SVTI的一些理解

創(chuàng)新互聯(lián)成都網(wǎng)站建設(shè)定制網(wǎng)站，是成都營銷推廣公司,為航空箱提供網(wǎng)站建設(shè)服務(wù),有成熟的網(wǎng)站定制合作流程，提供網(wǎng)站定制設(shè)計服務(wù)：原型圖制作、網(wǎng)站創(chuàng)意設(shè)計、前端HTML5制作、后臺程序開發(fā)等。成都網(wǎng)站設(shè)計熱線：028-86922220

很多地方看見對SVTI的說明是gre over ipsec，因為這個東西都加密了，看不見內(nèi)容，也說不了什么。

偶然看見思科社區(qū)http://www.cisco-club.com.cn/space-113351-do-blog-id-8866.html關(guān)于juniper SRX和思科對聯(lián)SVTI，具體看了一下juniper配置，完全是ipsec的接口模式，沒有g(shù)re參與，想來是一些人看見配置是tunnel就以為還是gre的東西，能喝SRX對接成功的肯定使用的是相同的技術(shù)，不會用gre。想驗證一下，但是加密內(nèi)容不可視，想來想去，可以看包大小是否一致，就能看出是不是一樣。

試驗，在R1上配SVTI，R2上配傳統(tǒng)的crypto map，R4兩個都配。

crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 40.1.1.2
!
!
crypto ipsec transform-set ESP-des-md5 esp-des esp-md5-hmac
!
crypto ipsec profile ipsec-profile
set transform-set ESP-des-md5
!
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface Tunnel0
ip address 172.16.1.1 255.255.255.0
tunnel source 61.1.1.1
tunnel destination 40.1.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile ipsec-profile
!
interface FastEthernet0/0
ip address 61.1.1.1 255.255.255.0
duplex auto
speed auto
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 61.1.1.3
ip route 1.1.1.4 255.255.255.255 Tunnel0

crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 40.1.1.2
!
!
crypto ipsec transform-set ESP-des-md5 esp-des esp-md5-hmac
!
crypto map mm 10 ipsec-isakmp
set peer 40.1.1.2
set transform-set ESP-des-md5
match address 100
!
!
!
!
interface Loopback0
ip address 1.1.1.2 255.255.255.255
!
interface FastEthernet0/0
ip address 61.1.1.2 255.255.255.0
duplex auto
speed auto
crypto map mm
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 61.1.1.3
!
!
!
access-list 100 permit ip host 1.1.1.2 host 1.1.1.4

crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 61.1.1.1
crypto isakmp key cisco address 61.1.1.2
!
!
crypto ipsec transform-set ESP-des-md5 esp-des esp-md5-hmac
!
crypto ipsec profile ipsec-profile
set transform-set ESP-des-md5
!
!
crypto map mm 10 ipsec-isakmp
set peer 61.1.1.2
set transform-set ESP-des-md5
match address 100
!
!
!
!
interface Loopback0
ip address 1.1.1.4 255.255.255.255
!
interface Tunnel0
ip address 172.16.1.4 255.255.255.0
tunnel source 40.1.1.2
tunnel destination 61.1.1.1
tunnel mode ipsec ipv4
tunnel protection ipsec profile ipsec-profile
!
interface FastEthernet0/0
ip address 40.1.1.2 255.255.255.0
duplex auto
speed auto
crypto map mm
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 40.1.1.1
ip route 1.1.1.1 255.255.255.255 Tunnel0
!
!
!
access-list 100 permit ip host 1.1.1.4 host 1.1.1.2

從R1和R2分別ping R4，通過抓包，比較ESP包大小，完全一樣，其后又用telnet試驗，發(fā)現(xiàn)包的大小仍然一致，SVTI的包和原來的IPsec沒有不同，不是所謂的gre over ipsec。

參看思科網(wǎng)站http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_***ips/configuration/15-s/sec-ipsec-virt-tunnl.html

SVTI configurations can be used for site-to-site connectivity in which a tunnel provides always-on access between two sites. The advantage of using SVTIs as opposed to crypto map configurations is that users can enable dynamic routing protocols on the tunnel interface without the extra 24 bytes required for GRE headers, thus reducing the bandwidth for sending encrypted data.

人家沒說過封裝gre，只是進行對比，可以過動態(tài)路由并且沒有g(shù)re的24字節(jié)的包頭。

下面的圖是抓包內(nèi)容。

這個是原始ipsec站點的ping包封裝成ESP

SVTI的一些理解