IPsec

GNS3で。



172.16.1.0/24 - TARO [.1]-(100.0.0.0/24)-[.2] RT [.1]-(200.0.0.0)-[.2] HANAKO - 172.16.2.0/24




TARO#ter len 0
TARO#sho run
Building configuration...

Current configuration : 1490 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname TARO
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
ip tcp synwait-time 5
ip cef
no ip domain lookup
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
 lifetime 28800
crypto isakmp key CISCO address 200.0.0.2 255.255.255.0
crypto isakmp keepalive 100
!
!
crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
!
crypto map MAP1 1 ipsec-isakmp
 set peer 200.0.0.2
 set transform-set IPSEC
 match address 101
!
!
!
!
interface FastEthernet0/0
 ip address 172.16.1.254 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet1/0
 ip address 100.0.0.1 255.255.255.0
 negotiation auto
 crypto map MAP1
!
interface GigabitEthernet2/0
 no ip address
 shutdown
 negotiation auto
!
ip route 0.0.0.0 0.0.0.0 100.0.0.2
ip route 172.16.2.0 255.255.255.0 100.0.0.2
!
no ip http server
no ip http secure-server
!
!
access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
no cdp log mismatch duplex
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
!
end










HANAKO#sho run
Building configuration...

Current configuration : 1492 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HANAKO
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
ip tcp synwait-time 5
ip cef
no ip domain lookup
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
 lifetime 28800
crypto isakmp key CISCO address 100.0.0.1 255.255.255.0
crypto isakmp keepalive 100
!
!
crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
!
crypto map MAP1 1 ipsec-isakmp
 set peer 100.0.0.1
 set transform-set IPSEC
 match address 101
!
!
!
!
interface FastEthernet0/0
 ip address 172.16.2.254 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet1/0
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet2/0
 ip address 200.0.0.2 255.255.255.0
 negotiation auto
 crypto map MAP1
!
ip route 0.0.0.0 0.0.0.0 200.0.0.1
ip route 172.16.1.0 255.255.255.0 200.0.0.1
!
no ip http server
no ip http secure-server
!
!
access-list 101 permit ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255
no cdp log mismatch duplex
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
!
end

HANAKO#





TARO#ping 172.16.2.254 source 172.16.1.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.2.254, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.254
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 68/94/116 ms
TARO#
TARO#
TARO#
TARO#sho cry isa sa
dst             src             state          conn-id slot status
200.0.0.2       100.0.0.1       QM_IDLE              1    0 ACTIVE

TARO#sho cry ipsec sa

interface: GigabitEthernet1/0
    Crypto map tag: MAP1, local addr 100.0.0.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (172.16.2.0/255.255.255.0/0/0)
   current_peer 200.0.0.2 port 500
     PERMIT, flags={origin_is_acl,ipsec_sa_request_sent}
    #pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
    #pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

     local crypto endpt.: 100.0.0.1, remote crypto endpt.: 200.0.0.2
     path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1/0
     current outbound spi: 0xD05FC0B9(3495936185)

     inbound esp sas:
      spi: 0xA794FBD4(2811558868)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2001, flow_id: SW:1, crypto map: MAP1
        sa timing: remaining key lifetime (k/sec): (4540909/3589)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xD05FC0B9(3495936185)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2002, flow_id: SW:2, crypto map: MAP1
        sa timing: remaining key lifetime (k/sec): (4540909/3589)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:
TARO#

さくらのVPSにGNS3をインストール（ubuntu)

とりあえず動いた・・・。

centosはメモリ1GBだから、GNS3を動かすのはちょっときついかな。

基本的に下記のガイドのとおり。

https://community.gns3.com/servlet/JiveServlet/download/38-7963/GNS3%20Getting%20Started%20Guide%201.0.pdf


ubuntuには、pythonは2系と3系が両方入っている。

pycrypto とかいうのがインストールされるところでエラーになって、
python2.7-dev と python3.4-dev をいれた。

たぶん3.4だけでいいのだと思う。

さくらのVPSにGNS3をインストール(centos)

gns3.com にインストールガイドがあるが、ubuntu用である。

centosにいれる。

とにかくいろんなものが必要。というか、足りない。

エラーになるたびメッセージをgoogleで検索して、必要なものをインストールしていった・・・。

どれも、それが何なのか全然わからないまま・・・。


先に結論を言うと、うまくいかなかった。

ので、正式なものは後日書くとして、
メモを残す。



まずdynamips

cmake

libpcap-devel

libuuid-devel.x86_64

libelfとかなんとか

dynamipsはうまくいった。



次に gns3server


python3

distribute

zeromq 4.0.5


Searching for pyzmq>=14.0.0
Reading https://pypi.python.org/simple/pyzmq/
Reading http://github.com/zeromq/pyzmq
Best match: pyzmq 14.4.1
Downloading https://pypi.python.org/packages/source/p/pyzmq/pyzmq-14.4.1.zip#md5=0cab6e0047107badf68a0a0fa4ae30d1
Processing pyzmq-14.4.1.zip
Writing /tmp/easy_install-khz_iw/pyzmq-14.4.1/setup.cfg
Running pyzmq-14.4.1/setup.py -q bdist_egg --dist-dir /tmp/easy_install-khz_iw/pyzmq-14.4.1/egg-dist-tmp-xy0lnt
warning: no files found matching 'tools'
no previously-included directories found matching 'docs/build'
no previously-included directories found matching 'docs/gh-pages'
warning: no previously-included files found matching 'bundled/zeromq/src/Makefile*'
warning: no previously-included files found matching 'bundled/zeromq/src/platform.hpp'
warning: no previously-included files found matching 'zmq/libzmq*'
warning: no previously-included files matching '.deps/*' found anywhere in distribution
warning: no previously-included files matching '*.so' found anywhere in distribution
warning: no previously-included files matching '*.pyd' found anywhere in distribution
warning: no previously-included files matching '*.pyc' found anywhere in distribution
warning: no previously-included files matching '.git*' found anywhere in distribution
warning: no previously-included files matching '.DS_Store' found anywhere in distribution
warning: no previously-included files matching '.mailmap' found anywhere in distribution
warning: no previously-included files matching 'Makefile.am' found anywhere in distribution
warning: no previously-included files matching 'Makefile.in' found anywhere in distribution
Using zmq-prefix /usr/local (found via pkg-config).
************************************************
Configure: Autodetecting ZMQ settings...
    Custom ZMQ dir:
build/temp.linux-x86_64-3.3/scratch/tmp/easy_install-khz_iw/pyzmq-14.4.1/temp/timer_createcmeorh.o: In function `main':
timer_createcmeorh.c:(.text+0x15): undefined reference to `timer_create'
collect2: ld はステータス 1 で終了しました
    ZMQ version detected: 4.0.5
************************************************
error: Setup script exited with error: in 'ext_modules' option (extension 'zmq.devices.monitoredqueue'), 'sources' must be present and must be a list of source filenames


ここでダメ。




GUI




Searching for pycrypto>=2.1,!=2.4
Reading https://pypi.python.org/simple/pycrypto/
Best match: pycrypto 2.6.1
Downloading https://pypi.python.org/packages/source/p/pycrypto/pycrypto-2.6.1.tar.gz#md5=55a61a054aa66812daf5161a0d5d7eda
Processing pycrypto-2.6.1.tar.gz
Writing /tmp/easy_install-ni0km5/pycrypto-2.6.1/setup.cfg
Running pycrypto-2.6.1/setup.py -q bdist_egg --dist-dir /tmp/easy_install-ni0km5/pycrypto-2.6.1/egg-dist-tmp-uck3lu
error: Setup script exited with error: in 'ext_modules' option (extension 'Crypto.PublicKey._fastmath'), 'sources' must be present and must be a list of source filenames


ここでダメ。



gns3インストールの記録はあるのだが、
皆バージョンが少し古い。

今gns.comへ行くと、
GNS3-1.1.source.zip

しかない。


これを、centos
Linux xxxxx.sakura.ne.jp 2.6.32-431.29.2.el6.x86_64 #1 SMP Tue Sep 9 21:36:05 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux


に入れねばならない。


いったんあきらめる。

ubuntuでできるか、試してみるか・・・。