[FVRFの仕組み] IPSec VTI : FVRFあり 設定例

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2

crypto keyring KEY vrf FVRF
  pre-shared-key address 10.0.0.21 key cisco

crypto keyring KEY vrf FVRF
  pre-shared-key address 10.0.0.11 key cisco

crypto ipsec transform-set TS esp-3des esp-md5-hmac 
 mode tunnel

crypto ipsec profile IPSEC
 set transform-set TS

R11#show running-config interface tunnel 0
Building configuration...

Current configuration : 159 bytes
!
interface Tunnel0
 ip vrf forwarding IVRF
 ip address 172.16.0.11 255.255.255.0
 tunnel source Loopback0
 tunnel destination 10.0.0.21
 tunnel vrf FVRF
end

interface Tunnel0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC

interface Tunnel0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC

R11#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
10.0.0.21       10.0.0.11       QM_IDLE           1001 ACTIVE

IPv6 Crypto ISAKMP SA

R11#show crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 10.0.0.11

   protected vrf: IVRF
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 10.0.0.21 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 95, #pkts encrypt: 95, #pkts digest: 95
    #pkts decaps: 101, #pkts decrypt: 101, #pkts verify: 101
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.0.0.11, remote crypto endpt.: 10.0.0.21
     plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
     current outbound spi: 0x8378E9A7(2205739431)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x9ED7F06A(2664951914)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: SW:1, sibling_flags 80004040, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4263551/3167)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x8378E9A7(2205739431)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: SW:2, sibling_flags 80004040, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4263552/3167)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
R11#show interfaces tunnel 0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 172.16.0.11/24
  MTU 17886 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel linestate evaluation up
  Tunnel source 10.0.0.11 (Loopback0), destination 10.0.0.21
   Tunnel Subblocks:
      src-track:
         Tunnel0 source tracking subblock associated with Loopback0
          Set of tunnels with source Loopback0, 1 member (includes iterators), on interface 
  Tunnel protocol/transport IPSEC/IP
  Tunnel TTL 255
  Tunnel transport MTU 1446 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Tunnel protection via IPSec (profile "IPSEC")
～省略～

R11#show ip eigrp vrf IVRF neighbors
EIGRP-IPv4 Neighbors for AS(1) VRF(IVRF)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   172.16.0.21             Tu0                      14 00:11:31   13  1494  0  14
0   172.17.0.12             Et0/1                    11 00:11:48    8   100  0  10
R11#show ip route vrf IVRF

Routing Table: IVRF
～省略～

Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.0.0/24 is directly connected, Tunnel0
L        172.16.0.11/32 is directly connected, Tunnel0
      172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks
C        172.17.0.0/24 is directly connected, Ethernet0/1
L        172.17.0.11/32 is directly connected, Ethernet0/1
D        172.17.12.0/24 [90/409600] via 172.17.0.12, 00:11:51, Ethernet0/1
      172.18.0.0/24 is subnetted, 2 subnets
D        172.18.0.0 [90/26905600] via 172.16.0.21, 00:11:21, Tunnel0
D        172.18.22.0 [90/27033600] via 172.16.0.21, 00:11:21, Tunnel0

R12#ping 172.18.22.22 source 172.17.12.12
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.18.22.22, timeout is 2 seconds:
Packet sent with a source address of 172.17.12.12
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

crypto keyring KEY vrf FVRF 
  pre-shared-key address 10.0.0.21 key cisco
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac 
 mode tunnel
!
crypto ipsec profile IPSEC
 set transform-set TS 
!
interface Tunnel0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC

crypto keyring KEY vrf FVRF 
  pre-shared-key address 10.0.0.11 key cisco
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac 
 mode tunnel
!
crypto ipsec profile IPSEC
 set transform-set TS 
!
interface Tunnel0
 ip vrf forwarding IVRF
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC