Spring中的aware接口详情
303
2022-09-28
IPSec ××× 访问控制(ipsec属于哪一层)
Cisco数据包处理流程
了解厂商数据包处理流程才能更好的利用ACL等策略以最高效的手段进行访问控制==cisco设备在在此有两个阶段==
IOS12.4之前
IOS12.4之后
案例一
before Release 12.3(8)T
在之前的版本12.4之前我们可以清晰的看到设备对于inbound流量,会在加密前匹配一次inbound方向的ACL,解密之后数据会再一次匹配inbound方向的ACL。已上图为例:
#已A路由器为例(仅允许10.1.1.0/24访问10.1.2.0/24):crypto map vpnmap 10 ipsec-isakmp set peer 192.168.2.1 set transform-set trans1 match address 101 interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 interface Serial1/0 ip address 192.168.1.1 255.255.255.0 ip access-group 150 in ip access-group 160 out crypto map vpnmap access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255 access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500 access-list 150 permit esp host 192.168.2.1 host 192.168.1.1 access-list 150 permit ip 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500 access-list 160 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
新的IPsec ××× 没有crypto access ACL访问控制:
新版本的IPsec ××× inbound流量只会在未解密之前匹配inbound ACL,解密后的流量不在匹配inbound ACL,此时解密后的流量会匹配crypto access ACL。已上图为例在新版本下配置无crypto access ACL的IPsec ×××访问控制:
#以A路由器为例(允许10.1.1.0/24访问10.1.2.0/24)crypto map vpnmap 10 ipsec-isakmp set peer 192.168.2.1 set transform-set trans1 match address 101 interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 interface Serial1/0 ip address 192.168.1.1 255.255.255.0 ip access-group 150 in ip access-group 160 out crypto map vpnmap access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255 access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500 access-list 150 permit esp host 192.168.2.1 host 192.168.1.1 access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500 access-list 160 permit esp host 192.168.1.1 host 192.168.2.1
新的IPsec ××× 有crypto access ACL访问控制
新版本的IPsec ××× inbound流量只会在未解密之前匹配inbound ACL,解密后的流量不在匹配inbound ACL,此时解密后的流量会匹配crypto access ACL。已上图为例在新版本下配置有crypto access ACL的IPsec ×××访问控制:
#以A路由器为例(仅允许10.1.1.0/24和10.1.2.0/24的telnet流量互通):crypto map vpnmap 10 ipsec-isakmp set peer 192.168.2.1 set transform-set trans1 set ip access-group 151 in set ip access-group 161 out match address 101 interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 interface Serial1/0 ip address 192.168.1.1 255.255.255.0 ip access-group 150 in ip access-group 160 out crypto map vpnmap access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255 access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500 access-list 150 permit esp host 192.168.2.1 host 192.168.1.1 access-list 151 permit tcp 10.1.2.0 0.0.0.255 eq telnet 10.1.1.0 0.0.0.255 access-list 151 permit tcp 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255 eq telnet access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500 access-list 160 permit esp host 192.168.1.1 host 192.168.2.1 access-list 161 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255 eq telnet access-list 161 permit ip 10.1.1.0 0.0.0.255 eq telnet 10.1.2.0 0.0.0.255
版权声明:本文内容由网络用户投稿,版权归原作者所有,本站不拥有其著作权,亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容,请联系我们jiasou666@gmail.com 处理,核实后本网站将在24小时内删除侵权内容。
发表评论
暂时没有评论,来抢沙发吧~