{"id":572,"date":"2016-05-11T11:24:00","date_gmt":"2016-05-11T02:24:00","guid":{"rendered":"https:\/\/wp.zassoul.com\/?p=572"},"modified":"2016-05-11T11:24:00","modified_gmt":"2016-05-11T02:24:00","slug":"aws%e4%b8%8a%e3%81%aevyos%e3%81%a8%e5%ae%b6%e3%81%aec841%e3%81%a8%e3%81%a7gre-over-ipsec%e3%82%92%e8%a9%a6%e3%81%99","status":"publish","type":"post","link":"https:\/\/wp.zassoul.com\/?p=572","title":{"rendered":"AWS\u4e0a\u306eVyos\u3068\u5bb6\u306eC841\u3068\u3067GRE over IPSec\u3092\u8a66\u3059"},"content":{"rendered":"

\u3061\u3087\u3063\u3068\u3084\u308a\u305f\u3044\u3053\u3068\u3042\u3063\u3066AWS\u3068IPSec\u5f35\u308a\u305f\u3044\u306a\u3068\u3002<\/p>\n

\u69cb\u6210\u306f\u3053\u3093\u306a\u3002<\/p>\n

<\/div>\n
<\/a><\/div>\n

<\/p>\n

<\/div>\n

OSPF\u306f\u5225\u306b\u3044\u3089\u306a\u3044\u3093\u3060\u3051\u3069\uff0c\u6298\u89d2\u306a\u3093\u3067\u30c0\u30a4\u30ca\u30df\u30c3\u30af\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u307e\u308f\u3057\u3066\u307f\u308b\u3002<\/p>\n

\u7c21\u5358\u306b\u3044\u3051\u308b\u304b\u306a\u30fc\u3068\u3082\u601d\u3063\u305f\u3051\u3069\u304b\u306a\u308a\u30cf\u30de\u3063\u305f\u3002\u53cc\u65b9NAT\u914d\u4e0b\u3067\u5bb6\u306e\u307b\u3046\u306f\u3055\u3089\u306b\u30b0\u30ed\u30fc\u30d0\u30eb\u306fDHCP\u5272\u5f53\u3067\u5909\u308f\u308b\u308fPAT\u3060\u304b\u3089NAT-T\u3084\u3089\u306a\u304d\u3083\u3060\u3068\u304b\uff0c\u307e\u30fc\u3044\u308d\u3044\u308d\u6c17\u306b\u3059\u308b\u30dd\u30a4\u30f3\u30c8\u304c\u3042\u3063\u305f\u3002<\/p>\n

\u3051\u3069\uff0c\u7121\u4e8b\u306b\u3064\u306a\u304c\u308a\u307e\u3057\u305f\u3002
\u5927\u304d\u304f\u30cf\u30de\u3063\u305f\u70b9\u306f\u4ee5\u4e0b2\u3064\u3002<\/p>\n

\u30fbCisco\u306eIPSec\u7528ACL\u3067gre\u6307\u5b9a\u3060\u3068NG\u3002ip \u6307\u5b9a\u3067\u89e3\u6d88\u3002
\u30fbVyos\u306eremote-id\u3067Cisco\u306e\u5b9fIP\u3092\u5165\u308c\u3066\u3042\u3052\u308b\u3002<\/p>\n

Vyos\u306f\u308f\u304b\u308b\u3093\u3060\u304c\uff0cCisco\u306eACL\u306f\u306a\u3093\u3067\u3060\u3002\u308f\u304b\u3089\u3093\u30fb\u30fb\u30fb\u3002<\/p>\n

VTI\u3068\u304b\u3067\u3084\u308c\u3070ACL\u4e0d\u8981\u3060\u304b\u3089\u3044\u3044\u306e\u304b\u3068\u601d\u3063\u305f\u304c\uff0c\u3053\u308c\u306f\u3053\u308c\u3067\u30cf\u30de\u3063\u305f\u306e\u3067\u53c8\u4eca\u5ea6\u3002<\/p>\n

Try&Error\u3092\u3072\u305f\u3059\u3089\u8a66\u3059\u306f\u3081\u306b\u306a\u308a\u307e\u3057\u305f\u3002
\u3044\u3044\u52c9\u5f37\u3055\u305b\u3066\u3044\u305f\u3060\u304d\u307e\u3057\u305f\u3002<\/p>\n

<\/p>\n\n\n\n
\u25a0 Cisco \u629c\u7c8b<\/span><\/span>
!<\/span>
crypto isakmp policy 5<\/span>
 encr aes 256<\/span>
 hash sha256<\/span>
 authentication pre-share<\/span>
 group 14<\/span>
 lifetime 3600<\/span>
crypto isakmp key aws address A.A.A.A  255.255.255.255<\/span>
crypto isakmp keepalive 30 30<\/span>
!<\/span>
!<\/span>
crypto ipsec transform-set IPSEC esp-aes 256 esp-sha256-hmac <\/span>
 mode tunnel<\/span>
<\/span><\/span>
<\/span>!<\/span>
!<\/span><\/span>
crypto map GRE_IPSEC 10 ipsec-isakmp <\/span><\/span>
 set peer A.A.A.A<\/span>
 set transform-set IPSEC <\/span>
 set pfs group14<\/span>
 match address AWS_GRE<\/span>
!<\/span>
!<\/span>
!<\/span>
!<\/span>
interface Loopback1<\/span>
 ip address 172.16.1.1 255.255.255.255<\/span>
!<\/span>
interface Tunnel1<\/span>
 ip address 192.168.254.1 255.255.255.0<\/span>
 ip mtu 1400<\/span>
 ip tcp adjust-mss 1360<\/span>
 ip ospf network broadcast<\/span>
 ip ospf hello-interval 5<\/span>
 keepalive 5 3<\/span>
 tunnel source Loopback1<\/span>
 tunnel destination 172.16.1.2<\/span>
!<\/span>
interface Vlan100<\/span>
 ip address 192.168.1.2 255.255.255.0<\/span><\/span>
 ip virtual-reassembly in<\/span><\/span>
 crypto map GRE_IPSEC<\/span><\/span>
!<\/span><\/span>
!<\/span><\/span>
!<\/span><\/span>
router ospf 1<\/span>
 network 192.168.10.0 0.0.0.255 area 0<\/span>
 network 192.168.254.0 0.0.0.255 area 0<\/span>
!<\/span>
!<\/span>
ip access-list extended AWS_GRE<\/span>
<\/span>!<\/span>
 permit ip host 172.16.1.1 host 172.16.1.2<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\u25a0 Vyos \u629c\u7c8b<\/span>
set interfaces loopback lo address ‘172.16.1.2\/32’<\/span>
set interfaces tunnel tun1 address ‘192.168.254.2\/24’<\/span>
set interfaces tunnel tun1 encapsulation ‘gre’<\/span>
set interfaces tunnel tun1 ip ospf dead-interval ’20’<\/span>
set interfaces tunnel tun1 ip ospf hello-interval ‘5’<\/span>
set interfaces tunnel tun1 ip ospf priority ‘1’<\/span>
set interfaces tunnel tun1 ip ospf retransmit-interval ‘5’<\/span>
set interfaces tunnel tun1 ip ospf transmit-delay ‘1’<\/span>
set interfaces tunnel tun1 local-ip ‘172.16.1.2’<\/span>
set interfaces tunnel tun1 mtu ‘1400’<\/span>
set interfaces tunnel tun1 multicast ‘enable’<\/span>
set interfaces tunnel tun1 remote-ip ‘172.16.1.1’<\/span>
set protocols ospf area 0 network ‘192.168.254.0\/24’<\/span>
set protocols ospf area 0 network ‘10.10.20.0\/24′<\/span><\/span>
set protocols ospf log-adjacency-changes ‘detail’<\/span>
set protocols static route 0.0.0.0\/0 next-hop 10.10.10.1 distance ‘1’<\/span>
—-<\/span>
set vpn ipsec esp-group ESP_AWS compression ‘disable’<\/span>
set vpn ipsec esp-group ESP_AWS lifetime ‘3600’<\/span>
set vpn ipsec esp-group ESP_AWS mode ‘tunnel’<\/span>
set vpn ipsec esp-group ESP_AWS pfs ‘enable’<\/span>
set vpn ipsec esp-group ESP_AWS proposal 1 encryption ‘aes256’<\/span>
set vpn ipsec esp-group ESP_AWS proposal 1 hash ‘sha256’<\/span>
set vpn ipsec ike-group IKE_AWS dead-peer-detection action ‘hold’<\/span>
set vpn ipsec ike-group IKE_AWS dead-peer-detection interval ’30’<\/span>
set vpn ipsec ike-group IKE_AWS dead-peer-detection timeout ‘120’<\/span>
set vpn ipsec ike-group IKE_AWS lifetime ‘3600’<\/span>
set vpn ipsec ike-group IKE_AWS proposal 1 dh-group ’14’<\/span>
set vpn ipsec ike-group IKE_AWS proposal 1 encryption ‘aes256’<\/span>
set vpn ipsec ike-group IKE_AWS proposal 1 hash ‘sha256’<\/span>
set vpn ipsec ipsec-interfaces interface ‘eth0’<\/span>
set vpn ipsec logging log-modes ‘all’<\/span>
set vpn ipsec nat-traversal ‘enable’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 authentication mode ‘pre-shared-secret’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 authentication pre-shared-secret ‘aws’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 authentication remote-id ‘192.168.1.2’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 connection-type ‘respond’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 ike-group ‘IKE_AWS’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 local-address ‘10.10.10.50’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 esp-group ‘ESP_AWS’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 local prefix ‘172.16.1.2\/32’<\/span>
set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 remote prefix ‘172.16.1.1\/32’<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u3061\u3087\u3063\u3068\u3084\u308a\u305f\u3044\u3053\u3068\u3042\u3063\u3066AWS\u3068IPSec\u5f35\u308a\u305f\u3044\u306a\u3068\u3002 \u69cb\u6210\u306f\u3053\u3093\u306a\u3002 OSPF\u306f\u5225\u306b\u3044\u3089\u306a\u3044\u3093\u3060\u3051\u3069\uff0c\u6298\u89d2\u306a\u3093\u3067\u30c0\u30a4\u30ca\u30df\u30c3\u30af\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u307e\u308f\u3057\u3066\u307f\u308b\u3002 \u7c21\u5358\u306b\u3044\u3051\u308b\u304b\u306a\u30fc\u3068\u3082\u601d\u3063\u305f\u3051\u3069\u304b\u306a\u308a\u30cf\u30de\u3063\u305f\u3002\u53cc\u65b9NAT\u914d\u2026 \u7d9a\u304d\u3092\u8aad\u3080 »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54,11,15,8],"tags":[],"class_list":["post-572","post","type-post","status-publish","format-standard","hentry","category-aws","category-cisco","category-network","category-8"],"_links":{"self":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=572"}],"version-history":[{"count":0,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/572\/revisions"}],"wp:attachment":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}