1、拓撲

192.168.18.101 <=======> 192.168.18.102

2、配置192.168.18.101

ip xfrm state add src 192.168.18.101 dst 192.168.18.102 proto esp spi 0x00000301 mode tunnel auth md5 0x96358c90783bbfa3d7b196ceabe0536b enc des3_ede 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df

ip xfrm state add src 192.168.18.102 dst 192.168.18.101 proto esp spi 0x00000302 mode tunnel auth md5 0x99358c90783bbfa3d7b196ceabe0536b enc des3_ede 0xffddb555acfd9d77b03ea3843f2653255afe8eb5573965df

ip xfrm state get src 192.168.18.101 dst 192.168.18.102 proto esp spi 0x00000301

ip xfrm policy add src 192.168.18.101 dst 192.168.18.102 dir out ptype main tmpl src 192.168.18.101 dst 192.168.18.102 proto esp mode tunnel

ip xfrm policy add src 192.168.18.102 dst 192.168.18.101 dir in ptype main tmpl src 192.168.18.102 dst 192.168.18.101 proto esp mode tunnel

ip xfrm policy ls

3、配置192.168.18.102

ip xfrm state add src 192.168.18.101 dst 192.168.18.102 proto esp spi 0x00000301 mode tunnel auth md5 0x96358c90783bbfa3d7b196ceabe0536b enc des3_ede 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df

ip xfrm state add src 192.168.18.102 dst 192.168.18.101 proto esp spi 0x00000302 mode tunnel auth md5 0x99358c90783bbfa3d7b196ceabe0536b enc des3_ede 0xffddb555acfd9d77b03ea3843f2653255afe8eb5573965df

ip xfrm state get src 192.168.18.101 dst 192.168.18.102 proto esp spi 0x00000301

ip xfrm policy add src 192.168.18.101 dst 192.168.18.102 dir in ptype main tmpl src 192.168.18.101 dst 192.168.18.102 proto esp mode tunnel

ip xfrm policy add src 192.168.18.102 dst 192.168.18.101 dir out ptype main tmpl src 192.168.18.102 dst 192.168.18.101 proto esp mode tunnel

ip xfrm policy ls4、測試4.1在192.168.18.101上執行

ping 192.168.18.102

4.2在192.168.18.102上抓包

tcpdump -p esp

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

11:12:00.771364 IP 192.168.18.101 > 192.168.18.102: ESP(spi=0x00000301,seq=0x41d), length 116

11:12:00.771498 IP 192.168.18.102 > 192.168.18.101: ESP(spi=0x00000302,seq=0x183), length 116

11:12:01.773378 IP 192.168.18.101 > 192.168.18.102: ESP(spi=0x00000301,seq=0x41e), length 116

11:12:01.773787 IP 192.168.18.102 > 192.168.18.101: ESP(spi=0x00000302,seq=0x184), length 116

11:12:02.774682 IP 192.168.18.101 > 192.168.18.102: ESP(spi=0x00000301,seq=0x41f), length 116

11:12:02.774793 IP 192.168.18.102 > 192.168.18.101: ESP(spi=0x00000302,seq=0x185), length 116

總結

以上是生活随笔為你收集整理的linux内核实现ipsec,IP XFRM配置示例：利用linux kernel自带的IPSec实现，手动配置IPSec...的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。