE封装，则配置方法如下：
[Hub1] interface tunnel 1
[Hub1-Tunnel1] tunnel-protocol dvpn gre
[Hub1-Tunnel1] vam client dvpn1hub1
[Hub1-Tunnel1] ip address 10.0.1.1 255.255.255.0
[Hub1-Tunnel1] source ethernet 1/1
[Hub1-Tunnel1] ospf network-type p2mp
[Hub1-Tunnel1] ipsec profile vamp
[Hub1-Tunnel1] quit
6、配置私网路由信息
四、spoke配置
1、创建vpn域的客户端、
指定VAM Server地址、
与共享密钥（这个和VAM Server上面配置的一样）、
配置本地用户名和密码（这里和VAM Server 上面创建的账号一样，或者与AAA上面的一致）、
使能客户端client enable
2、创建ipsec安全提议
[Spoke2] ipsec transform-set vam
[Spoke2-ipsec-transform-set-vam] encapsulation-mode tunnel
[Spoke2-ipsec-transform-set-vam] transform esp
[Spoke2-ipsec-transform-set-vam] esp encryption-algorithm des
[Spoke2-ipsec-transform-set-vam] esp authentication-algorithm sha1
[Spoke2-ipsec-transform-set-vam] quit
3、 配置IKE对等体。
[Spoke2] ike peer vam
[Spoke2-ike-peer-vam] pre-shared-key abcde
[Spoke2-ike-peer-vam] quit
4、配置IPsec安全框架。
[Spoke2] ipsec profile vamp
[Spoke2-ipsec-profile-vamp] transform-set vam
[Spoke2-ipsec-profile-vamp] ike-peer vam
[Spoke2-ipsec-profile-vamp] sa duration time-based 600
[Spoke2-ipsec-profile-vamp] pfs dh-group2
[Spoke2-ipsec-profile-vamp] quit
5、 配置DVPN隧道
# 配置VPN域1的隧道接口Tunnel1。如果采用UDP封装，则配置方法如下：
[Spoke2] interface tunnel 1
[Spoke2-Tunnel1] tunnel-protocol dvpn udp
[Spoke2-Tunnel1] vam client dvpn1spoke2
[Spoke2-Tunnel1] ip address 10.0.1.4 255.255.255.0
[Spoke2-Tunnel1] source ethernet 1/1
[Spoke2-Tunnel1] ospf network-type p2mp
[Spoke2-Tunnel1] ospf dr-priority 0
[Spoke2-Tunnel1] ipsec profile vamp
[Spoke2-Tunnel1] quit
如果采用GRE封装，则配置方法如下：
[Spoke2] interface tunnel 1
[Spoke2-Tunnel1] tunnel-protocol dvpn gre
[Spoke2-Tunnel1] vam client dvpn1spoke2
[Spoke2-Tunnel1] ip address 10.0.1.4 255.255.255.0
[Spoke2-Tunnel1] source ethernet 1/1
[Spoke2-Tunnel1] ospf network-type p2mp
[Spoke2-Tunnel1] ospf dr-priority 0
[Spoke2-Tunnel1] ipsec profile vamp
[Spoke2-Tunnel1] quit
6、配置私网路由信息