網絡安全的普及宣傳研究畢業論文-資料下載頁

　　

【正文】 des espshahmac mode transport exitaccesslist 100 permit ip host host crypto map dxy 1 ipsecisakmpset peer set transformset dxymatch address 100exitinterface serial0/0crypto map dxyexitVPN1：crypto isakmp policy 100encryption 3deshash sha authentication preshare group 2exitcrypto isakmp key 0 dong address crypto ipsec transformset dxy esp3des espshahmac mode transport exitaccesslist 100 permit ip host host crypto map dxy 1 ipsecisakmpset peer set transformset dxymatch address 100exitinterface serial0/0crypto map dxyexit在以上配置完成以后，筆者將對其進行調試，首先來通過ping命令來觸發IPSec的建立，從而來查看和分析IPSec系統的相關協商過程。首先在VPN1和Center上同時打開debug crypto ipsec和debug crypto isakmp，然后在VPN1執行命令ping ，調試中現實的代碼如下：VPN1VPN1debug crypto ipsec Crypto IPSEC debugging is onVPN1debug crypto isakmpCrypto ISAKMP debugging is onVPN1ping Type escape sequence to abort.Sending 5, 100byte ICMP Echos to , timeout is 2 seconds:Packet sent with a source address of *Mar 1 00:44:: IPSEC(sa_request): ,//數據觸發SA。 (key eng. msg.) OUTBOUND local= , remote= , local_proxy= (type=1), remote_proxy= (type=1), protocol= ESP, transform= esp3des espshahmac (Tunnel), //觸發的crypto map細節。 lifedur= 3600s and 4608000kb, spi= 0x9076EC32(2423712818), conn_id= 0, keysize= 0, flags= 0x400E*Mar 1 00:44:: ISAKMP: received ke message (1/1)*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): SA request profile is (NULL)*Mar 1 00:44:: ISAKMP: Created a peer struct for , peer port 500*Mar 1 00:44:: ISAKMP: New peer created peer = 0x64A76F64 peer_handle = 0x80000004//主模式的交換正在開始：還沒有策略被共享，路由器仍處于MM_NO_STATE狀態。*Mar 1 00:44:: ISAKMP: Locking peer struct 0x64A76F64, IKE refcount 1 for isakmp_initiator*Mar 1 00:44:: ISAKMP: local port 500, remote port 500*Mar 1 00:44:: ISAKMP: set new node 0 to QM_IDLE *Mar 1 00:44:: insert sa successfully sa = 63E2E4EC*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode.*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):found peer preshared key matching //路由器首先核實有一個預共享密鑰匹配對等設備的地址（在這點上還沒有做驗證）*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): constructed NATT vendor07 ID*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): constructed NATT vendor03 ID*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): constructed NATT vendor02 ID*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1 //這里表明IKE 協商已經被發起，主模式協商中的第一條ISAKMP 消息即將被發送，注意該消息中的“I”，這里表明VPN1為IKE 協商的發起方，如果VPN1為應答方，將顯示“R”。*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange//開始IKE階段1中的主模式交換。首先通信雙方交換第2條信息，而在發送這兩條信息之前，發送者和接受者必須先計算出各自的cookie(可以防重放和DOS攻擊)，這些cookie用于標識每個單獨的協商交換消息。RFC中建議，cookie是將源/目IP、源/目端口、本地生成的隨機數、日期以及時間進行散列操作得到的，從而成為留在IKE協商中交換信息的唯一標識。實際上cookie是用來防止DOS攻擊的，它把和其他設備建立IPSEC所需要的連接信息不是以緩存的形式保存在路由器里，而是把這些信息HASH成個 cookie值。*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): sending packet to my_port 500 peer_port 500 (I) MM_NO_STATE//第1個包。發送方向對等體發送一條包含一組或多組策略提議，在策略提議中包括5元組（加密算法，散列算法，DH，認證方法，IKE SA壽命）：1）加密算法：選擇DES或3DES2）hash算法：選擇MD5或SHA3）認證方法：選擇證書認證、預置共享密鑰認證或Kerberos v5認證4）DiffieHellman組的選擇*Mar 1 00:44:: ISAKMP (0:0): received packet from dport 500 sport 500 Global (I) MM_NO_STATE//第2個包。響應者收到發起者的第1條消息后查看IKE策略消息，并嘗試在本地尋找與之匹配的策略，找到后，則返回給發起者一條消息，即第2條消息。注意：發起者會將它的所有策略發送給響應者，響應者則在自己的策略中尋找與之匹配的策略，對比順序從優先級號小的到大的（默認策略實際就是個模版沒作用，如果認證只配置預共享的話，其他參數就會copy默認策略里的）。*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_I_MM2 //MM 12主要作用就是協商peer的地址和第一階段的策略。.!!!!Success rate is 80 percent (4/5), roundtrip min/avg/max = 60/141/200 msVPN1*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): processing vendor id payload*Mar 1 00:44:: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch*Mar 1 00:44:: ISAKMP (0:0): vendor ID is NATT v7*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):found peer preshared key matching *Mar 1 00:44:: ISAKMP:(0:0:N/A:0): local preshared key found*Mar 1 00:44:: ISAKMP : Scanning profiles for xauth ...*Mar 1 00:44:: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 100 policy//ISAKMP/IKE 策略的比較在這里開始。*Mar 1 00:44:: ISAKMP: encryption 3DESCBC*Mar 1 00:44:: ISAKMP: hash SHA*Mar 1 00:44:: ISAKMP: default group 2*Mar 1 00:44:: ISAKMP: auth preshare*Mar 1 00:44:: ISAKMP: life type in seconds*Mar 1 00:44:: ISAKMP: life duration (VPI) of 0x0 VPN10x1 0x51 0x80 *Mar 1 00:44:: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0//此消息代表匹配的策略已經找到，表示第2個包協商成功。*Mar 1 00:44:: ISAKMP:(0:1:SW:1): processing vendor id payload*Mar 1 00:44:: ISAKMP:(0:1:SW:1): vendor ID seems Unity/DPD but major 245 mismatch*Mar 1 00:44:: ISAKMP (0:134217729): vendor ID is NATT v7*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2 //前兩條消息交換成功之后，便開始進行第3條和第4條消息的交換，以用于交換DH的公開信息和隨機數。下面兩個數據包信息則就是這兩條信息的具體體現。*Mar 1 00:44:: ISAKMP:(0:1:SW:1): sending packet to my_port 500 peer_port 500 (I) MM_SA_SETUP//第3個包。*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3 *Mar 1 00:44:: ISAKMP (0:134217729): received packet from dport 500 sport 500 Global (I) MM_SA_SETUP//第4個包。*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCHVPN1*Mar 1 00:44:: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4 //MM 34包主要作用是交換DH公開值和輔助數據。*Mar 1 00:44:: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0*Mar 1 00:44:: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0*Mar 1 00:44:: ISAKMP:(0:1:SW:1):found peer preshared k