フレッツ・VPN プライオにおけるIPsec＋スタティックルーティング構成の設定例（Cisco891）

[tetsusat]

NTT東日本様が提供する「フレッツ・VPNプライオ」を利用した構成における弊社IOSルータのサンプル設定を公開します。

＊「フレッツ・VPNプライオ」については、こちらを参照ください

https://business.ntt-east.co.jp/service/vpnprio/

トポロジ

プラットフォーム

Cisco891

拠点LAN側設定情報

	LAN側サブネット
A拠点	192.168.10.0/24
B拠点	192.168.11.0/24
C拠点	192.168.12.0/24

R1（A拠点）

crypto ikev2 proposal PHASE1-prop 
 encryption aes-cbc-128
 integrity md5
 group 2
!
crypto ikev2 policy site-pol 
 proposal PHASE1-prop
!
crypto ikev2 keyring KEYRNG
 peer Branch
  address 0.0.0.0 0.0.0.0
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
!
crypto ikev2 profile IKEV2-SETUP
 match identity remote address 0.0.0.0 
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRNG
!
crypto ipsec transform-set PRIOSET esp-aes esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile PRIO
 set transform-set PRIOSET 
 set ikev2-profile IKEV2-SETUP
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface Tunnel0
 ip unnumbered Loopback0
 ip mtu 1374
 tunnel source 192.168.10.2
 tunnel mode ipsec ipv4
 tunnel destination 192.168.11.2
 tunnel protection ipsec profile PRIO
!
interface Tunnel1
 ip unnumbered Loopback0
 ip mtu 1374
 tunnel source 192.168.10.2
 tunnel mode ipsec ipv4
 tunnel destination 192.168.12.2
 tunnel protection ipsec profile PRIO
!
interface GigabitEthernet0
 no ip address
!
interface GigabitEthernet8
 ip address 192.168.10.2 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 ip address 172.16.1.254 255.255.255.0
 ip tcp adjust-mss 1334
!
ip route 0.0.0.0 0.0.0.0 172.16.1.1
ip route 172.16.2.0 255.255.255.0 Tunnel0
ip route 172.16.3.0 255.255.255.0 Tunnel1
ip route 192.168.11.0 255.255.255.0 192.168.10.1
ip route 192.168.12.0 255.255.255.0 192.168.10.1
!

R2（B拠点）

crypto ikev2 proposal PHASE1-prop 
 encryption aes-cbc-128
 integrity md5
 group 2
!
crypto ikev2 policy site-pol 
 proposal PHASE1-prop
!
crypto ikev2 keyring KEYRNG
 peer Center
  address 192.168.10.2 255.255.255.0
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
!
crypto ikev2 profile IKEV2-SETUP
 match identity remote address 192.168.10.2 255.255.255.255 
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRNG
!
crypto ipsec transform-set PRIOSET esp-aes esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile PRIO
 set transform-set PRIOSET 
 set ikev2-profile IKEV2-SETUP
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface Tunnel0
 ip unnumbered Loopback0
 ip mtu 1374
 tunnel source 192.168.11.2
 tunnel mode ipsec ipv4
 tunnel destination 192.168.10.2
 tunnel protection ipsec profile PRIO
!
!
interface GigabitEthernet0
 no ip address
!
interface GigabitEthernet8
 ip address 192.168.11.2 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 ip address 172.16.2.254 255.255.255.0
 ip tcp adjust-mss 1334
!
ip route 0.0.0.0 0.0.0.0 Tunnel0
ip route 192.168.10.0 255.255.255.0 192.168.11.1
!

R3（C拠点）

crypto ikev2 proposal PHASE1-prop 
 encryption aes-cbc-128
 integrity md5
 group 2
!
crypto ikev2 policy site-pol 
 proposal PHASE1-prop
!
crypto ikev2 keyring KEYRNG
 peer Center
  address 192.168.10.2 255.255.255.0
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
!
crypto ikev2 profile IKEV2-SETUP
 match identity remote address 192.168.10.2 255.255.255.255 
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRNG
!
crypto ipsec transform-set PRIOSET esp-aes esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile PRIO
 set transform-set PRIOSET 
 set ikev2-profile IKEV2-SETUP
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
!
interface Tunnel0
 ip unnumbered Loopback0
 ip mtu 1374
 tunnel source 192.168.12.2
 tunnel mode ipsec ipv4
 tunnel destination 192.168.10.2
 tunnel protection ipsec profile PRIO
!
!
interface GigabitEthernet0
 no ip address
!
interface GigabitEthernet8
 ip address 192.168.12.2 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 ip address 172.16.3.254 255.255.255.0
 ip tcp adjust-mss 1334
!
ip route 0.0.0.0 0.0.0.0 Tunnel0
ip route 192.168.10.0 255.255.255.0 192.168.12.1
!