±¾ÎÄ×÷ÕߣºÌï˼Ñî 

GA»Æ½ð¼×ÍøÂç¼¼Êõ·þÎñ²¿»¥ÁªÍø·þÎñÖÐÐÄ

ý½é

ÔÚÉÏһƪ¡¶VPN¼¼Êõdz̸֮ÈôºÎ²¿ÊðÔ¶³Ì°ì¹«ÍøÂç¡·ÖÐ£¬×÷ÕßΪ¸÷ÈË·ÖÏíÁ˶˵½Õ¾µãVPN¼¼Êõ£¬¸Ã¼¼ÊõÖØҪʹÓÃÔÚÔ¶³Ì°ì¹«ÈËÔ±ºÍÆóÒµÍøÂ绥ͨ³¡¾°£¬¶øÕ¾µãµ½Õ¾µãVPN¼¼Êõ³£ÓÃÓÚ×ܲ¿Óë·ÖÖ§Ö®¼äµÄÍøÂ绥ͨ£¬Í¨¹ýÀûÓÃ×éÖ¯ÒÑÓеĻ¥ÁªÍø³ö¿Ú£¬Ê¹ÓÃVPN¼¼ÊõÐé¹¹³öÒ»Ìõ“רÏß”£¬½«ÆóÒµµÄ·ÖÖ§»ú¹¹ºÍ×ܲ¿ÏνÓÆðÀ´£¬×é³ÉÒ»¸ö´óµÄ¾ÖÓòÍø¡£Õ¾µãµ½Õ¾µãVPNÖØÒªÔ̺¬IPSec VPN¡¢L2TP VPN¡¢L2TP over IPSec VPN¡¢GRE VPN¡¢GRE over IPSec VPN¡¢SSL VPNµÈ¡£IPSec VPN¼¼ÊõÒòÆäÓµÓа²È«ÐԸߡ¢³É±¾µÍ¡¢²¿Êð½Ã½Ý¡¢À©´óÐԺõÅ×ŵã£¬ÒѳÉΪÆóÒµÕ¾µã¼äVPN²¿ÊðµÄµÚ Ò»¼¼ÊõÑ¡Ôñ¡£

IPSec VPN²»ÊÇÒ»¸öµ¥¶ÀµÄºÍ̸£¬¶øÊÇÓÉÒ»×éºÍ̸×é³É£¬ÒòÆäÔ̺¬µÄ¼¼Êõ¶à¡¢¼¼Êõ¼ä¹ØÁª¹Øϵ¶à£¬ºÃ¶à°éÂÂÎÞ·¨°ÑIPSec VPN¼¼ÊõÀí½â͸¡£±¾ÎÄÊ×ÏÈͨ¹ýÊáÀíIPSec VPNÖи÷¼¼ÊõµÄÓô¦¼°Ö®¼äµÄ¹ØÁª¹ØϵԮÊÖ¸÷ÈËÀí½â¼¼ÊõµÀÀí£¬Æä´ÎΪ¸÷È˽éÉÜIPSec VPNµÄһЩ¸ß¼¶Ö°ÄÜ£¬×îºóΪ¸÷ÈË·ÖÏíµäÐÍʵ¼Ê³¡¾°ºÍ¹ÊÕÏÅŲ鲽Öè¡£µ«Ô¸±¾ÎÄ¿ÉÄÜÔ®ÊÖ¸÷λ¶ÁÕß°ÑIPSec VPN¼¼Êõѧ͸¡¢ÓÃÁìÂÔ£¬ÄÍÐĶÁÍêÕâƪÎÄÕÂÏàÐÅÄã»áÓв»Ò»ÑùµÄÊÕ³É¡£

GA»Æ½ð¼×Ö§³ÖIPSec VPNµÄÉ豸ÓкöàÖÖ£¬·ÖÆçÉ豸¶Ô¸÷IPSec VPN¼¼ÊõµÄÖ§³ÖÇé¿öÂÔÓвî¾à£¬±¾ÎÄÒÔGA»Æ½ð¼×Íø¹ØÉ豸ΪÀý¸ø¸÷È˽â˵£¬Èç¶ÁÕßʹÓÃÆäËûÉ豸ӭ½ÓÁªÏµGA»Æ½ð¼×¹¤³Ìʦ»òµ½GA»Æ½ð¼×¹ÙÍø²éÎÊ£¬¸Ð¼¤¡£

 

ͼ1£º³£¼ûÆóÒµVPN½ÓÈëÍØÆËÄ£ÐÍ

IPSec VPN»ù´¡²ÎÊý

IPSecÖÐͨѶ˫·½³ÉÁ¢µÄÏνӽÐ×ö°²È«¹ØÁª£¨IPSec SA£©£¬Ë«·½Í¨¹ý²ÎÊýЭÉÌʵÏÖIPSec SA³ÉÁ¢ºó£¬Í¨¹ýIPSec SA´«Êä¼ÓÃܵÄÊý¾Ý±¨ÎĽøÐÐͨѶ¡£ËùÒÔÁ½¸ö¶ÔµÈÌå¼äÒªÏëͨ¹ýIPSec VPNͨѶ£¬Ê×ÏÈÒª³ÉÁ¢IPSec SA¡£ÔÚ½øÐÐIPSec SA³ÉÁ¢Ê±¶ÔµÈÌå¼äÒª½øÐÐIPSec SA²ÎÊýЭÉÌ£¬Á½¶Ë²ÎÊýÒ»Ñùʱ²Å»á³ÉÁ¢³É¹¦¡£

 

ͼ2£ºIPSec VPN»ù´¡²ÎÊý

IPSec SAÌìÉú·½Ê½

ÊÖ¶¯Ö¸¶¨ÌìÉúIPSec SA

¶ÔµÈÌåͨ¹ýÊÖ¶¯Ö¸¶¨IPSec SAЭÉ̲ÎÊýÌìÉúIPSec SA£¬IPSec SA³ÉÁ¢ºóûÓÐÉú¼ÆÖÜÆÚÏÞ¶È£¬ÓÀ²»Íâʱ£¬³ý·ÇÊÖ¹¤É¾³ý£¬Òò¶ø´æÔÚ°²È«Òþ»¼¡£Í¨³£ÍƼöÔÚ¶ÔµÈÌåÊýÁ¿½ÏÉÙÇÒÎÞ·¨Í¨¹ýIKEЭÉ̳ÉÁ¢IPSec SA³¡¾°ÏÂʹÓÃ¡£

IKEЭÉÌÌìÉúIPSec SA

IKEÓÃÓÚ¶¯Ì¬³ÉÁ¢²¢ÊµÊ±ÊØ»¤IPSec SA¡£IKEͨ¹ýÁ½¸ö½×¶ÎÀ´³ÉÁ¢IPSec SA£¬µÚÒ»½×¶ÎÊ×ÏÈҪЭÉ̳ÉÁ¢IKE SA£¬µÚ¶þ½×¶Îͨ¹ýIKE SAЭÉ̳ÉÁ¢IPSec SA¡£

IKEЭÉÌÌìÉúIPSec SA±ÈÊÖ¶¯Ö¸¶¨ÌìÉúIPSec SA´æÔÚÒÔÏÂÓÅÊÆ£º

50. ºÏÓó¡¾°·á˶£ºÊÖ¶¯Ö¸¶¨·½Ê½±ØÐë¶ÔµÈÌåÁ½¶Ë¶¼Óй̶¨µÄ¹«ÍøIPµØÖ·£¬ÈçÒ»¶Ë¶ÔµÈÌ幫ÍøIPµØÖ·²»¹Ì¶¨±ØÐëʹÓÃIKEЭÉÌ·½Ê½
    £»
50. ½µµÍÅäÖø´ÔӶȣºÊÖ¶¯Ö¸¶¨·½Ê½±ØÒªÊÖ¶¯ÅäÖÃSPI¡¢ÃÜÔ¿µÈÐÅÏ¢£¬ÔÚ¶ÔµÈÌå½Ï¶àµÄ³¡¾°ÅäÖÃÁ¿½Ï´ó¶ø²»±ãÓÚÊØ»¤£¬IKEЭÉÌ·½Ê½»áͨ¹ýIKE SAÀ´ÌìÉúºÍÊØ»¤ÕâЩÐÅÏ¢£¬½µµÍÅäÖø´ÔӶȼ°ÊØ»¤³É±¾
    £»
50. Ìá¸ß°²È«ÐÔ£ºÊÖ¶¯Ö¸¶¨·½Ê½³ÉÁ¢µÄIPSec SAÃÜÔ¿ÊǾ²Ì¬µÄ£¬³ÉÁ¢ºóÓÀ²»Íâʱ£¬IKEЭÉÌ·½Ê½»áͨ¹ýIKE SAÌìÉúÃÜÔ¿£¬²¢ÇÒÐÔÃüÖÜÆÚµ½ÆÚºó½øÐÐÀÏ»¯³ÁÐÂÌìÉú£¬Ìá¸ßÁË°²È«ÐÔ¡£

Ó×ÌáÐÑ£ºIKEºÍ̸ĿǰÓÐÁ½¸ö°æ±¾IKEv1ÓëIKEv2£¬IKEv1Ä¿Ç°½ÏΪ³£ÓÃ£¬IKEv2ÓëIKEv1ÅäÖÃ˼·һÑù£¬µ«Ð­É̹ý³ÌÓëIKEv1ÓÐËùÇø±ð£¬±¾ÎIJ»½øÐнâ˵£¬±¾ÎÄÖгöÏÖµÄIKEºÍ̸¾ù´ú±íIKEv1¡£

IKE SAЭÉÌģʽ

ÔÚIKEµÚÒ»½×¶ÎÓÐÁ½ÖÖЭÉÌģʽ¿ÉЭÉ̳ÉÁ¢IKE SA£¬Ö÷ģʽ»òÕßÒ°Âùģʽ¡£Ö÷ģʽʹÓÃ6¸ö±¨ÎÄʵÏÖIKE SA³ÉÁ¢£¬¶øÒ°ÂùģʽʹÓÃ3¸ö±¨ÎÄʵÏÖIKE SA³ÉÁ¢£¬ÓëÖ÷ģʽÏà±ÈÒ°ÂùģʽÏ÷¼õ½»»¥±¨ÎÄÊýÁ¿´Ó¶ø¼Ó¿ìÁËЭÉÌ¿ìÂÊ£¬µ«Òò¶ÔÉí·ÝÐÅÏ¢ºÍÈÏÖ¤ÐÅϢѡȡÃ÷ÎĽ»»¥£¬Ã»ÓмÓÃܱ
£»¤£¬Òò¶ø²»°²È«£¬×÷Õß²»ÍƼöʹÓÃ¡£

Ò°ÂùģʽÔçÆÚÉè¼ÆÖØҪΪ½â¾öÒ»¶Ë¶ÔµÈÌ幫ÍøIPµØÖ·²»¹Ì¶¨»òûÓй«ÍøIPµØÖ·µÄ³¡¾°ÏÂÖ÷ģʽÎÞ·¨Ð­É̳ÉÁ¢µÄÎÊÌâ£¬Ä¿Ç°¸ÃÎÊÌâÄܹ»Í¨¹ý“¶¯Ì¬Ëí·”µÄ²½Öè¸üºÃµØ½â¾ö£¬ËùÒÔÍƼöʹÓÃÖ÷ģʽ¡£Ò°Âùģʽ½öÔÚGA»Æ½ð¼×É豸Óë·ÇGA»Æ½ð¼×É豸³ÉÁ¢IPSecʹÓÃÖ÷ģʽÎÞ·¨³ÉÁ¢³É¹¦ÏÂʹÓÃ£¬ÆäËû³¡¾°Ï²»ÍƼöʹÓÃ¡£

Ó×ÌáÐÑ£ºÖ÷ģʽºÍÒ°Âùģʽ±¨ÎĽ»»¥¾ßÌåÁ÷³Ì²Î¿¼±¾ÎÄ¡¶IKE±¨ÎĽ»»¥ÖªÊ¶µã»ØÊס·Ó×½Ú¡£

IKE SA¼ÓÃÜ·½Ê½

IKE SAʹÓöԳƼÓÃÜËã·¨¶ÔÊý¾Ý½øÐмÓÃܺͽâÃÜ£¬±£ÕÏÊý¾ÝµÄ°²È«ÐÔ¡£³£ÓõĶԳƼÓÃÜËã·¨ÓÐDES¡¢3DES¡¢AESµÈ£¬ÕâÈý¸ö¼ÓÃÜËã·¨µÄ°²È«ÐÔÓɸߵ½µÍ˳´ÎÊÇ£ºAES¡¢3DES¡¢DES£¬°²È«ÐԸߵļÓÃÜË㷨ʵÏÖ»úÔ츴ÔÓ£¬ÔËËã¿ìÂÊÂý¡£

ͼ3£ºIKE SA³£ÓõĶԳƼÓÃÜËã·¨

IKE SAÑéÖ¤·½Ê½

IKE SAʹÓÃÑéÖ¤Ëã·¨¶Ô±¨ÎÄÆëÈ«ÐÔ¼°ÆðÔ´ºÏ·¨ÐÔ½øÐÐÑéÖ¤£¬³£ÓõÄÑéÖ¤·½Ê½ÓÐMD5-HMAC¡¢SHA1-HMACµÈ£¬ÊÇHASHËã·¨ºÍHMACÁ½ÖÖ¼¼ÊõµÄ½áºÏ¡£

HASHË㷨ʵÏÖ¶Ô±¨ÎĽøÐÐÆëÈ«ÐÔУÑé£¬³£¼ûµÄHASHËã·¨ÓÐMD5¡¢SHA1µÈ£¬MD5Ëã·¨µÄÍÆËã¿ìÂʱÈSHA1Ëã·¨¿ì£¬¶øSHA1Ëã·¨µÄ°²È«Ç¿¶È±ÈMD5Ëã·¨¸ß¡£

ͼ4£ºIKE SA³£ÓõÄHASHËã·¨

 

HMAC(Hash-based Message Authentication Code)ÊÇÒ»ÖÖ»ùÓÚHASHËã·¨ºÍÃÜÔ¿½øÐÐÐÂÎÅÈÏÖ¤µÄ²½Öè£¬ÊµÏÖ¶Ô±¨ÎÄÆðÔ´µÄºÏ·¨ÐÔ½øÐÐÑéÖ¤£¬Äܹ»ÓëÈκÎHASHËã·¨°ó¸¿Ê¹ÓÃ¡£

IKE SAÃÜÔ¿ÌìÉú·½Ê½

DH£¨Diffie-Hellman£©ÊÇÒ»ÖַǶԳÆÃÜÔ¿Ëã·¨£¬Ë«·½¿Éͨ¹ý½ö»¥»»Ò»Ð©Êý¾Ý£¬¼´¿ÉÍÆËã³öË«·½µÄÃÜÔ¿£¬²¢ÇÒµÚÈý·½²¶»ñÁËÆäÖеÄÊý¾ÝÒ²ÎÞ·¨ÍÆËãµÃ³öÃÜÔ¿¡£DH²úÉúµÄÃÜÔ¿ÓÃÓÚÊý¾Ý±¨ÎļÓÃܼ°HMACÍÆËãÖÐ¡£¶ÔµÈÌåÁ½¶ËDH×鳤¶ÈÐèÖ¸¶¨ÎªÒ»Ñù£¬³£ÓõÄDH×鳤¶Å×Ð768bit£¨DH1£©¡¢1024bit£¨DH2£©¡¢1536bit£¨DH5£©¡£

IKE SAÈÏÖ¤·½Ê½

ÔÚIKE¶ÔµÈÌåÖ®¼äÔÚ½øÐÐÉí·ÝÈÏ֤ʱ֧³Öͨ¹ýÔ¤¹²ÏíÃÜÔ¿ÈÏÖ¤ºÍÊý×ÖÖ¤ÊéÈÏÖ¤Á½ÖÖ·½Ê½À´È·È϶Է½Éí·ÝµÄºÏ·¨ÐÔ¡£Ô¤¹²ÏíÃÜÔ¿ÈÏÖ¤ÅäÖñÈÁ¦µ¥Ò»£¬ÊÇÄ¿Ç°±ÈÁ¦³£ÓõÄÈÏÖ¤·½Ê½¡£Êý×ÖÖ¤ÊéÈÏÖ¤Ïà¶Ô¸´ÔÓµ«°²È«ÐԽϸß£¬¶Ô°²È«ÐÔÓнϸßÒªÇóµÄ³¡¾°½¨ÒéʹÓÃÊý×ÖÖ¤ÊéÈÏÖ¤¡£

IKE SAÉí·Ý±êʶ

ÔÚIKE SAЭÉÌÖжԵÈÌåË«·½±ØҪʹÓÃÒ»ÑùÀàÐ͵ÄÉí·Ý±êʶ£¬³£ÓõÄÉí·Ý±êʶÀàÐÍÓÐ4ÖÖ£¬IPµØÖ·¡¢FQDN¡¢USER-FQDN¡¢Ö¤ÊéDN¡£Êý×ÖÖ¤ÊéÈÏ֤ͨ³£Ñ¡È¡Ö¤ÊéDN×÷Ϊ±¾µØÉí·Ý±êʶ¡£Ô¤¹²ÏíÃÜÔ¿ÈÏ֤ĬÈÏÑ¡È¡IPµØÖ·×÷Ϊ±¾µØÉí·Ý±êʶ£¬Í¨³£Ê¹ÓÃÑ¡È¡IPµØÖ·×÷Ϊ±¾µØÉí·Ý±êʶ¼´¿É£¬ÈôÓöµ½ÒÔÏÂÁ½ÖÖ³¡¾°ÍƼöÊÖ¶¯Åú¸ÄʹÓÃFQDN»òUSER-FQDN£º

50. ÈôÊǶԵÈÌåµÄIPµØַΪÓòÃû´ó¾Ö£¬Ôò±ØÐëʹÓÃFQDN»òUSER-FQDN
    £»
50. ¶ÔµÈÌå½Ï¶àµÄ³¡¾°ÏÂ£¬½¨ÒéÑ¡È¡FQDN»òUSER-FQDN£¬±ãÓÚ·Ö±æÿ¸ö¶ÔµÈÌå¶ÔÓ¦ÊÇÄĸö·ÖÖ§¡£

Ó×ÌáÐÑ£ºÉí·Ý±êʶÀàÐÍÓëЭÉÌģʽÎÞ¹Ø£¬ÈκÎÉí·Ý±êʶÔÚÖ÷ģʽ»òÒ°ÂùģʽϾù¿ÉʹÓÃ£¬ºÃ±ÈÖ÷ģʽʹÓÃFQDN×÷ΪÉí·Ý±êʶ»òÒ°ÂùģʽʹÓÃIP×÷ΪÉí·Ý±êʶ¶¼¿ÉÕý³£ÊµÏÖIKE SAЭÉÌ£¬Ö»ÓжԵÈÌåÁ½¶ËʹÓÃÒ»ÑùÀàÐÍÉí·Ý±êʶ¼´¿É¡£

IKE SAÐÔÃüÖÜÆÚ

ÓÉÓÚIPSec SAЭÉÌÊdzÉÁ¢ÔÚIKE SA»ù´¡ÉϵÄ£¬Òò¶øΪ½Ú¼óЭÉÌIPSec SAµÄ¹¦·ò£¬Í¨³£IKE SAÐÔÃüÖÜÆÚ£¨60Ãëµ½86400Ãë£¬È±Ê¡86400Ã룩±ÈIPSec SAÐÔÃüÖÜÆÚÉèÖõij¤¡£µ±ÔÚ½øÐÐIKE SAЭÉÌʱ£¬Á½¶Ë¶ÔµÈÌåÉèÖõÄIKE SAÐÔÃüÖÜÆÚ·ÖÆç²»»áÔì³ÉIKE SAЭÉÌʧ°Ü£¬¶øʹÓ÷¢ËÍ·½ÉèÖõÄIKE SAÐÔÃüÖÜÆÚ¡£

IPSec SA°²È«ºÍ̸

AHºÍESPÊÇIPSecµÄÁ½ÖÖ°²È«ºÍ̸£¬ÓÃÓÚʵÏÖIPSecÔÚÉí·ÝÈÏÖ¤ºÍÊý¾Ý¼ÓÃܵݲȫ»úÔì¡£

50. AHºÍ̸£¨Authentication Header£¬ºÍ̸ºÅ51£©£¬ÖØÒªÌṩÊý¾ÝÆëÈ«ÐÔÈ·ÈÏ¡¢Êý¾ÝÆðÔ´È·ÈÏ¡¢·À³Á·ÅµÈ°²È«¸öÐÔ¡£AHͨ³£Ê¹ÓÃMD5-HMAC¡¢SHA-HMACµÈÑéÖ¤Ë㷨ʵÏÖÊý¾ÝÆëÈ«ÐÔ
    £»
50. ESPºÍ̸£¨Encapsulating Security Payload£¬ºÍ̸ºÅ50£©£¬ÖØÒªÌṩÊý¾ÝÆëÈ«ÐÔÈ·ÈÏ¡¢Êý¾Ý¼ÓÃÜ¡¢Êý¾ÝÆðÔ´È·ÈÏ¡¢·À³Á·ÅµÈ°²È«¸öÐÔ¡£ESPͨ³£Ê¹ÓÃDES¡¢3DES¡¢AESµÈ¼ÓÃÜË㷨ʵÏÖÊý¾Ý¼ÓÃÜ£¬Ê¹ÓÃMD5-HMAC¡¢SHA-HMACµÈÑéÖ¤Ë㷨ʵÏÖÊý¾ÝÆëÈ«ÐÔ¡£ESPºÍ̸Ïà±ÈAHºÍ̸¶àÁËÖ§³ÖÊý¾Ý¼ÓÃÜ¡¢Ö§³ÖNAT´©Ô½£¨NAT-T£©ÕâÁ½´óÓÅÊÆ£¬ÊÇÄ¿Ç°IPSec VPN½ÏΪ³£ÓõݲȫºÍ̸¡£

IPSec SA·âװģʽ

·âװģʽÓÃÓÚÖ¸¶¨°²È«ºÍ̸µÄ·â×°µØλ£¬Óд«ÊäģʽºÍËí·ģʽÁ½ÖÖ£º

 

´«Ê䣨Transport£©Ä£Ê½ÏÂ£¬AHÍ·»òESPÍ·²åÈëIPÍ·ºÍ´«Êä²ãºÍ̸֮¼ä£¬²»Å¤×ªÔ­Ê¼±¨ÎÄÍ·£¬IPSecËí·µÄÔ´ºÍÖ÷ÕŵØÖ·¾ÍÊÇ×îÖÕͨѶ˫·½µÄÔ´ºÍÖ÷ÕŵØÖ·£¬ËùÒÔÖ»Äܱ
£»¤Á½¸öIPSec¶ÔµÈÌåÖ®¼äÏ໥ͨѶ¡£Í¨¾­³£ÓÃÔÚʹÓÃGRE over IPSec»òL2TP over IPSecºÍ̸µÄ³¡¾°ÖÐ£¬Ê¹ÓÃIPSecËí·±
£»¤GRE»òL2TP¶ÔµÈÌå
£»

Ëí·£¨Tunnel£©Ä£Ê½ÏÂ£¬AHÍ·»òESPÍ·²åÔÚԭʼIPͷ֮ǰ£¬²¢ÇÒÐÂÌìÉúÒ»¸öIPÍ··ÅÔÚESPÍ·»òAHͷ֮ǰ£¬ËùÒÔÄܹ»±
£»¤Á½¸öIPSec¶ÔµÈÌå±³ºóÁ½¸öÍøÂçÖ®¼ä½øÐÐͨѶ¡£Í¨¾­³£ÓÃÔÚÕ¾µã¼äÍøÂ绥ͨµÄ³¡¾°£¬Êǽϳ£Óõķâװģʽ¡£

 

ͼ5£ºAHºÍ̸Á½ÖÖ·âװģʽϱ¨ÎÄ·â×°

ͼ6£ºESPºÍ̸Á½ÖÖ·âװģʽϱ¨ÎÄ·â×°

IPSec SA¼ÓÃÜ·½Ê½

IPSec SAÖ§³ÖʹÓõļÓÃÜ·½Ê½ÓëIKE SAÒ»Ñù£¬²Î¿¼±¾ÎÄ¡¶IKE SA¼ÓÃÜ·½Ê½¡·Ó×½Ú¡£

IPSec SAÑéÖ¤·½Ê½

IPSec SAÖ§³ÖʹÓõÄÑéÖ¤·½Ê½ÓëIKE SAÒ»Ñù£¬²Î¿¼±¾ÎÄ¡¶IKE SAÑéÖ¤·½Ê½¡·Ó×½Ú¡£

IPSec SAÐÔÃüÖÜÆÚ

ΪÁËÈ·±£°²È«£¬IPSec SA½«ÔÚ¾­¹ýÒ»°´¹¦·ò£¨0»òÕß120Ãëµ½86400Ãë£¬È±Ê¡3600Ã룩»ò´ïµ½¿Ï¶¨Í¨Ñ¶Á¿£¨0»ò2560KBµ½536870912KB£¬È±Ê¡4608000KB£©Ö®ºó³¬Ê±£¬³ÁÐÂЭÉÌ£¬²¢Ê¹ÓÃеÄÃÜÔ¿¡£ÐÂIPSec SAÔÚÐÔÃüÖÜÆÚ³¬Ê±Ç°30Ãë£¬»ò¾­ÓÉÕâÌõËí·µÄÊý¾ÝͨѶÁ¿¾àÐÔÃüÖÜÆÚ»¹ÓÐ256KBʱÆðÍ·½øÐÐЭÉÌ£¨Æ¾¾ÝÄĸöÏȲúÉú£©¡£

µ±ÔÚ½øÐÐIPSec SAЭÉÌʱ£¬Á½¶Ë¶ÔµÈÌåÉèÖõÄIPSec SAÐÔÃüÖÜÆÚ·ÖÆç²»»áÔì³ÉIPSec SAЭÉÌʧ°Ü£¬¶øʹÓÃÌáÒé·½ÉèÖõÄIPSec SAÐÔÃüÖÜÆÚ¡£

IPSec VPN¸ß¼¶Ö°ÄÜ

 

ͼ7£ºIPSec VPN¸ß¼¶Ö°ÄÜ

IPSecËí·×Ô¶¯³ÉÁ¢£¨Set Autoup£©

ÔÚĬÈÏÇé¿öÏÂIPSec VPNÅäÖÃÍêºó£¬IPSecËí·ÊÇÓÉÊý¾ÝÁ÷Á¿´¥·¢ºóÔÙЭÉ̳ÉÁ¢µÄ¡£ÅäÖÃIPSecËí·×Ô¶¯³ÉÁ¢£¨Set Autoup£©Ö°Äܺó£¬²»ÂÛÊÇ·ñº±¼û¾ÝÁ÷Á¿´¥·¢£¬Ö»ÓÐʵÏÖIPSec VPNÅäÖúó£¬É豸»á×ÔÐд¥·¢IPSecËí·³ÉÁ¢¡£

IPSecÁ´Â·Ì½²â£¨DPD/Track£©

DPD̽²â

ÔÚĬÈÏÇé¿öÏÂÁ½¶ËÉ豸³ÉÁ¢IPSecËí·ºó£¬µ±Ò»¶ËÉ豸³öÏÖÎÊÌâºóÁíÒ»¶ËÊÇÎÞ¸ÐÖªµÄ£¬ÁíÒ»¶ËÉ豸»á³ÖÐøͨ¹ýIPSecËí··¢ËÍÊý¾Ý¸ø¹ÊÕÏÉ豸µ¼ÖÂÊý¾ÝͨѶÖжÏ¡£´Ëʱ±ØÒªÆÚ´ýIPSecËí·³¬Ê±ºó¹ÊÕÏIPSecËí·²Å»áÖжϣ¨IPSecËí·ĬÈϳ¬²»¶Ï¼äΪһÓ×ʱ£©¡£

DPD̽²âÊÇͨ¹ý·¢ËÍIKE±¨ÎÄÈ·È϶ԶËÉ豸IKE SA״̬ÊÇ·ñÕý³£µÄÒ»ÖÖ̽²â»úÔì£¬µ±Ì½²âµ½¶Ô¶ËIKE״̬Ò쳣ʱ£¬»á¶Ï¸ù¶ÔÓ¦µÄIKE SAºÍIPSec SA¡£

DPD̽²âÓÐÁ½ÖÖ¹¤×÷ģʽ£º

50. °´Ðè̽²âģʽ£¨On-demand£©£¬ÔÚ³¬¹ýÅäÖõÄ̽²â¹¦·òÇÒµ±º±¼û¾Ý±¨ÎÄ·¢ËÍʱ£¬É豸»á·¢ËÍDPDÐÂÎÅ̽²â¶Ô¶ËÉ豸ÊÇ·ñÕý³££¬µ±·¢ËÍ5´ÎDPDÐÅÏ¢¶¼Ã»ÓÐÊÕµ½¶Ô¶ËÉ豸»Ø°ü»áÒÔΪ¶Ô¶ËIKE SA״̬Òì³£
    £»
50. ÖÜÆÚ̽²âģʽ£¨Periodic£©£¬É豸»áƾ¾ÝÅäÖõÄ̽²â¹¦·òÖÜÆÚÐÔ×Ô¶¯·¢ËÍ DPD ÐÂÎÅ̽²â¶Ô¶ËÉ豸ÊÇ·ñÕý³££¬µ±·¢ËÍ5´ÎDPDÐÅÏ¢¶¼Ã»ÓÐÊÕµ½¶Ô¶ËÉ豸»Ø°ü»áÒÔΪ¶Ô¶ËIKE SA״̬Òì³£¡£

×ÛÉÏ°´Ðè̽²âģʽ±ÈÖÜÆÚ̽²âģʽ»á·¢Ë͸üÉÙµÄDPDÐÅÏ¢Ö»ÔÚÊý¾Ý±¨ÎÄ·¢ËÍÇ°¼ì²â£¬½ÚÔ¼É豸×ÊÔ´¼°ÍøÂç´ø¿í×ÊÔ´£¬µ«Ì½²âµ½¶Ô¶ËÉ豸¹ÊÕϵŦ·ò»á±ÈÖÜÆÚ̽²âģʽ³¤£¬¶ÁÕßƾ¾Ý×ÔÉíÒµÎñÐèҪʹÓÃÏàÒËģʽ½øÐÐDPD̽²â¼´¿É¡£

Track̽²â

DPD̽²âͨ¹ý½»»¥IKE±¨ÎÄÄܹ»Ì½²âµ½¶Ô¶ËÉ豸IKE SA״̬ÊÇ·ñÕý³££¬¶ÔÓÚIKE SA״̬Õý³£¶øIPSec SAÒì³£µÄÇé¿öDPD̽²â¾ÍÁ¦Ëù²»¼°ÁË£¬ÕâÖÖÇé¿öͬÑù»áµ¼ÖÂIPSecÒµÎñÖжÏ¡£Track̽²âͨ¹ý¶¨ÆÚ·¢ËÍICMP»òUDP±¨ÎÄ̽²âIPSecÏÖʵҵÎñÊÇ·ñÕý³££¬µ±Track̽²âµ½IPSecÒµÎñ²»Í¨Ê±»á¶Ï¸ù¶ÔÓ¦µÄIPSec SA½øÐгÁÐÂЭÉÌ¡£Í¨³£½¨ÒéͬʱÅäÖÃDPD̽²âºÍTrack̽²â¡£

NAT´©Ô½£¨NAT-T£©

É豸ĬÈÏ¿ªÆôNAT´©Ô½£¨NAT-T£©Ö°ÄÜ£¬ÓÃÓÚ½â¾öµ±³ÉÁ¢IPSec VPNµÄÁ½Ì¨É豸¼ä´æÔÚNATÉ豸ESP±¨ÎÄÎÞ·¨Í¨¹ýµÄÎÊÌâ¡£ESP±¨Í··â×°ÔÚIP²ãÖ®ÉÏIPºÍ̸ºÅ50ËùÒÔÎÞ·¨Í¨¹ýNATÉ豸, NAT-Tͨ¹ýÔÚESP±¨ÎÄÖ®ÉÏ·â×°4500¶Ë¿ÚµÄUDP±¨Í·½â¾ö¸ÃÎÊÌâ¡£

 

ͼ8£ºNAT-TÔÚESP±¨ÎÄÖ®ÉÏ·â×°4500¶Ë¿ÚµÄUDP±¨Í·

 

ÔÚIKEЭÉ̵ĵÚÒ»½×¶Î£¨Ö÷ģʽµÚ1¡¢2¸ö±¨ÎÄ¡¢Ò°ÂùģʽµÚ1¸ö±¨ÎÄ£©Ö§³ÖNAT-TµÄÉ豸ÔÚ·¢ËÍIKE±¨ÎÄÖлáЯ´øÒ»¸ö¼ì²âNAT-TÄÜÁ¦µÄVendor IDµÄÔغÉ£¬µ±Á½¶ËÉ豸¶¼Ð¯´øÕâ¸ö×ֶξͻá½øÐÐNAT-TЭÉÌ¡£µ±¼ì²âË«·½¶¼Ö§³ÖNAT-TËæºó£¨Ö÷ģʽµÚ3¡¢4¸ö±¨ÎÄ¡¢Ò°ÂùģʽµÚ2¸ö±¨ÎÄ£©»áЯ´øÒ»¸öNAT-DµÄÔغÉ£¬NAT-DÔغÉÖÐÔ̺¬×Ô¼ºIPµØÖ·ºÍ¶Ë¿ÚµÄHASHÖµ£¬¶Ô¶ËÉ豸ÊÕµ½Õâ¸öÖµºó»áÓëÊÕµ½µÄÏÖʵIPµØÖ·ºÍ¶Ë¿ÚµÄHashÖµ×ö¶Ô±È£¬ÈôÊÇÒ»Ñù×¢Ã÷ÖÐÑëδ¾­¹ýNATÉ豸£¬²»È»×¢Ã÷ÖÐÑë¾­¹ýNATÉ豸¡£ÈôÊÇNAT-T¼ì²âµ½ÖÐÑë¾­¹ýNATÉ豸£¬É豸»á±ÉÈËÒ»¸ö±¨ÎÄ£¨Ö÷ģʽµÚ5¡¢6±¨ÎÄ¡¢Ò°ÂùģʽµÚ3¸ö±¨ÎÄ£©ÆðÍ·²åÈëÒ»¸ö4500¶Ë¿ÚµÄUDP±¨Í·£¬ÖÁ´ËNAT-T¹¤×÷ʵÏÖ¡£

 

¶¯Ì¬Ëí·£¨Crypto Dynamic-map£©

ͨ³£Çé¿öÏÂ£¬Á½¶ËÉ豸¶¼Óй«ÍøIPµØÖ·£¬ÅäÖÃʱÁ½¶ËʹÓþ²Ì¬Ëí·µÄ·½Ê½Ï໥ָ¶¨¶Ô¶Ë¹«ÍøIPµØÖ·½øÐÐIPSecËí·³ÉÁ¢¡£ÏÖʵÖÐÒ²»áÓöµ½Ò»¶ËÓй«ÍøIPµØÖ·¶øÁíÒ»¶ËûÓй̶¨¹«ÍøIPµØÖ·»òÕßûÓй«ÍøIPµØÖ·µÄÇé¿ö£¬ÕâÖÖÇé¿öÁ½¶Ë¶¼Ê¹Óþ²Ì¬Ëí·µÄ·½Ê½¾ÍÎÞ·¨³ÉÁ¢IPSecËí·¡£Ê¹Óö¯Ì¬Ëí·ÅäÖÃʱÎÞÐèÖ¸¶¨¶Ô¶ËIPµØÖ·¡¢Éí·Ý¡¢¸ÐÐËÖÂÁ÷µÈ£¬Óй«ÍøIPµØÖ·µÄÒ»¶ËʹÓö¯Ì¬Ëí·¿É½â¾öÁíÒ»¶ËûÓй̶¨¹«ÍøIPµØÖ·»òÕßûÓй«ÍøIPµØÖ·µÄÎÊÌâ¡£´Ë±í£¬ÈôÊDZ¾¶Ë±ØÒª³ÉÁ¢´óÁ¿IPSec VPNµÄ¶ÔµÈÌåÒ²Äܹ»Ê¹¶¯Ì¬Ëí·£¬Ï÷¼õÅäÖÃÁ¿¡£

·´Ïò·ÓÉ×¢È루RRI£©

ÔÚʵÏÖIPSecÅäÖúóÎÒÃÇÒªÅäÖÃÈ¥Íù¶Ô¶ËÍø¶ÎµÄ¾²Ì¬Â·ÓÉ£¬ÈôÊǸÐÐËÖÂÁ÷Íø¶Î½Ï¶à±¨´ðÊÖ¶¯ÅäÖü°ÊØ»¤ÕâЩ·ÓÉÓÐЩ²»±ã¡£¿ªÆô·´Ïò·ÓÉ×¢ÈëÖ°ÄÜ£¬µ±IPSecËí·³ÉÁ¢ÊµÏÖºó»á×Ô¶¯²úÉúÏàÓ¦µÄ¾²Ì¬Â·ÓÉ£¨Ö÷ÕŵØÖ·ÊǶԶ˸ÐÐËÖÂÁ÷µØÖ·£¬ÏÂÒ»ÌøÊǶԶ˹«ÍøIPµØÖ·£©×¢È뵽·ÓɱíÖÐ£¬µ±IPSecËí·¶Ï¿ªºó¶ÔÓ¦µÄ·ÓÉÒ²»áÒþû¡£·´Ïò·ÓÉ»á½áºÏIPSecËí·µÄ³ÉÁ¢ÐÅÏ¢×Ô¶¯ÌìÉú¶Ô¶ËÍø¶Î·ÓÉ£¬ÕâÑù±ãÄܶ¯Ì¬µØʵÏÖ·ÓɵÄÔö³¤Óëɾ³ý£¬Ô¤·À´óÁ¿±¨´ðÅäÖÃ¡£´Ë±í£¬ÔÚÉ豸´æÔÚ¶à³ö¿Ú³¡¾°£¬»¹Äܹ»Í¨¹ý·´Ïò·ÓÉ×¢Èë½øÐжà³ö¿ÚÉÏIPSecËí·µÄÇл»¡£

ʹÓö¯Ì¬Â·ÓɺÍ̸£¨GRE over IPSec/L2TP over IPSec£©

ÔÚIPSecÍøÂçÖÐÖ»ÄÜͨ¹ý¾²Ì¬Â·ÓÉÅäÖõ½¶Ô¶ËÍø¶ÎµÄ·ÓÉ£¬IPSec¶ÔµÈÌåÖ®¼äÎÞ·¨Ê¹Óö¯Ì¬Â·ÓɺÍ̸½øÐзÓɽø½¨£¬·´Ïò·ÓÉ×¢ÈëÄܹ»¿Ï¶¨Ë®Æ½ÉϽâ¾ö¸ÐÐËÖÂÁ÷Íø¶Î½Ï¶à¡¢¾²Ì¬Â·ÓÉÊØ»¤³É±¾¸ßµÄÎÊÌâ£¬ÈôÊǵ«Ô¸Ê¹Óö¯Ì¬Â·ÓɺÍ̸½øÒ»²½½µµÍ·ÓÉÊØ»¤³É±¾£¬Äܹ»Ê¹ÓÃGRE over IPSec VPN»òÕßL2TP over IPSec VPN£¬Ê¹ÓÃGRE»òÕßL2TP³ÉÁ¢VPNËí·£¬¶øºóÔÙʹÓÃIPSecËí·±
£»¤Õâ¸öVPNËí·£¬´Ëʱ¼È±£ÕÏÁËÊý¾Ý°²È«ÓÖ¿ÉÔÚVPNËí·Á½¶ËʹÓö¯Ì¬Â·ÓɺÍ̸¡£

IPSec VPNµäÐͳ¡¾°

µ¥×ܲ¿µ¥·ÖÖ§³¡¾°

³¡¾°¢ñ

 

ͼ9£ºIPSec VPNµäÐͳ¡¾°¢ñÅäÖñí

³¡¾°¢ò

 

ͼ10£ºIPSec VPNµäÐͳ¡¾°¢òÅäÖñí

 

³¡¾°¢ó

 

ͼ11£ºIPSec VPNµäÐͳ¡¾°¢óÅäÖñí

³¡¾°¢ô

 

ͼ12£ºIPSec VPNµäÐͳ¡¾°¢ôÅäÖñí

 

³¡¾°¢õ

 

ͼ13£ºIPSec VPNµäÐͳ¡¾°¢õÅäÖñí

³¡¾°¢ö

 

ͼ14£ºIPSec VPNµäÐͳ¡¾°¢öÅäÖñí

¶à×ܲ¿¶à·ÖÖ§³¡¾°

³¡¾°¢÷

 

ͼ15£ºIPSec VPNµäÐͳ¡¾°¢÷ÅäÖÃͼ

³¡¾°¢ø

 

ͼ16£ºIPSec VPNµäÐͳ¡¾°¢øÅäÖñí

 

ÔÚ¶à×ܲ¿¶à·ÖÖ§³¡¾°ÏÂ£¬³ýÒÔÉÏÁ½ÖÖµ¥³ö¿ÚÇé¿ö±í£¬¶à³ö¿ÚµÄÇé¿öÒ²½ÏΪ³£¼û¡£²¿Êðʱ½«ÒÔÉÏÁ½ÖÖ¶à×ܲ¿¶à·ÖÖ§³¡¾°Óëµ¥×ܲ¿µ¥·ÖÖ§³¡¾°Ï¶à³ö¿ÚµÄÇé¿ö½áºÏʹÓü´¿É£¬±¾Õ²»ÔÚ׸Êö¡£

IPSec VPN¹ÊÕÏÅŲé

IPSec VPNʹÓÃʱδÃâ»áÓöµ½Ëí·³ÉÁ¢Ê§°ÜµÄÇé¿ö¡£Í¨³£IPSec VPN¹ÊÕÏ¿É·ÖΪÈýÀࣺIKE SA³ÉÁ¢Ê§°Ü
£»IPSec SA³ÉÁ¢Ê§°Ü
£»IPSec SA³ÉÁ¢³É¹¦µ«Êý¾Ý²»Í¨¡£ÔÚÓöµ½IPSec VPN¹ÊÕÏʱ¶ÁÕ߿ɲ鿴ÌáÒé·½ºÍ½Ó¹Ü·½×´Ì¬²¢¶ÔºÃ±ÈÏÂIPSec¶ÔµÈÌå״̬½âÎöͼȷÈÏÊôÓÚÄÄÀà¹ÊÕÏ£¬¶øºóƾ¾ÝÿÀà¹ÊÕϳ£¼ûÔ­Òò½øÐÐÅŲé¡£

 

ͼ17£º²é¿´IPSec¶ÔµÈÌå״̬

18£ºIPSec¶ÔµÈÌå״̬½âÎö

IKE±¨ÎĽ»»¥ÖªÊ¶µã»ØÊ×

ÔÚ·ÖÎöÿÀà¹ÊÕϳ£¼û²úÉúÔ­ÒòÇ°£¬×÷ÕßÊ×ÏÈ´ø¸÷ÈË»ØÊ×ÏÂIKE±¨ÎĽ»»¥Çé¿ö£¬Ö»ÓÐ֪·ÁËÿ¸ö±¨ÎÄÔÚ½»»¥Ê²Ã´ÄÚÈÝ£¬ÔÚÓöµ½IPSec³ÉÁ¢Í£¶ÙÔÚijһ½×¶Îʱ£¬ÎÒÃDzÅ֪·ÅŲéµÄ·½Ïò¡£IKEͨ¹ýÁ½¸ö½×¶ÎÀ´³ÉÁ¢IPSec SA£¬µÚÒ»½×¶ÎÑ¡È¡Ö÷ģʽ»òÕßÒ°Âùģʽ³ÉÁ¢IKE SA£¬µÚ¶þ½×¶ÎÑ¡È¡¼±¾çģʽ³ÉÁ¢IPSec SA¡£

IKEµÚÒ»½×¶Î£¨Ö÷ģʽ£©£º

50. µÚ1-2¸ö±¨ÎÄЯ´øIKEÕ½Êõ£¬½øÐÐIKEÕ½ÊõЭÉÌ£¬IKEÕ½ÊõÔ̺¬£º¼ÓÃÜËã·¨¡¢HASHËã·¨¡¢DH×é¡¢ÑéÖ¤·½Ê½¡¢IKE SAÐÔÃüÖÜÆÚ£¬
50. µÚ3-4¸ö±¨ÎÄЯ´øDHËã·¨±ØÒªµÄ×ÊÁÏ£¬½øÐÐDHËã·¨ÍÆËãÌìÉúÃÜÔ¿£¬
50. µÚ5-6¸ö±¨ÎÄЯ´øÉí·ÝÐÅÏ¢¼°ÈÏÖ¤ÐÅÏ¢£¬½øÐжԵÈÌå¼äµÄÈÏÖ¤£¬ÊµÏÖIKE SA³ÉÁ¢¡£±ØÒª°ÑÎȵÄÊÇ´ÓµÚ5¸ö±¨ÎÄÆðÍ·ÓÐÁ½´¦±ä¶¯£¬µÚÒ»µãÊDZ¨ÎÄÆðÍ·±»¼ÓÃܱ
    £»¤£¬µÚ¶þµãÊÇÈôÊÇ´æÔÚNAT´©Ô½µÄÇé¿öUDP¶Ë±êÓｫ´Ó500±äΪ4500

 

ͼ19£ºÖ÷ģʽ±¨ÎĽ»»¥Á÷³Ì¼°¶ÔµÈÌå״̬

 

IKEµÚÒ»½×¶Î£¨Ò°Âùģʽ£©£º

50. µÚ1¸ö±¨ÎÄ·¢ËÍ·½·¢ËÍIKEÕ½Êõ¡¢DHËã·¨±ØÒªµÄ×ÊÁÏ¡¢Éí·ÝÐÅÏ¢£¬IKEÕ½ÊõÔ̺¬£º¼ÓÃÜËã·¨¡¢HASHËã·¨¡¢DH×é¡¢ÑéÖ¤·½Ê½¡¢IKE SAÐÔÃüÖÜÆÚ
    £»
50. µÚ2¸ö±¨ÎĽӹܷ½»ØӦƥÅäµÄIKEÕ½Êõ£¬·¢ËÍDHËã·¨±ØÒªµÄ×ÊÁÏ¡¢Éí·ÝÐÅÏ¢¡¢ÈÏÖ¤ÐÅÏ¢
    £»
50. µÚ3¸ö±¨ÎÄ·¢ËÍ·½·¢ËÍÈÏÖ¤ÐÅϢʵÏÖÈÏÖ¤£¬ÊµÏÖIKE SA³ÉÁ¢¡£ÈôÊÇ´æÔÚNAT´©Ô½µÄÇé¿ö´Ó¸Ã±¨ÎÄÆðÍ·UDP¶Ë±êÓï´Ó500±äΪ4500¡£

 

ͼ20£ºÒ°Âùģʽ±¨ÎĽ»»¥Á÷³Ì¼°¶ÔµÈÌå״̬

 

IKEµÚ¶þ½×¶Î£º

50. µÚ1¸ö±¨ÎÄ·¢ËÍ·½·¢ËÍIPSecת»»¼¯¡¢¸ÐÐËÖÂÁ÷£¬½øÐÐIPSec²ÎÊýЭÉÌ£¬IPSecת»»¼¯Ô̺¬£º·âװģʽ¡¢°²È«ºÍ̸¡¢¼ÓÃÜËã·¨¡¢HASHËã·¨¡¢IPSec SAÐÔÃüÖÜÆÚ¡£Áí±íÈôÊÇ¿ªÆôPFS»¹»áЯ´øDHËã·¨±ØÒªµÄ×ÊÁÏ£¬½øÐÐDHËã·¨ÍÆËãÌìÉúеÄÃÜÔ¿
    £»
50. µÚ2¸ö±¨ÎĽӹܷ½»ØӦƥÅäµÄIPSecÕ½Êõ¡¢¸ÐÐËÖÂÁ÷¼°DHËã·¨±ØÒªµÄ×ÊÁÏ(ÈôÊÇ¿ªÆôPFS)
    £»
50. µÚ3¸ö±¨ÎÄ·¢ËÍ·½½øÐÐÁ˾ÖÈ·ÈÏ£¬Ë«·½ÊµÏÖIPSec SA³ÉÁ¢¡£

Ó×ÌáÐÑ£ºPFS£¨Perfect Forward Secrecy£©ÊÇÒ»ÖÖ°²È«»úÔì£¬Ä¬ÈÏÇé¿öÏÂIPSec SA»áÖ±½ÓʹÓÃIKE SAͨ¹ýDHËã·¨ÌìÉúµÄÃÜÔ¿£¬¿ªÆôPFS»úÔìºó£¬IPSec SAÔÚЭÉÌʱ»áÔÚ¶î±í½øÐÐÒ»´ÎDHÃÜÔ¿»¥»»Ëã·¨£¬Ê¹IPSec SAʹÓõÄÃÜÔ¿ÓëIKE SAʹÓõÄÃÜÔ¿·ÖÆç£¬Ìá¸ß°²È«ÐÔ¡£

IKE SA³ÉÁ¢Ê§°Ü¹ÊÕÏÔ­Òò·ÖÎö

ͼ21£ºIKEµÚÒ»½×¶ÎIKE SA³ÉÁ¢Ê§°ÜÔ­Òò

 

IPSec SA³ÉÁ¢Ê§°Ü¹ÊÕÏÔ­Òò·ÖÎö

ͼ22£ºIKEµÚ¶þ½×¶ÎIPSec SA³ÉÁ¢Ê§°ÜÔ­Òò

 

IPSec SA³ÉÁ¢³É¹¦µ«Êý¾Ý²»Í¨¹ÊÕÏÔ­Òò·ÖÎö

ͼ23£ºIPSec SA³ÉÁ¢³É¹¦µ«Êý¾Ý²»Í¨Ô­Òò

 

дÔÚ×îºó

±¾ÎĽáºÏÀíÂÛÓëʵ¼Ê¶ÔIPSec VPN¼¼ÊõµÄ»ù´¡²ÎÊý¡¢¸ß¼¶Ö°ÄÜ¡¢µäÐÍʵ¼Ê³¡¾°¼°¹ÊÕÏÅŲ鲽Öè½øÐÐÁËÉî¿Ì½âÎö¡£³ýÁËIPSec VPN¼¼Êõ±íL2TP over IPSec VPN¡¢GRE over IPSec VPNµÈVPN¼¼ÊõÒ²ÔÚһЩÆóÒµÕ¾µã¼äʹÓÃ£¬¶ÁÕ߿ɽáºÏ±¾ÎÄ˼·×ÔÇ°½øÐÐ×êÑÐ¡£

ÓйØÍƼö£º

• VPN¼¼Êõdz̸֮ÈôºÎ²¿ÊðÔ¶³Ì°ì¹«ÍøÂç
• ÆóÒµ°ì¹«Íø½ÓÈëÈÏÖ¤¼¼ÊõÏê½â
• ¾Ó°²Ë¼Î££¬×Ô¶¯¸Ä¸ï ——dzÎöÔ°Çø°ì¹«ÍøÂçµÄ½¨Éè