IPSec的高可用性技术
IPSec VPN的高可用性技术：
①、DPD（Dead Peer Detection）对等体检测
——旨在检查有问题的IPSec VPN网络，并快速的切换到备用网关
②、RRI（Reverse Route Injection）反向路由注入
——解决高可用性的路由问题
****************DPD**************
DPD的工作模式：
周期性的工作模式——设置一个定时器，路由器会按照这个定时器所设置的时间周期性的发送DPD数据包； 好处在于快速的检测到对等体的问题；缺点是这样周期的发送DPD会消耗较多的设备资源和网络资源
按需工作模式——DPD默认的工作模式，这样的情况下，DPD信息会基于流量形式的不同而采取不同的发送方式。 好处是需要发送DPD的时候才发，节约资源和网络带宽；缺点是检测到IPSec VPN网关故障所需时间稍长。
实验拓扑：
默认配置完成，此时是可以建立起IPSec VPN的：
Site2#sho cry en conn active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
1 IPsec DES+MD5 0 10 13 23.1.1.3
2 IPsec DES+MD5 10 0 0 23.1.1.3
1001 IKE SHA+DES 0 0 0 23.1.1.3
那么我们来看一下在没有DPD功能的时候：
Site1#debug crypto isakmp
Crypto ISAKMP debugging is on
Internet(config)#int f1/0
Internet(config-if)#shu
Site1#ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.....
Success rate is 0 percent (0/5)
Site1#sho cry en conn active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
1 IPsec DES+MD5 0 8 9 12.1.1.1
2 IPsec DES+MD5 19 0 0 12.1.1.1
1001 IKE SHA+DES 0 0 0 12.1.1.1
这说明没有启用DPD技术的时候，IPSec VPN无法探测有问题的网关，因此会继续使用又问题的IPSec SA加密数据包，接下来再看启用了DPD的情况：
Site1(config)#crypto isakmp keepalive ?
<10-3600> Number of seconds between keep alives
Site1(config)#crypto isakmp keepalive 10 periodic
Site2(config)#crypto isakmp keepalive 10 periodic
Site1/2#cle crypto isakmp
Site1/2#cle crypto sa
Internet(config)#int f1/0
Internet(config-if)#no shu
此时Site1和Site2之间又恢复了通信：
Site1#ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 184/208/240 ms
那么在来看一下DPD检测失效网关的效果：
Apr 22 23:56:20.535: ISAKMP:(1002):Sending NOTIFY DPD/R_U_THERE protocol 1
spi 1746747408, message ID = 1135002381
*Apr 22 23:56:20.535: ISAKMP:(1002): seq. no 0x1B47B85D
*Apr 22 23:56:20.535: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:20.535: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:20.539: ISAKMP:(1002):purging node 1135002381
*Apr 22 23:56:20.539: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_IM_ALIVE
*Apr 22 23:56:20.543: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Site1#
*Apr 22 23:56:20.767: ISAKMP:(1002):purging node 593664099
Site1#
*Apr 22 23:56:22.539: ISAKMP:(1002):DPD incrementing error counter (1/5)
*Apr 22 23:56:22.539: ISAKMP: set new node 511611758 to QM_IDLE
*Apr 22 23:56:22.539: ISAKMP:(1002):Sending NOTIFY DPD/R_U_THERE protocol 1
spi 1746747408, message ID = 511611758
*Apr 22 23:56:22.539: ISAKMP:(1002): seq. no 0x1B47B85E
*Apr 22 23:56:22.539: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:22.543: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:22.543: ISAKMP:(1002):purging node 511611758
*Apr 22 23:56:22.547: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE
Site1#
*Apr 22 23:56:22.547: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Site1#
*Apr 22 23:56:24.543: ISAKMP:(1002):DPD incrementing error counter (2/5)
*Apr 22 23:56:24.543: ISAKMP: set new node -2042738143 to QM_IDLE
*Apr 22 23:56:24.547: ISAKMP:(1002):Sending NOTIFY DPD/R_U_THERE protocol 1
spi 1746747408, message ID = -2042738143
*Apr 22 23:56:24.547: ISAKMP:(1002): seq. no 0x1B47B85F
*Apr 22 23:56:24.551: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:24.551: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:24.551: ISAKMP:(1002):purging node -2042738143
*Apr 22 23:56:24.555: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE
Site1#
*Apr 22 23:56:24.555: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Site1#
*Apr 22 23:56:26.555: ISAKMP:(1002):DPD incrementing error counter (3/5)
*Apr 22 23:56:26.555: ISAKMP: set new node 1264419706 to QM_IDLE
*Apr 22 23:56:26.559: ISAKMP:(1002):Sending NOTIFY DPD/R_U_THERE protocol 1
spi 1746747408, message ID = 1264419706
*Apr 22 23:56:26.559: ISAKMP:(1002): seq. no 0x1B47B860
*Apr 22 23:56:26.559: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:26.563: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:26.563: ISAKMP:(1002):purging node 1264419706
*Apr 22 23:56:26.567: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE
Site1#
*Apr 22 23:56:26.567: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Site1#
*Apr 22 23:56:28.007: ISAKMP:(1002):purging node 519630341
*Apr 22 23:56:28.567: ISAKMP:(1002):DPD incrementing error counter (4/5)
*Apr 22 23:56:28.567: ISAKMP: set new node 2041023417 to QM_IDLE
*Apr 22 23:56:28.571: ISAKMP:(1002):Sending NOTIFY DPD/R_U_THERE protocol 1
spi 1746747408, message ID = 2041023417
*Apr 22 23:56:28.571: ISAKMP:(1002): seq. no 0x1B47B861
*Apr 22 23:56:28.571: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:28.575: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:28.575: ISAKMP:(1002):purging node 2041023417
Site1#
*Apr 22 23:56:28.579: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE
*Apr 22 23:56:28.579: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
Site1#
*Apr 22 23:56:30.579: ISAKMP:(1002):DPD incrementing error counter (5/5)
*Apr 22 23:56:30.579: ISAKMP:(1002):peer 23.1.1.3 not responding!
*Apr 22 23:56:30.583: ISAKMP:(1002):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE
*Apr 22 23:56:30.583: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Apr 22 23:56:30.595: ISAKMP (1002): No more ipsec tunnels for this SA.
*Apr 22 23:56:30.599: ISAKMP: set new node 1589052764 to QM_IDLE
*Apr 22 23:56:30.603: ISAKMP:(1002): sending packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:30.603: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:30.607: ISAKMP:(1002):purging node 1589052764
*Apr 22 23:56:30.607: ISAKMP:(1002):Input = IKE_MESG_FROM_IPSEC, IKE_PHASE2_DEL
*Apr 22 23:56:30.611: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Apr 22 23:56:30.619: ISAKMP: set new node 1168250615 to QM_IDLE
*Apr 22 23:56:30.619: ISAKMP:(1002): send
Site1#ing packet to 23.1.1.3 my_port 500 peer_port 500 (I) QM_IDLE
*Apr 22 23:56:30.623: ISAKMP:(1002):Sending an IKE IPv4 Packet.
*Apr 22 23:56:30.623: ISAKMP:(1002):purging node 1168250615
*Apr 22 23:56:30.627: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Apr 22 23:56:30.627: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA
*Apr 22 23:56:30.635: ISAKMP:(1002):deleting SA reason "No reason" state (I) QM_IDLE (peer 23.1.1.3)
*Apr 22 23:56:30.635: ISAKMP: Unlocking peer struct 0x68665020 for isadb_mark_sa_deleted(), count 0
*Apr 22 23:56:30.639: ISAKMP: Deleting peer node by peer_reap for 23.1.1.3: 68665020
*Apr 22 23:56:30.643: ISAKMP:(1002):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr 22 23:56:30.643: ISAKMP:(1002):Old State = IKE_DEST_SA New State = IKE_DEST_SA
*Apr 22 23:56:30.887: ISAKMP:(1002):purging node -1414911362
可以看到的是：Site1上的DPD中，如果Site1周期性的发送的DPD信息没有得到远端的确认，那么会连续发送5次，若5次都没有远端的确认。site1马上就会清楚本地的IPSec和ISAKMP安全关联：
Site1#show crypto engine connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
Site2#sho cry en conn active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
以上的配置DPD会周期的发送。DPD按需工作模式会基于流量形式的不同而采取不同的发送方式，若IPSec VPN有持续的流量加密发送，并且还能持续解密对端发来的数据，那么此时，按需工作模式就会认为一切正常，不需要发送DPD：而在当一个数据加密发送出去，在一定的时间内没有收到任何的解密数据包额情况下，DPD才会怀疑IPSec VPN出现问题，发送DPD。若很快收到了DPD确认，那么表示远端正常，若一定的时间内没有收到DPD确认，那么也是5次之后，删除所有安全连接。
下面是按需发送的配置：
Site1(config)#no crypto isakmp keepalive 10 periodic
Site1(config)#crypto isakmp keepalive 10 //加密数据发出后10秒没有收到解密数据包，就发送DPD进行探测
Site2(config)#no crypto isakmp keepalive 10 periodic
Site2(config)#crypto isakmp keepalive 10
值得注意的是：在10秒后连续5次Site1删除本地的所有安全关联，但是在Site2上还是存在，除非Site2发出加密数据包，10秒内未得到解密数据包。
**************RRI********************
什么时候注入（动态产生）这一条路由呢？
在产生IPSec SA 的同时也产生这条路由，在IPSec SA消失的时候，也随之消失。由RRI产生的路由，其目的网络为远端通信网络，下一跳为远端加密点（也可以认为是隧道的终点）。
下面是测试RRI的工作特性，拓扑如下：
默认经典的IPSec VPN以及建立成功：
Site2#sho cry en connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
1 IPsec DES+MD5 0 3 4 23.1.1.3
2 IPsec DES+MD5 3 0 0 23.1.1.3
1001 IKE SHA+DES 0 0 0 23.1.1.3
Site2(config)#crypto map cisco 10 ipsec-isakmp
Site2(config-crypto-map)#reverse-route
Site2(config-crypto-map)#set reverse-route tag 10
This will remove previously installed VPN routes and SAs
Site2(config-crypto-map)#exi
Site2(config)#route-map RRI permit 10
Site2(config-route-map)#match tag 10
Site2(config-route-map)#exi
Site2(config)#int f1/1
Site2(config-if)#ip add 35.1.1.3 255.255.255.0
Site2(config-if)#no shu
Site2(config-if)#int lo0
Site2(config-if)#no ip add
Site2(config-if)#end
Site2#conf t
Site2(config)#router os 1
Site2(config-router)#router-id 2.2.2.2
Site2(config-router)#net 35.1.1.0 0.0.0.255 a 0
Site2(config-router)#end
R5(config)#int f1/0
R5(config-if)#ip add 35.1.1.5 255.255.255.0
R5(config-if)#no sh
R5(config)#int lo0
R5(config-if)#ip add 3.3.3.3 255.255.255.0
R5(config-if)#router os 1
R5(config-router)#router-id 5.5.5.5
R5(config-router)#net 0.0.0.0 255.255.255.255 a 0
R5(config-router)#exi
现在的情况是在R5上没有R1的1.1.1.1的路由，因为反向注入还没有实施，所以即使匹配上了感兴趣流，但是还是不能通信
Site1#cle access-list counters
Site1#ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.....
Success rate is 0 percent (0/5)
Site2#sho access-lists
Extended IP access list vpn
10 permit ip 3.3.3.0 0.0.0.255 1.1.1.0 0.0.0.255 (4 matches)
下面是将RRI注入OSPF网络的配置：
Site2(config)#router os 1
Site2(config-router)#redistribute static route-map RRI subnets
Site2#sho ip ro static
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 23.1.1.2 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 23.1.1.2
1.0.0.0/24 is subnetted, 1 subnets
S 1.1.1.0 [1/0] via 12.1.1.1
可以看到的是这里的RRI产生的静态是下一跳为12.1.1.1的，就是peer的加密点的地址
Site1#ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 328/365/408 ms
Site1#show crypto engine connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
7 IPsec DES+MD5 0 5 5 12.1.1.1
8 IPsec DES+MD5 5 0 0 12.1.1.1
1002 IKE SHA+DES 0 0 0 12.1.1.1
此时在R5的路由表中肯定有OE2的OSPF路由了：
R5#sho ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is not set
1.0.0.0/24 is subnetted, 1 subnets
O E2 1.1.1.0 [110/20] via 35.1.1.3, 00:00:03, FastEthernet1/0
