Centos8与华为USG建立GRE over ipsec隧道
拓扑
需求：centos8与防火墙建立gre over ipsec
GRE-linux端配置：
[root@localhost ~]# cat set_gre.sh
#!bin/bash
interface_name="gre1"
local_ip="10.0.2.2" #本端地址，注意这里nat环境的话，是写内网接口地址
remote_ip="201.1.1.2" #对端公网地址
ipaddress="10.10.10.1" #本端gre tunnel口ip
peer_address="10.10.10.2/32" #对端gre tunnel口ip
route_net="192.168.10.0/24" #添加路由
modprobe ip_gre #加载gre模块
ip tunnel add $interface_name mode gre remote $remote_ip local $local_ip ttl 255 #gre隧道
ip add add $ipaddress peer $peer_address dev $interface_name #设置gre接口IP
ip link set $interface_name up #设置接口up
ip route add $route_net dev $interface_name #添加路由
GRE-华为USG配置
interface GigabitEthernet1/0/0
ip address 201.1.1.2 255.255.255.0
#
interface Tunnel0
ip address 10.10.10.2 255.255.255.0
tunnel-protocol gre
source 201.1.1.2
destination 1.1.1.2 #对端nat后的地址
#
firewall zone trust
add interface Tunnel0
#
firewall zone untrust
add interface GigabitEthernet1/0/0
#
security-policy
rule name permit_any
action permit
#
ip route-static 0.0.0.0 0.0.0.0 201.1.1.1
#
建立Ipsec加密数据
华为端ipsec配置：
ip address-set net1 type object
address 0 192.168.10.0 mask 24
#
ip address-set net2 type object
address 0 192.168.11.0 mask 24
#
acl number 3000
rule 5 permit ip source address-set net1 destination address-set net2
#
ipsec proposal prop2824463376
encapsulation-mode auto
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
ike peer ike2824463376
exchange-mode auto
pre-shared-key %^%#7HCS,w2^w&e-A-H<sFY9m#ZM9{A})*B@iF"Ac0I5%^%#
ike-proposal 1
remote-id-type none
local-id 10.10.10.2
dpd type periodic
remote-address 10.10.10.1
#
ipsec policy ipsec2824462928 1 isakmp
security acl 3000
ike-peer ike2824463376
proposal prop2824463376
tunnel local applied-interface
alias ipsec1
sa trigger-mode auto
sa duration traffic-based 10485760
sa duration time-based 3600
#
interface LoopBack0
ip address 192.168.10.1 255.255.255.0
#
interface Tunnel0
ip address 10.10.10.2 255.255.255.0
tunnel-protocol gre
source 201.1.1.2
destination 1.1.1.2
ipsec policy ipsec2824462928
#
ip route-static 192.168.11.0 255.255.255.0 10.10.10.1
centos ipsec配置
1.开启流量转发
cp -pv /etc/sysctl.conf{,.old}
vim /etc/sysctl.conf
## Controls IP packet forwarding
net.ipv4.ip_forward = 1
## Controls source route verification
net.ipv4.conf.default.rp_filter = 0
禁用send_redirects。
sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print$1"= 0"}'
sysctl -a | egrep "ipv4.*(accept|send)_redirects" | awk -F "=" '{print$1"= 0"}' >> /etc/sysctl.conf
保存sysctl.conf
sysctl -p
setenforce关闭
setenforce 0
安装配置
yum install -y libreswan
检查环境，要全部Ok
ipsec verify
有一个报错：临时解决：
echo "0" >/proc/sys/net/ipv4/conf/all/rp_filter
配置文件：/etc/ipsec.d/test-vm.conf
[root@localhost ~]# cat /etc/ipsec.d/test-vm.conf
conn test-vm-test
### phase 1 ###
authby=secret
#指定认证类型预共享秘钥
ike=aes256-sha256;dh14
#指定第一阶段ike的算法
keyexchange=ike
# 指定ike
### phase 2 ###
esp=aes256-sha256
# 指定是否压缩
compress=no
# 指定是否加密
pfs=yes
# 指定连接添加类型。start 为开机自启，add为添加 不主动连接
auto=start
# 指定模式类型为隧道模式|传输模式
type=tunnel
#本端发起连接的ip
left=10.10.10.1
#匹配本地要加密的网段
leftsubnet=192.168.11.0/24
#本端id
leftid=10.10.10.1
#会自动将本地网络流量通过系统的默认路由（即默认网关）转发到远程网络。简化配置：无需手动指定具体的下一跳 IP 地址，系统会自动使用默认路由。
leftnexthop=%defaultroute
#对端ip
right=10.10.10.2
#匹配对端要加密的网段
rightsubnet=192.168.10.0/24
#对端端id
rightid=10.10.10.10.2
rightnexthop=%defaultroute
共享秘钥：/etc/ipsec.d/test-vm.secrets
[root@localhost ~]# cat /etc/ipsec.d/test-vm.secrets
0.0.0.0 0.0.0.0 : PSK "123456789"
启动ipsec
systemctl restart ipsec
添加路由
ip a a 192.168.11.1/24 dev ens4
ip route add 192.168.10.0/24 dev gre1
验证
ipsec status
ipsec status全部日志
[root@localhost ~]# ipsec status
000 using kernel interface: xfrm
000
000 interface lo UDP [::1]:500
000 interface lo UDP 127.0.0.1:4500
000 interface lo UDP 127.0.0.1:500
000 interface ens3 UDP 10.0.2.2:4500
000 interface ens3 UDP 10.0.2.2:500
000 interface virbr0 UDP 192.168.122.1:4500
000 interface virbr0 UDP 192.168.122.1:500
000 interface gre1 UDP 10.10.10.1:4500
000 interface gre1 UDP 10.10.10.1:500
000
000 fips mode=disabled;
000 SElinux=disabled
000 seccomp=disabled
000
000 config setup options:
000
000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
000 nssdir=/etc/ipsec.d, dumpdir=/run/pluto, statsbin=unset
000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=<unset>
000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
000 pluto_version=4.4, pluto_vendorid=OE-Libreswan-4.4, audit-log=yes
000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=30s
000 ddos-cookies-threshold=25000, ddos-max-halfopen=50000, ddos-mode=auto, ikev1-policy=accept
000 ikebuf=0, msg_errqueue=yes, crl-strict=no, crlcheckinterval=0, listen=<any>, nflog-all=0
000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=<unset>
000 ocsp-trust-name=<unset>
000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
000 global-redirect=no, global-redirect-to=<unset>
000 secctx-attr-type=32001
000 debug:
000
000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
000 virtual-private (%priv):
000 - allowed subnets: 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, 100.64.0.0/10, fd00::/8, fe80::/10, <unset-subnet>
000
000 Kernel algorithms supported:
000
000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256
000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256
000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128
000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384
000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512
000 algorithm AH/ESP auth: name=NONE, key-length=0
000
000 IKE algorithms supported:
000
000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256
000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
000 algorithm IKE DH Key Exchange: name=MODP1024, bits=1024
000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
000 algorithm IKE DH Key Exchange: name=DH19, bits=512
000 algorithm IKE DH Key Exchange: name=DH20, bits=768
000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
000 algorithm IKE DH Key Exchange: name=DH31, bits=256
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
000
000 Connection list:
000
000 "test-vm-test": 192.168.11.0/24===10.10.10.1<10.10.10.1>---10.0.2.1...10.10.10.2<10.10.10.2>===192.168.10.0/24; erouted; eroute owner: #2
000 "test-vm-test": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
000 "test-vm-test": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
000 "test-vm-test": our auth:secret, their auth:secret
000 "test-vm-test": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, cat:unset;
000 "test-vm-test": sec_label:unset;
000 "test-vm-test": ike_life: 28800s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "test-vm-test": retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
000 "test-vm-test": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "test-vm-test": policy: IKEv2+PSK+ENCRYPT+TUNNEL+PFS+UP+IKE_FRAG_ALLOW+ESN_NO;
000 "test-vm-test": v2-auth-hash-policy: none;
000 "test-vm-test": conn_prio: 24,24; interface: gre1; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "test-vm-test": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "test-vm-test": our idtype: ID_IPV4_ADDR; our id=10.10.10.1; their idtype: ID_IPV4_ADDR; their id=10.10.10.2
000 "test-vm-test": dpd: action:hold; delay:0; timeout:0; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
000 "test-vm-test": newest ISAKMP SA: #1; newest IPsec SA: #2; conn serial: $1;
000 "test-vm-test": IKE algorithms: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test-vm-test": IKEv2 algorithm newest: AES_CBC_256-HMAC_SHA2_256-MODP2048
000 "test-vm-test": ESP algorithms: AES_CBC_256-HMAC_SHA2_256_128
000 "test-vm-test": ESP algorithm newest: AES_CBC_256-HMAC_SHA2_256_128; pfsgroup=<Phase1>
000
000 Total IPsec connections: loaded 1, active 1
000
000 State Information: DDoS cookies not required, Accepting new IKE connections
000 IKE SAs: total(1), half-open(0), open(0), authenticated(1), anonymous(0)
000 IPsec SAs: total(1), authenticated(1), anonymous(0)
000
000 #1: "test-vm-test":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); EVENT_SA_REKEY in 26150s; newest ISAKMP; idle;
000 #2: "test-vm-test":500 STATE_V2_ESTABLISHED_CHILD_SA (IPsec SA established); EVENT_SA_REKEY in 26391s; newest IPSEC; eroute owner; isakmp#1; idle;
000 #2: "test-vm-test" esp.b884094@10.10.10.2 esp.a2f63cd4@10.10.10.1 tun.0@10.10.10.2 tun.0@10.10.10.1 Traffic: ESPin=420B ESPout=420B! ESPmax=0B
000
000 Bare Shunt list:
000
华为USG ipsec sa
[USG6000V2]dis ipsec sa
2025-02-28 15:10:00.720 +08:00
ipsec sa information:
===============================
Interface: Tunnel0
===============================
-----------------------------
IPSec policy name: "ipsec2824462928"
Sequence number : 1
Acl group : 3000
Acl rule : 5
Mode : ISAKMP
-----------------------------
Connection ID : 16777381
Encapsulation mode: Tunnel
Holding time : 0d 0h 29m 42s
Tunnel local : 10.10.10.2:500
Tunnel remote : 10.10.10.1:500
Flow source : 192.168.10.0/255.255.255.0 0/0-65535
Flow destination : 192.168.11.0/255.255.255.0 0/0-65535
[Outbound ESP SAs]
SPI: 2734046420 (0xa2f63cd4)
Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
SA remaining key duration (kilobytes/sec): 0/603019
Max sent sequence-number: 6
UDP encapsulation used for NAT traversal: N
SA encrypted packets (number/bytes): 5/420
[Inbound ESP SAs]
SPI: 193478804 (0xb884094)
Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
SA remaining key duration (kilobytes/sec): 0/603019
Max received sequence-number: 1
UDP encapsulation used for NAT traversal: N
SA decrypted packets (number/bytes): 5/420
Anti-replay : Enable
Anti-replay window size: 1024
ike sa
[USG6000V2] dis ike sa
2025-02-28 15:19:09.480 +08:00
IKE SA information :
Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID
------------------------------------------------------------------------------------------------------------------------------------
16777381 10.10.10.1:500 RD|A v2:2 IP 10.10.10.1
16777380 10.10.10.1:500 RD|A v2:1 IP 10.10.10.1
Number of IKE SA : 2
------------------------------------------------------------------------------------------------------------------------------------
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING
验证测试
ping测试：
抓包：
linux主机抓包
tcpdump -n -i gre1 esp or udp port 500 or udp port 4500
浙公网安备 33010602011771号