Linux 虚拟网络 IPSec

合集 - Linux Network(9)

1.Containerlab（转载）2024-06-14 2.VyOS(转载)2024-06-14 3.Containerlab + VyOS 模拟三层网络2024-06-14 4.Linux 虚拟网络设备 veth pair2024-06-15 5.Linux 虚拟网络 host gw2024-06-15 6.Linux 虚拟网络 VXLAN2024-06-18 7.Linux 虚拟网络 IPIP2024-06-18

8.Linux 虚拟网络 IPSec2024-07-05

9.Linux 虚拟网络 Wireguard2024-07-06

`IPSec`

IPsec（Internet Protocol Security）是为IP网络提供安全性的协议和服务的集合，它是VPN（Virtual Private Network，虚拟专用网）中常用的一种技术。由于IP报文本身没有集成任何安全特性，IP数据包在公用网络如Internet中传输可能会面临被伪造、窃取或篡改的风险。通信双方通过IPsec建立一条IPsec隧道，IP数据包通过IPsec隧道进行加密传输，有效保证了数据在不安全的网络环境如Internet中传输的安全性。

一、手动搭建 `ipsec` 网络

a | 拓扑

-----------------            -----------------
|      ns1      |            |      ns1      |
|   1.1.1.2/24  |            |   1.1.2.2/24  |
|       |       |            |       |       |
|       |       |            |       |       |
|       |       |            |       |       |
|-------|-------|            |-------|-------|      
      ens33                        ens33
        |----------------------------|
172.16.94.141     ipsec tunnel     172.16.94.142

b | 配置命令

host 141 主机配置命令

# host 141
## 创建名称空间
ip netns a ns1

## 创建 1对 veth pair 网卡
ip l a int0 type veth peer name br0
ip l s br0 up
ip a a 1.1.1.1/24 dev br0

## ns1 配置信息，网卡 int0 分配到 ns1
ip l s int0 netns ns1
ip netns exec ns1 ip l s int0 up
ip netns exec ns1 ip a a 1.1.1.2/24  dev int0
ip netns exec ns1 ip r a default via 1.1.1.1 dev int0

## create the ip xfrm state and ip xfrm policy:
# ID=0x`dd if=/dev/urandom count=4 bs=1 2> /dev/null| xxd -p -c 8``
# KEY=0x`dd if=/dev/urandom count=20 bs=1 2> /dev/null| xxd -p -c 40`

ID=0xfe51d978
KEY=0xfa42aa6bc685beb4d967057134dd8e327ca179a6
ip xfrm state flush
ip xfrm policy flush
ip xfrm state add src 172.16.94.141 dst 172.16.94.142 proto esp spi $ID reqid $ID mode tunnel aead 'rfc4106(gcm(aes))' $KEY 128
ip xfrm state add src 172.16.94.142 dst 172.16.94.141 proto esp spi $ID reqid $ID mode tunnel aead 'rfc4106(gcm(aes))' $KEY 128

ip xfrm policy add src 1.1.1.2/24 dst 1.1.2.2/24 dir out tmpl src 172.16.94.141 dst 172.16.94.142 proto esp reqid $ID mode tunnel
ip xfrm policy add src 1.1.2.2/24 dst 1.1.1.2/24 dir fwd tmpl src 172.16.94.142 dst 172.16.94.141 proto esp reqid $ID mode tunnel
ip xfrm policy add src 1.1.2.2/24 dst 1.1.1.2/24 dir in  tmpl src 172.16.94.142 dst 172.16.94.141 proto esp reqid $ID mode tunnel

host 142 主机配置命令

# host 142
## 创建名称空间
ip netns add ns1

## 创建 1对 veth pair 网卡
ip l a int0 type veth peer name br0
ip l s br0 up
ip a a 1.1.2.1/24 dev br0

## ns1 配置信息，网卡 int0 分配到 ns1
ip l s int0 netns ns1
ip netns exec ns1 ip l s int0 up
ip netns exec ns1 ip a a 1.1.2.2/24 dev int0
ip netns exec ns1 ip r a default via 1.1.2.1 dev int0


## create the ip xfrm state and ip xfrm policy:
# ID=0x`dd if=/dev/urandom count=4 bs=1 2> /dev/null| xxd -p -c 8``
# KEY=0x`dd if=/dev/urandom count=20 bs=1 2> /dev/null| xxd -p -c 40`

ID=0xfe51d978
KEY=0xfa42aa6bc685beb4d967057134dd8e327ca179a6
ip xfrm state flush
ip xfrm policy flush
ip xfrm state add src 172.16.94.142 dst 172.16.94.141 proto esp spi $ID reqid $ID mode tunnel aead 'rfc4106(gcm(aes))' $KEY 128
ip xfrm state add src 172.16.94.141 dst 172.16.94.142 proto esp spi $ID reqid $ID mode tunnel aead 'rfc4106(gcm(aes))' $KEY 128

ip xfrm policy add src 1.1.2.2/24 dst 1.1.1.2/24 dir out tmpl src 172.16.94.142 dst 172.16.94.141 proto esp reqid $ID mode tunnel
ip xfrm policy add src 1.1.1.2/24 dst 1.1.2.2/24 dir fwd tmpl src 172.16.94.141 dst 172.16.94.142 proto esp reqid $ID mode tunnel
ip xfrm policy add src 1.1.1.2/24 dst 1.1.2.2/24 dir in  tmpl src 172.16.94.141 dst 172.16.94.142 proto esp reqid $ID mode tunnel

host 141 主机 ipsec 信息

root@kind:~# ip x s
src 172.16.94.142 dst 172.16.94.141
        proto esp spi 0xfe51d978 reqid 4266776952 mode tunnel
        replay-window 0 
        aead rfc4106(gcm(aes)) 0xfa42aa6bc685beb4d967057134dd8e327ca179a6 128
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0 
src 172.16.94.141 dst 172.16.94.142
        proto esp spi 0xfe51d978 reqid 4266776952 mode tunnel
        replay-window 0 
        aead rfc4106(gcm(aes)) 0xfa42aa6bc685beb4d967057134dd8e327ca179a6 128
        anti-replay context: seq 0x0, oseq 0x2, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0 

root@kind:~# ip x p
src 1.1.2.2/24 dst 1.1.1.2/24 
        dir in priority 0 
        tmpl src 172.16.94.142 dst 172.16.94.141
                proto esp reqid 4266776952 mode tunnel
src 1.1.2.2/24 dst 1.1.1.2/24 
        dir fwd priority 0 
        tmpl src 172.16.94.142 dst 172.16.94.141
                proto esp reqid 4266776952 mode tunnel
src 1.1.1.2/24 dst 1.1.2.2/24 
        dir out priority 0 
        tmpl src 172.16.94.141 dst 172.16.94.142
                proto esp reqid 4266776952 mode tunnel

host 142 主机 ipsec 信息

root@clab:~# ip x s
src 172.16.94.141 dst 172.16.94.142
        proto esp spi 0xfe51d978 reqid 4266776952 mode tunnel
        replay-window 0 
        aead rfc4106(gcm(aes)) 0xfa42aa6bc685beb4d967057134dd8e327ca179a6 128
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0 
src 172.16.94.142 dst 172.16.94.141
        proto esp spi 0xfe51d978 reqid 4266776952 mode tunnel
        replay-window 0 
        aead rfc4106(gcm(aes)) 0xfa42aa6bc685beb4d967057134dd8e327ca179a6 128
        anti-replay context: seq 0x0, oseq 0x1, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0 

root@clab:~# ip x p
src 1.1.1.2/24 dst 1.1.2.2/24 
        dir in priority 0 
        tmpl src 172.16.94.141 dst 172.16.94.142
                proto esp reqid 4266776952 mode tunnel
src 1.1.1.2/24 dst 1.1.2.2/24 
        dir fwd priority 0 
        tmpl src 172.16.94.141 dst 172.16.94.142
                proto esp reqid 4266776952 mode tunnel
src 1.1.2.2/24 dst 1.1.1.2/24 
        dir out priority 0 
        tmpl src 172.16.94.142 dst 172.16.94.141
                proto esp reqid 4266776952 mode tunnel

c | 测试网络

root@kind:~# ip netns exec ns1 ping 1.1.2.2 -c 1
PING 1.1.2.2 (1.1.2.2) 56(84) bytes of data.
64 bytes from 1.1.2.2: icmp_seq=1 ttl=62 time=0.563 ms

--- 1.1.2.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.563/0.563/0.563/0.000 ms

d | 抓包分析

141 主机 ns 名称空间进行 ping 包测试

root@kind:~# ip netns exec ns1 ping 1.1.2.2 -c 1
PING 1.1.2.2 (1.1.2.2) 56(84) bytes of data.
64 bytes from 1.1.2.2: icmp_seq=1 ttl=62 time=9.43 ms

--- 1.1.2.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 9.431/9.431/9.431/0.000 ms

141 主机 ns1 名称空间 int0 网卡抓包

root@kind:~# ip netns exec ns1 ip a l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
6: int0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether c6:d8:82:be:42:55 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 1.1.1.2/24 scope global int0
       valid_lft forever preferred_lft forever
    inet6 fe80::c4d8:82ff:febe:4255/64 scope link 
       valid_lft forever preferred_lft forever

root@kind:~# ip netns exec ns1 tcpdump -pne -i int0
08:24:12.078337 c6:d8:82:be:42:55 > 16:48:39:b5:42:19, ethertype IPv4 (0x0800), length 98: 1.1.1.2 > 1.1.2.2: ICMP echo request, id 7429, seq 1, length 64
08:24:12.079530 16:48:39:b5:42:19 > c6:d8:82:be:42:55, ethertype IPv4 (0x0800), length 98: 1.1.2.2 > 1.1.1.2: ICMP echo reply, id 7429, seq 1, length 64

源 mac 地址为 int0 网卡 mac 地址，目的 mac 地址为 veth pair 网卡 br0 mac 地址

141 主机网卡，路由信息

# 网卡信息
root@kind:~# ip a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:18:be:6c brd ff:ff:ff:ff:ff:ff
    altname enp2s1
    inet 172.16.94.141/24 brd 172.16.94.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe18:be6c/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:f1:91:d1:46 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
4: br-e9fae772bb31: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:7e:b1:2f:69 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-e9fae772bb31
       valid_lft forever preferred_lft forever
    inet6 fc00:f853:ccd:e793::1/64 scope global tentative 
       valid_lft forever preferred_lft forever
    inet6 fe80::1/64 scope link tentative 
       valid_lft forever preferred_lft forever
5: br0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 16:48:39:b5:42:19 brd ff:ff:ff:ff:ff:ff link-netns ns1
    inet 1.1.1.1/24 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::1448:39ff:feb5:4219/64 scope link 
       valid_lft forever preferred_lft forever

# 路由信息
root@kind:~# ip r s
default via 172.16.94.2 dev ens33 proto static 
1.1.1.0/24 dev br0 proto kernel scope link src 1.1.1.1 
172.16.94.0/24 dev ens33 proto kernel scope link src 172.16.94.141 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.18.0.0/16 dev br-e9fae772bb31 proto kernel scope link src 172.18.0.1 linkdown

141 主机 br0 网卡抓包

root@kind:~# tcpdump -pne -i br0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:26:05.743927 c6:d8:82:be:42:55 > 16:48:39:b5:42:19, ethertype IPv4 (0x0800), length 98: 1.1.1.2 > 1.1.2.2: ICMP echo request, id 7554, seq 1, length 64
08:26:05.744621 16:48:39:b5:42:19 > c6:d8:82:be:42:55, ethertype IPv4 (0x0800), length 98: 1.1.2.2 > 1.1.1.2: ICMP echo reply, id 7554, seq 1, length 64

抓包信息同 ns1 名称空间 int0 网卡，因为他们互为 veth pair 网卡

141 主机 eth0 网卡抓包，并使用 wireshare 分析

搜索 esp 数据包， ipsec 模式下，数据包是密文 esp 数据包，需要进行解密后，才能查看。解密 esp 数据包，获取到如下图数据信息

esp 数据层，下面有多了新的数据层，包括 ip 层信息和 icmp 信息

ipsec 模式下，内部数据包信息没有 mac 信息，只到了 ip 层后，即进行了 ipsec 封装，比较类似 ipip 模式， ipip 数据包内层包也没有 mac 信息，但是 ipip 数据包非加密，不需要使用解密即可查看到包信息

142 主机 eth0 网卡抓包，并使用 wireshare 分析

数据包信息同 141 主机 eth0 网卡信息

142 主机 br0 网卡抓包

root@clab:~# tcpdump -pne -i br0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:33:16.508361 1a:1d:1f:7c:5f:ec > 9e:1e:fc:13:e9:4d, ethertype IPv4 (0x0800), length 98: 1.1.1.2 > 1.1.2.2: ICMP echo request, id 8004, seq 1, length 64
08:33:16.508397 9e:1e:fc:13:e9:4d > 1a:1d:1f:7c:5f:ec, ethertype IPv4 (0x0800), length 98: 1.1.2.2 > 1.1.1.2: ICMP echo reply, id 8004, seq 1, length 64

源 mac 地址为 br0 网卡 mac 地址，目的 mac 地址为 ns1 名称空间 int0 网卡 mac 地址

root@clab:~# ip netns exec ns1 ip a l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
6: int0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9e:1e:fc:13:e9:4d brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 1.1.2.2/24 scope global int0
       valid_lft forever preferred_lft forever
    inet6 fe80::9c1e:fcff:fe13:e94d/64 scope link 
       valid_lft forever preferred_lft forever

e | 资源回收

## 141
# ip netns del ns1 && reboot

## 142
# ip netns del ns1 && reboot

二、使用 `Containerlab` 模拟网络

a | 拓扑

b | 网络拓扑文件

# ipsec.clab.yml
name: ipsec
topology:
  nodes:
    gw1:
      kind: linux
      image: vyos/vyos:1.2.8
      cmd: /sbin/init
      binds:
        - /lib/modules:/lib/modules
        - ./startup-conf/gw1.cfg:/opt/vyatta/etc/config/config.boot

    gw2:
      kind: linux
      image: vyos/vyos:1.2.8
      cmd: /sbin/init
      binds:
        - /lib/modules:/lib/modules
        - ./startup-conf/gw2.cfg:/opt/vyatta/etc/config/config.boot

    server1:
      kind: linux
      image: harbor.dayuan1997.com/devops/nettool:0.9
      exec:
      - ip addr add 10.1.5.10/24 dev net0
      - ip route replace default via 10.1.5.1

    server2:
      kind: linux
      image: harbor.dayuan1997.com/devops/nettool:0.9
      exec:
      - ip addr add 10.1.8.10/24 dev net0
      - ip route replace default via 10.1.8.1


  links:
    - endpoints: ["gw1:eth1", "server1:net0"]
    - endpoints: ["gw2:eth1", "server2:net0"]
    - endpoints: ["gw1:eth2", "gw2:eth2"]

c | `VyOS` 配置文件

gw1.cfg

配置文件

# ./startup-conf/gw1.cfg

interfaces {
    ethernet eth1 {
        address 10.1.5.1/24
        duplex auto
        smp-affinity auto
        speed auto
    }
    ethernet eth2 {
        address 172.12.1.10/24
        duplex auto
        smp-affinity auto
        speed auto
    }
    loopback lo {
    }
}
protocols {
    static {
        # 静态路由，指定到达 10.1.8.0/24 网络的下一条为 172.12.1.11
        route 10.1.8.0/24 {
            next-hop 172.12.1.11 {
            }
        }
    }
}
system {
    config-management {
        commit-revisions 100
    }
    console {
        device ttyS0 {
            speed 9600
        }
    }
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password $6$QxPS.uk6mfo$9QBSo8u1FkH16gMyAVhus6fU3LOzvLR9Z9.82m3tiHFAxTtIkhaZSWssSgzt4v4dGAL8rhVQxTg0oAG9/q11h/
                plaintext-password ""
            }
            level admin
        }
    }
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
        server 2.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level info
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}
vpn {
    ipsec {
        esp-group office-srv-esp {
            compression disable
            lifetime 1800
            mode tunnel
            pfs enable
            proposal 1 {
                encryption aes256
                hash sha1
            }
        }
        ike-group office-srv-ike {
            close-action none
            ikev2-reauth no
            key-exchange ikev1
            lifetime 3600
            proposal 1 {
                dh-group 2
                encryption aes256
                hash sha1
            }
        }
        # 设置 eth2 网卡为 ipsec 模式
        ipsec-interfaces {
            interface eth2
        }
        site-to-site {
            peer 172.12.1.11 {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret 0xfa42aa6bc685beb4d967057134dd8e327ca179a6
                }
                connection-type initiate
                ike-group office-srv-ike
                ikev2-reauth inherit
                local-address 172.12.1.10
                tunnel 0 {
                    allow-nat-networks disable
                    allow-public-networks disable
                    esp-group office-srv-esp
                    local {
                        prefix 10.1.5.0/24
                    }
                    remote {
                        prefix 10.1.8.0/24
                    }
                }
            }
        }
    }
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "nat@4:snmp@1:pptp@1:ntp@1:dns-forwarding@1:ipsec@5:broadcast-relay@1:conntrack-sync@1:pppoe-server@2:config-management@1:vrrp@2:dhcp-server@5:quagga@7:qos@1:wanloadbalance@3:mdns@1:ssh@1:zone-policy@1:dhcp-relay@2:webgui@1:webproxy@1:firewall@5:conntrack@1:cluster@1:webproxy@2:l2tp@1:system@10" === */
/* Release version: 1.2.8 */

gw2.cfg

配置文件

# ./startup-conf/gw2.cfg

interfaces {
    ethernet eth1 {
        address 10.1.8.1/24
        duplex auto
        smp-affinity auto
        speed auto
    }
    ethernet eth2 {
        address 172.12.1.11/24
        duplex auto
        smp-affinity auto
        speed auto
    }
    loopback lo {
    }
}
protocols {
    static {
        # 静态路由，指定到达 10.1.8.0/24 网络的下一条为 172.12.1.10
        route 10.1.5.0/24 {
            next-hop 172.12.1.10 {
            }
        }
    }
}
system {
    config-management {
        commit-revisions 100
    }
    console {
        device ttyS0 {
            speed 9600
        }
    }
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password $6$QxPS.uk6mfo$9QBSo8u1FkH16gMyAVhus6fU3LOzvLR9Z9.82m3tiHFAxTtIkhaZSWssSgzt4v4dGAL8rhVQxTg0oAG9/q11h/
                plaintext-password ""
            }
            level admin
        }
    }
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
        server 2.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level info
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}
vpn {
    ipsec {
        esp-group office-srv-esp {
            compression disable
            lifetime 1800
            mode tunnel
            pfs enable
            proposal 1 {
                encryption aes256
                hash sha1
            }
        }
        ike-group office-srv-ike {
            close-action none
            ikev2-reauth no
            key-exchange ikev1
            lifetime 3600
            proposal 1 {
                dh-group 2
                encryption aes256
                hash sha1
            }
        }
        # 设置 eth2 网卡为 ipsec 模式
        ipsec-interfaces {
            interface eth2
        }
        site-to-site {
            peer 172.12.1.10 {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret 0xfa42aa6bc685beb4d967057134dd8e327ca179a6
                }
                connection-type initiate
                ike-group office-srv-ike
                ikev2-reauth inherit
                local-address 172.12.1.11
                tunnel 0 {
                    allow-nat-networks disable
                    allow-public-networks disable
                    esp-group office-srv-esp
                    local {
                        prefix 10.1.8.0/24
                    }
                    remote {
                        prefix 10.1.5.0/24
                    }
                }
            }
        }
    }
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "nat@4:snmp@1:pptp@1:ntp@1:dns-forwarding@1:ipsec@5:broadcast-relay@1:conntrack-sync@1:pppoe-server@2:config-management@1:vrrp@2:dhcp-server@5:quagga@7:qos@1:wanloadbalance@3:mdns@1:ssh@1:zone-policy@1:dhcp-relay@2:webgui@1:webproxy@1:firewall@5:conntrack@1:cluster@1:webproxy@2:l2tp@1:system@10" === */
/* Release version: 1.2.8 */

d | 部署服务

# tree -L 2 ./
./
└── ipsec.clab.yml

# clab deploy -t ipsec.clab.yml

INFO[0000] Containerlab v0.54.2 started                 
INFO[0000] Parsing & checking topology file: clab.yaml  
INFO[0000] Creating docker network: Name="clab", IPv4Subnet="172.20.20.0/24", IPv6Subnet="2001:172:20:20::/64", MTU=1500 
INFO[0000] Creating lab directory: /root/wcni-kind/network/5-demo-cni/9-ipsec/1-clab-ipsec/clab-ipsec 
INFO[0000] Creating container: "gw1"                    
INFO[0000] Creating container: "server2"                
INFO[0001] Creating container: "gw2"                    
INFO[0001] Creating container: "server1"                
INFO[0002] Created link: gw2:eth1 <--> server2:net0     
INFO[0002] Created link: gw1:eth2 <--> gw2:eth2         
INFO[0002] Created link: gw1:eth1 <--> server1:net0     
INFO[0002] Executed command "ip addr add 10.1.8.10/24 dev net0" on the node "server2". stdout: 
INFO[0002] Executed command "ip route replace default via 10.1.8.1" on the node "server2". stdout: 
INFO[0002] Executed command "ip addr add 10.1.5.10/24 dev net0" on the node "server1". stdout: 
INFO[0002] Executed command "ip route replace default via 10.1.5.1" on the node "server1". stdout: 
INFO[0002] Adding containerlab host entries to /etc/hosts file 
INFO[0002] Adding ssh config for containerlab nodes     
INFO[0002] 🎉 New containerlab version 0.55.1 is available! Release notes: https://containerlab.dev/rn/0.55/#0551
Run 'containerlab version upgrade' to upgrade or go check other installation options at https://containerlab.dev/install/ 
+---+--------------------+--------------+------------------------------------------+-------+---------+----------------+----------------------+
| # |        Name        | Container ID |                  Image                   | Kind  |  State  |  IPv4 Address  |     IPv6 Address     |
+---+--------------------+--------------+------------------------------------------+-------+---------+----------------+----------------------+
| 1 | clab-ipsec-gw1     | 1536c5495e4c | vyos/vyos:1.2.8                          | linux | running | 172.20.20.3/24 | 2001:172:20:20::3/64 |
| 2 | clab-ipsec-gw2     | b1d45b33209e | vyos/vyos:1.2.8                          | linux | running | 172.20.20.4/24 | 2001:172:20:20::4/64 |
| 3 | clab-ipsec-server1 | 44dff0da2f32 | harbor.dayuan1997.com/devops/nettool:0.9 | linux | running | 172.20.20.5/24 | 2001:172:20:20::5/64 |
| 4 | clab-ipsec-server2 | 18b12c6c35ca | harbor.dayuan1997.com/devops/nettool:0.9 | linux | running | 172.20.20.2/24 | 2001:172:20:20::2/64 |
+---+--------------------+--------------+------------------------------------------+-------+---------+----------------+----------------------+

e | 查看 4 个容器路由表信息

## clab-ipsec-server1 主机路由
root@kind:~# lo clab-ipsec-server1 ip r s
default via 10.1.5.1 dev net0 
10.1.5.0/24 dev net0 proto kernel scope link src 10.1.5.10 
172.20.20.0/24 dev eth0 proto kernel scope link src 172.20.20.5 

## clab-ipsec-server2 主机路由
root@kind:~# lo clab-ipsec-server2 ip r s
default via 10.1.8.1 dev net0 
10.1.8.0/24 dev net0 proto kernel scope link src 10.1.8.10 
172.20.20.0/24 dev eth0 proto kernel scope link src 172.20.20.3 

## clab-ipsec-gw1 主机路由
root@kind:~# lo clab-ipsec-gw1 ip r s
default via 172.20.20.1 dev eth0 
10.1.5.0/24 dev eth1 proto kernel scope link src 10.1.5.1 
10.1.8.0/24 via 172.12.1.11 dev eth2 proto static metric 20 
172.12.1.0/24 dev eth2 proto kernel scope link src 172.12.1.10 
172.20.20.0/24 dev eth0 proto kernel scope link src 172.20.20.3 

## clab-ipsec-gw2 主机路由
root@kind:~# lo clab-ipsec-gw2 ip r s
default via 172.20.20.1 dev eth0 
10.1.5.0/24 via 172.12.1.10 dev eth2 proto static metric 20 
10.1.8.0/24 dev eth1 proto kernel scope link src 10.1.8.1 
172.12.1.0/24 dev eth2 proto kernel scope link src 172.12.1.11 
172.20.20.0/24 dev eth0 proto kernel scope link src 172.20.20.4

f | 查看 `gw1 gw2` 容器 `ipsec` 信息

gw1

root@gw1:/# ip x s
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xc02f0625 reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0x777f6ab1a07c5f8f7f826c8c0f8f5612365e817f 96
        enc cbc(aes) 0xd1489ba1e8aa40afd37a7d0d22421ad6fb0ada708d9b38d7b23a27fa07b6681b
        anti-replay context: seq 0x0, oseq 0x1, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xce02f639 reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0x976fafcd9b08a386752164ac125f707d37687c06 96
        enc cbc(aes) 0xdc5425b5217d32429fa36ef54c31596d85e7c3131e1644b592d806e9f1d240a0
        anti-replay context: seq 0x1, oseq 0x0, bitmap 0x00000001
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xc314ee5d reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0xeb0e331f9cd39ee36136f343622e9a9743fa6d1d 96
        enc cbc(aes) 0xecdfd09c35246b373f079772f1aaaec41f3727e77cb868926f85a9dcb2fd8567
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc509de2e reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0xc974bb749d7fef047b59909ab00aca5a1b911331 96
        enc cbc(aes) 0x37ff49c439db9478b2e8db84c930b85b63713fe83eefd03f45d2fd21eaedfc23
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xcf4843b8 reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0x7965eefa6bd78f0f9c7fffef3cff1fcc08f43143 96
        enc cbc(aes) 0x3ad728a2de6193fa8905156700682b375c16e1e0fa7289ea3955fb68db7bb1ec
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc56b829e reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0xff14b902b38dff70404f24a1db17045d9cf39e18 96
        enc cbc(aes) 0x86cc1d0277dc82b8d68876844519512cf92e2b839ec92769cd939616728c5259
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xcf36c7b0 reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0x2aaee791be690e2bbf80545901ad34e11081c805 96
        enc cbc(aes) 0x02a852201075f460b20a000b43c8a5772da5da82dd22b08016ac6904ae5567ad
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc7bb938b reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0xb6bc417e23a2b13f6d0ebb10d80aefd376e2118c 96
        enc cbc(aes) 0xfdb2ea4398ce72d432f77bcc571d8f7688e35b11aaf4ef2a474268f79ba05d81
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000

root@gw1:/# show vpn ike sa
Peer ID / IP                            Local ID / IP               
------------                            -------------
172.12.1.11                             172.12.1.10                            

    State  IKEVer  Encrypt  Hash    D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------  ----    ---------      -----  ------  ------
    up     IKEv1   aes256   sha1_96 2(MODP_1024)   no     1440    3600   

 
root@gw1:/# show vpn ipsec sa
Connection                 State    Up         Bytes In/Out    Remote address    Remote ID    Proposal
-------------------------  -------  ---------  --------------  ----------------  -----------  ------------------------------------------------
peer-172.12.1.11-tunnel-0  up       8 minutes  N/A             172.12.1.11       N/A          AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

gw2

root@gw2:/# ip x s
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xce02f639 reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0x976fafcd9b08a386752164ac125f707d37687c06 96
        enc cbc(aes) 0xdc5425b5217d32429fa36ef54c31596d85e7c3131e1644b592d806e9f1d240a0
        anti-replay context: seq 0x0, oseq 0x1, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xc02f0625 reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0x777f6ab1a07c5f8f7f826c8c0f8f5612365e817f 96
        enc cbc(aes) 0xd1489ba1e8aa40afd37a7d0d22421ad6fb0ada708d9b38d7b23a27fa07b6681b
        anti-replay context: seq 0x1, oseq 0x0, bitmap 0x00000001
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc509de2e reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0xc974bb749d7fef047b59909ab00aca5a1b911331 96
        enc cbc(aes) 0x37ff49c439db9478b2e8db84c930b85b63713fe83eefd03f45d2fd21eaedfc23
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xc314ee5d reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0xeb0e331f9cd39ee36136f343622e9a9743fa6d1d 96
        enc cbc(aes) 0xecdfd09c35246b373f079772f1aaaec41f3727e77cb868926f85a9dcb2fd8567
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc56b829e reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0xff14b902b38dff70404f24a1db17045d9cf39e18 96
        enc cbc(aes) 0x86cc1d0277dc82b8d68876844519512cf92e2b839ec92769cd939616728c5259
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xcf4843b8 reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0x7965eefa6bd78f0f9c7fffef3cff1fcc08f43143 96
        enc cbc(aes) 0x3ad728a2de6193fa8905156700682b375c16e1e0fa7289ea3955fb68db7bb1ec
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.11 dst 172.12.1.10
        proto esp spi 0xc7bb938b reqid 1 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc hmac(sha1) 0xb6bc417e23a2b13f6d0ebb10d80aefd376e2118c 96
        enc cbc(aes) 0xfdb2ea4398ce72d432f77bcc571d8f7688e35b11aaf4ef2a474268f79ba05d81
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
src 172.12.1.10 dst 172.12.1.11
        proto esp spi 0xcf36c7b0 reqid 1 mode tunnel
        replay-window 32 flag af-unspec
        auth-trunc hmac(sha1) 0x2aaee791be690e2bbf80545901ad34e11081c805 96
        enc cbc(aes) 0x02a852201075f460b20a000b43c8a5772da5da82dd22b08016ac6904ae5567ad
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000

root@gw2:/# show vpn ike sa
Peer ID / IP                            Local ID / IP               
------------                            -------------
172.12.1.10                             172.12.1.11                            

    State  IKEVer  Encrypt  Hash    D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------  ----    ---------      -----  ------  ------
    up     IKEv1   aes256   sha1_96 2(MODP_1024)   no     1620    3600   

 
root@gw2:/# show vpn ipsec sa
Connection                 State    Up          Bytes In/Out    Remote address    Remote ID    Proposal
-------------------------  -------  ----------  --------------  ----------------  -----------  ------------------------------------------------
peer-172.12.1.10-tunnel-0  up       10 minutes  N/A             172.12.1.10       N/A          AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

g｜抓包分析

root@kind:~# lo clab-ipsec-server1 ping 10.1.8.10 -c 10
PING 10.1.8.10 (10.1.8.10): 56 data bytes
64 bytes from 10.1.8.10: seq=0 ttl=62 time=0.596 ms
64 bytes from 10.1.8.10: seq=1 ttl=62 time=0.183 ms
64 bytes from 10.1.8.10: seq=2 ttl=62 time=0.178 ms
64 bytes from 10.1.8.10: seq=3 ttl=62 time=0.167 ms
64 bytes from 10.1.8.10: seq=4 ttl=62 time=0.162 ms
64 bytes from 10.1.8.10: seq=5 ttl=62 time=0.170 ms
64 bytes from 10.1.8.10: seq=6 ttl=62 time=0.180 ms
64 bytes from 10.1.8.10: seq=7 ttl=62 time=0.173 ms
64 bytes from 10.1.8.10: seq=8 ttl=62 time=0.174 ms
64 bytes from 10.1.8.10: seq=9 ttl=62 time=0.178 ms

--- 10.1.8.10 ping statistics ---
10 packets transmitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 0.162/0.216/0.596 ms

s1 包分析

server1 net0 网卡

root@kind:~# lo clab-ipsec-server1 tcpdump -pne -i net0

09:12:22.004636 aa:c1:ab:c8:ef:52 > aa:c1:ab:c2:d9:8b, ethertype IPv4 (0x0800), length 98: 10.1.5.10 > 10.1.8.10: ICMP echo request, id 40, seq 0, length 64
09:12:22.004734 aa:c1:ab:c2:d9:8b > aa:c1:ab:c8:ef:52, ethertype IPv4 (0x0800), length 98: 10.1.8.10 > 10.1.5.10: ICMP echo reply, id 40, seq 0, length 64

root@kind:~# lo clab-ipsec-server1 ip a l
43: net0@if44: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9500 qdisc noqueue state UP group default 
    link/ether aa:c1:ab:c8:ef:52 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet 10.1.5.10/24 scope global net0
       valid_lft forever preferred_lft forever
    inet6 fe80::a8c1:abff:fec8:ef52/64 scope link 
       valid_lft forever preferred_lft forever

root@kind:~# lo clab-ipsec-server1 ip n s
10.1.5.1 dev net0 lladdr aa:c1:ab:c2:d9:8b REACHABLE

icmp 包中，源 mac 地址：aa:c1:ab:c8:ef:52 目标 mac 地址：aa:c1:ab:c2:d9:8b , 分别为 s1 主机的 net0 网卡的 mac 地址，和 gw1 路由器 10.1.5.1 ip 的 mac 地址

gw1.cap 包分析

数据包到达 gw1 路由器 eth1 网卡后，解包后发现数据包目的地址为 10.1.8.10，查询路由表信息后会送往 eth2 网卡 10.1.8.0/24 via 172.12.1.11 dev eth2 proto static metric 20，而 eth2 网卡被设置为 ipsec 模式 set vpn ipsec ipsec-interfaces interface eth2 ，会对数据包进行加密，加密后为 esp 数据包

对数据包进行解密，加密模式为: AES_CBC_256 认证模式: HMAC_SHA1_96，解密后获取到源数据包信息

内层数据包没有 mac 层信息，比较类似 ipip 模式。
外层数据包 ip 层中，源 ip 目的 ip 分别为 gw1 路由器和 gw2 路由器 eth2 网卡地址。
外层数据包 icmp 包中，源 mac 地址：aa:c1:ab:24:8c:58 目标 mac 地址：aa:c1:ab:85:59:c9 , 分别为 gw1 主机的 eth2 网卡的 mac 地址，和 gw2 路由器 eth2 网卡的 mac 地址

h | 数据包流向

数据从 server1 服务器发出，通过查看本机路由表，送往 gw1 网关。路由: default via 10.1.5.1 dev net0
gw1 网关查看自身路由后，会送往 eth0 接口，因为目的地址为 10.1.8.10。路由: 10.1.8.0/24 via 172.12.1.11 dev eth2 proto static metric 20
eth2 接口为 ipsec 模式，会重新封装数据包，封装信息查看 ip x s 配置信息 src 172.12.1.10 dst 172.12.1.11 proto esp spi 0xc9d77d1d reqid 1 mode tunnel ... auth-trunc hmac(sha1) 0xeb2ef38fcbb796217cc58bed14ab0c12a09deb32 96 ... enc cbc(aes) 0x2c59ec6be9ddcbfc9e1547f206d6892ac257e8e0d6285cd97c768c7bc5669124
数据封装完成后，会送往 eth2 接口，并送往对端 gw2 主机。
对端 gw2 主机接受到数据包后，发现这个是一个 ipsec 数据包，使用 ipsec 信息对包解密。
解密数据包后发现内部的数据包，目的地址为 10.1.8.10 ，通过查看本机路由表，送往 eth1 网卡。路由: 10.1.8.0/24 dev eth1 proto kernel scope link src 10.1.8.1
通过 eth1 网卡，最终会把数据包送到 server2 主机

i | `VyOS` `cli` 配置

gw1 cli 接口配置

root@gw1:/# show configuration commands

set interfaces ethernet eth1 address '10.1.5.1/24'
set interfaces ethernet eth1 duplex 'auto'
set interfaces ethernet eth1 smp-affinity 'auto'
set interfaces ethernet eth1 speed 'auto'
set interfaces ethernet eth2 address '172.12.1.10/24'
set interfaces ethernet eth2 duplex 'auto'
set interfaces ethernet eth2 smp-affinity 'auto'
set interfaces ethernet eth2 speed 'auto'
set interfaces loopback lo

set protocols static route 10.1.8.0/24 next-hop 172.12.1.11

set vpn ipsec esp-group office-srv-esp compression 'disable'
set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable'
set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
set vpn ipsec ike-group office-srv-ike lifetime '3600'
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
## IPsec
set vpn ipsec ipsec-interfaces interface eth2
set vpn ipsec site-to-site peer 172.12.1.11 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 172.12.1.11 authentication pre-shared-secret '0xfa42aa6bc685beb4d967057134dd8e327ca179a6'
set vpn ipsec site-to-site peer 172.12.1.11 ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer 172.12.1.11 local-address '172.12.1.10'
set vpn ipsec site-to-site peer 172.12.1.11 tunnel 0 allow-nat-networks 'disable'
set vpn ipsec site-to-site peer 172.12.1.11 tunnel 0 allow-public-networks 'disable'
set vpn ipsec site-to-site peer 172.12.1.11 tunnel 0 esp-group 'office-srv-esp'
set vpn ipsec site-to-site peer 172.12.1.11 tunnel 0 local prefix '10.1.5.0/24'
set vpn ipsec site-to-site peer 172.12.1.11 tunnel 0 remote prefix '10.1.8.0/24'

set system config-management commit-revisions '100'
set system console device ttyS0 speed '9600'
set system host-name 'vyos'
set system login user vyos authentication encrypted-password '$6$QxPS.uk6mfo$9QBSo8u1FkH16gMyAVhus6fU3LOzvLR9Z9.82m3tiHFAxTtIkhaZSWssSgzt4v4dGAL8rhVQxTg0oAG9/q11h/'
set system login user vyos authentication plaintext-password ''
set system login user vyos level 'admin'
set system ntp server 0.pool.ntp.org
set system ntp server 1.pool.ntp.org
set system ntp server 2.pool.ntp.org
set system syslog global facility all level 'info'
set system syslog global facility protocols level 'debug'
set system time-zone 'UTC'

gw2 cli 接口配置

root@gw2:/# show configuration commands
set interfaces ethernet eth1 address '10.1.8.1/24'
set interfaces ethernet eth1 duplex 'auto'
set interfaces ethernet eth1 smp-affinity 'auto'
set interfaces ethernet eth1 speed 'auto'
set interfaces ethernet eth2 address '172.12.1.11/24'
set interfaces ethernet eth2 duplex 'auto'
set interfaces ethernet eth2 smp-affinity 'auto'
set interfaces ethernet eth2 speed 'auto'
set interfaces loopback lo

set protocols static route 10.1.5.0/24 next-hop 172.12.1.10

set vpn ipsec esp-group office-srv-esp compression 'disable'
set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable'
set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
set vpn ipsec ike-group office-srv-ike lifetime '3600'
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
## IPsec
set vpn ipsec ipsec-interfaces interface eth2

set vpn ipsec site-to-site peer 172.12.1.10 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 172.12.1.10 authentication pre-shared-secret '0xfa42aa6bc685beb4d967057134dd8e327ca179a6'
set vpn ipsec site-to-site peer 172.12.1.10 ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer 172.12.1.10 local-address '172.12.1.11'
set vpn ipsec site-to-site peer 172.12.1.10 tunnel 0 allow-nat-networks 'disable'
set vpn ipsec site-to-site peer 172.12.1.10 tunnel 0 allow-public-networks 'disable'
set vpn ipsec site-to-site peer 172.12.1.10 tunnel 0 esp-group 'office-srv-esp'
set vpn ipsec site-to-site peer 172.12.1.10 tunnel 0 local prefix '10.1.8.0/24'
set vpn ipsec site-to-site peer 172.12.1.10 tunnel 0 remote prefix '10.1.5.0/24'

set system config-management commit-revisions '100'
set system console device ttyS0 speed '9600'
set system host-name 'vyos'
set system login user vyos authentication encrypted-password '$6$QxPS.uk6mfo$9QBSo8u1FkH16gMyAVhus6fU3LOzvLR9Z9.82m3tiHFAxTtIkhaZSWssSgzt4v4dGAL8rhVQxTg0oAG9/q11h/'
set system login user vyos authentication plaintext-password ''
set system login user vyos level 'admin'
set system ntp server 0.pool.ntp.org
set system ntp server 1.pool.ntp.org
set system ntp server 2.pool.ntp.org
set system syslog global facility all level 'info'
set system syslog global facility protocols level 'debug'
set system time-zone 'UTC'

j | 销毁服务

# clab destroy -t ipsec.clab.yml

posted @ 2024-07-05 18:14 evescn 阅读(225) 评论(0) 编辑收藏举报

刷新页面返回顶部

登录后才能查看或发表评论，立即登录或者逛逛博客园首页

相关博文：

· Linux 虚拟网络 Wireguard

· Linux 虚拟网络 IPIP

· 六_docker网络之跨主机网络通信（2）

· ipsec点对点安全通信搭建

· NGFW-虚拟系统与站点建立IPSec

阅读排行：
· 震惊！C++程序真的从main开始吗？99%的程序员都答错了
· 别再用vector＜bool＞了！Google高级工程师：这可能是STL最大的设计失误
· 单元测试从入门到精通
· 【硬核科普】Trae如何「偷看」你的代码？零基础破解AI编程运行原理
· 上周热点回顾（3.3-3.9）

公告

昵称： evescn
园龄： 8年6个月
粉丝： 28
关注： 3

+加关注

2025年3月

日

一

二

三

四

五

六

evescn

Linux 虚拟网络 IPSec

`IPSec`

一、手动搭建 `ipsec` 网络

a | 拓扑

b | 配置命令

c | 测试网络

d | 抓包分析

e | 资源回收

二、使用 `Containerlab` 模拟网络

a | 拓扑

b | 网络拓扑文件

c | `VyOS` 配置文件

d | 部署服务

e | 查看 4 个容器路由表信息

f | 查看 `gw1 gw2` 容器 `ipsec` 信息

g｜抓包分析

h | 数据包流向

i | `VyOS` `cli` 配置

j | 销毁服务

公告

我的标签

合集

随笔分类

随笔档案

evescn

Linux 虚拟网络 IPSec

IPSec

一、手动搭建 ipsec 网络

a | 拓扑

b | 配置命令

c | 测试网络

d | 抓包分析

e | 资源回收

二、使用 Containerlab 模拟网络

a | 拓扑

b | 网络拓扑文件

c | VyOS 配置文件

d | 部署服务

e | 查看 4 个容器路由表信息

f | 查看 gw1 gw2 容器 ipsec 信息

g｜ 抓包分析

h | 数据包流向

i | VyOS cli 配置

j | 销毁服务

公告

我的标签

合集

随笔分类

随笔档案

`IPSec`

一、手动搭建 `ipsec` 网络

二、使用 `Containerlab` 模拟网络

c | `VyOS` 配置文件

f | 查看 `gw1 gw2` 容器 `ipsec` 信息

g｜抓包分析

i | `VyOS` `cli` 配置