在 FIPS 模式下配置 IPsec VPN
总结 本节提供用于在 FIPS 模式下配置 IPsec 的配置命令。
IPsec 隧道提供通过公共或不受信任网络的信息的设备身份验证、机密性和完整性。 图 1 显示了 IPsec VPN 隧道拓扑。
图 1:IPsec VPN 隧道拓扑
在路由器 1 上配置 IPsec VPN 服务
在本节中,您将为 IPsec VPN 配置运行 Junos OS 的路由器 1。
在路由器 2 上配置 IPsec VPN 服务
在本节中,您将配置运行 Junos OS 的路由器 2 以实现 IPsec VPN。
验证
确认配置工作正常。
目的
验证是否已创建 IPsec VPN 隧道。
行动
crypto-officer@hostname:fips> show services ipsec-vpn ike security-associations detail
IKE peer 10.0.1.2 Role: Initiator, State: Matured Initiator cookie: 5d73349e49090ae8, Responder cookie: 40f88e192c6538e1 Exchange type: IKEv2, Authentication method: Pre-shared-keys Local: 10.0.1.1, Remote: 10.0.1.2 Lifetime: Expires in 3578 seconds Algorithms: Authentication : hmac-sha256-128 Encryption : aes256-cbc Pseudo random function: hmac-sha256 Diffie-Hellman group : 20 Traffic statistics: Input bytes : 496 Output bytes : 496 Input packets: 2 Output packets: 2 Flags: IKE SA created IPSec security associations: 2 created, 0 deleted
crypto-officer@hostname:fips> show services ipsec-vpn ipsec security-associations detail
Service set: ss1, IKE Routing-instance: default Rule: rule1, Term: term1, Tunnel index: 1 Local gateway: 10.0.1.1, Remote gateway: 10.0.1.2 IPSec inside interface: ms-4/0/0.1, Tunnel MTU: 1500 UDP encapsulate: Disabled, UDP Destination port: 0 Local identity: ipv4_subnet(any:0,[0..7]=172.16.0.0/16) Remote identity: ipv4_subnet(any:0,[0..7]=192.168.0.0/16) NATT Detection: Not Detected, NATT keepalive interval: 0 Direction: inbound, SPI: 3546616983, AUX-SPI: 0 Mode: tunnel, Type: dynamic, State: Installed Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits) Soft lifetime: Expires in 27960 seconds Hard lifetime: Expires in 28766 seconds Anti-replay service: Enabled, Replay window size: 4096 Copy ToS: Enabled Copy TTL: Disabled, TTL value: 64 Direction: outbound, SPI: 4136721180, AUX-SPI: 0 Mode: tunnel, Type: dynamic, State: Installed Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits) Soft lifetime: Expires in 27960 seconds Hard lifetime: Expires in 28766 seconds Anti-replay service: Enabled, Replay window size: 4096 Copy ToS: Enabled Copy TTL: Disabled, TTL value: 64