ISAKMP Profile技术应用
ISAKMP Profile技术是IKE协商的一种新型配置方式。它主要的作用是映射我们第一阶段ISAKMP参数到第
二阶段IPSec隧道，可以实现一个设备和多个站点建立多个隧道。还可以很好的消除不同×××之间的影
响，让第一阶段策略和第二阶段策略关联的更加紧密。并且ISAKMP Profile普遍在EZ×××和VRF-ware
IPSec ×××配置里边被采用。
Site1 ：
crypto keyring ccie
pre-shared-key address 61.128.1.1 key cisco
!
crypto isakmp policy 100
encr 3des
authentication pre-share
group 2
crypto isakmp profile isaprof
keyring ccie
match identity address 61.128.1.1 255.255.255.255
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map ccie 10 ipsec-isakmp
set peer 61.128.1.1
set transform-set myset
set isakmp-profile isaprof
match address ***
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
crypto map ccie
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
!
ip access-list extended ***
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
Internet：
interface FastEthernet0/0
ip address 202.100.1.10 255.255.255.0
!
interface FastEthernet0/1
ip address 61.128.1.10 255.255.255.0
！
end
Site2:
crypto keyring ccie
pre-shared-key address 202.100.1.1 key cisco
!
crypto isakmp policy 100
encr 3des
authentication pre-share
group 2
crypto isakmp profile isaprof
keyring ccie
match identity address 202.100.1.1 255.255.255.255
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map ccie 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set myset
set isakmp-profile isaprof
match address ***
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
ip address 61.128.1.1 255.255.255.0
crypto map ccie
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 61.128.1.10
!
ip access-list extended ***
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
!
测试：
Site1#ping 2.2.2.2 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/133/148 ms
Site1#show crypto ipsec sa
interface: FastEthernet0/0
Crypto map tag: ccie, local addr 202.100.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (2.2.2.0/255.255.255.0/0/0)
current_peer 61.128.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 202.100.1.1, remote crypto endpt.: 61.128.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x96AB8F14(2527825684)
inbound esp sas:
spi: 0xF41D2511(4095550737)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: SW:1, crypto map: ccie
sa timing: remaining key lifetime (k/sec): (4566332/2033)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x96AB8F14(2527825684)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: SW:2, crypto map: ccie
sa timing: remaining key lifetime (k/sec): (4566332/2031)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
Site1#show crypto session
Crypto session current status
Interface: FastEthernet0/0
Profile: isaprof
Session status: UP-ACTIVE
Peer: 61.128.1.1 port 500
IKE SA: local 202.100.1.1/500 remote 61.128.1.1/500 Active
IPSEC FLOW: permit ip 1.1.1.0/255.255.255.0 2.2.2.0/255.255.255.0
Active SAs: 2, origin: crypto map
