Как сконфигурировать GRE tunnel в маршрутизаторах Cisco?

1 комментарий. Оставить новый

• 

  Жора

  22 мая 2022 19:23

  int gi1/gi2
  ip nat outside/inside
  access-list 1 permit 192/172 0.0.0.255
  ip nat inside source list 1 interface Gi1 overload

  interface Tunnel 1
  ip address 172.16.1.1/2 255…
  tunnel mode gre ip
  tunnel source 4.4.4.100
  tunnel destination 5.5.5.100

  router eigrp 6500
  network 192/172 0.0.0.255
  network 172.16.1.0 0.0.0.255

  crypto isakmp policy 1
  encr aes
  authentication pre-share
  hash sha256
  group 14
  crypto isakmp key cisco address 5.100/4.100
  crypto isakmp nat keepalive 5
  crypto ipsec transform-set имя esp-aes 256 esp-sha256-hmac
  mode tunnel
  crypto ipsec profile VTI
  set transform-set имя
  interface Tunnel1
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile VTI
  —
  ip access-list extended Lnew
  permit tcp any any established
  permit udp host 4.4.4.100 eq 53 any
  permit udp host 5.5.5.1 eq 123 any
  permit tcp any host 4.4.4.100 eq 80
  permit tcp any host 4.4.4.100 eq 443
  permit tcp any host 4.4.4.100 eq 2222
  permit udp host 5.5.5.100 host 4.4.4.100 eq 500
  permit esp any any
  permit icmp any any
  int gi 1
  ip access-group Lnew in
  ——
  ip access-list extended Rnew
  permit tcp any any established
  permit tcp any host 5.5.5.100 eq 80
  permit tcp any host 5.5.5.100 eq 443
  permit tcp any host 5.5.5.100 eq 2244
  permit udp host 4.4.4.100 host 5.5.5.100 eq 500
  permit esp any any
  permit icmp any any
  int gi 1
  ip access-group Rnew in

  (L) ip nat inside source static tcp 192.168.100.100 22 4.4.4.100 2222
  ip nat inside source static tcp/udp 192.168.100.200 53 4.4.4.100 53
  (R) ip nat inside source static tcp 172.16.100.100 22 5.5.5.100 2244

  /etc/chrony/chrony.conf
  (ISP) local stratum 4
  allow 4.4.4.0/24
  allow 3.3.3.0/24

  (webL-R) pool ntp.int.demo.wsr iburst
  allow 192.168.100.0/24

  ip domain name int.demo.wsr
  ip name-server 192.168.100.200
  ntp server ntp.int.demo.wsr (ip)
  raid
  /root/.smbclient
  username/password
  /etc/fstab
  //srv.int.demo.wsr/диск /opt/share cifs user,rw,_netdev,credentials=/root/.smbclient 0 0
  mkdir /opt/share
  mount -a

  apt install -y docker-ce
  systemctl start docker
  systemctl enable docker
  mkdir /mnt/app
  mount /dev/sr1 /mnt/app
  docker load < /mnt/app/app.tar
  docker images
  docker run —name app -p 8080:80 -d app

  docker ps
  no ip http secure-server
  reload
  (L) ip nat inside source static tcp 192.168.100.100 80 4.4.4.100 80
  ip nat inside source static tcp 192.168.100.100 443 4.4.4.100 443
  (R) ip nat inside source static tcp 172.16.100.100 80 5.5.5.100 80
  ip nat inside source static tcp 172.16.100.100 443 5.5.5.100 443
  nginx
  cd /opt/share
  openssl pkcs12 -nodes -nocerts -in http://www.pfx -out http://www.key
  openssl pkcs12 -nodes -nokeys -in http://www.pfx -out http://www.cer
  —
  cp /opt/share/www.key /etc/nginx/www.key
  cp /opt/share/www.cer /etc/nginx/www.cer
  nano /etc/nginx/snippets/snakeoil.conf
  ssl_certificate /etc/nginx/www.cer;
  ssl_certificate_key /etc/nginx/www.key;
  /etc/nginx/sites-available/default
  upstream backend {
  server 192.168.100.100:8080 fail_timeout=25;
  server 172.16.100.100:8080 fail_timeout=25;
  }

  server {
  listen 443 ssl default_server;
  include snippers/snakeoil.conf;

  server_name http://www.demo.wsr;

  location / {
  proxy_pass http://backend ;
  }
  }
  server {
  listen 80 default_server;
  server_name _;
  return 301 https://www.demo.wsr;
  }
  (CLI) scp -P 2244 '[email protected]:/opt/share/ca.cer' C:\Users\user\Desktop\

  Install-WindowsFeature -Name AD-Certificate, ADCS-Web-Enrollment -IncludeManagementTools
  Install-AdcsCertificationAuthority -CAType StandaloneRootCa -CACommonName "Demo.wsr" -force
  Install-AdcsWebEnrollment -Confirm -force
  New-SelfSignedCertificate -subject "localhost"
  Get-ChildItem cert:\LocalMachine\My
  Move-item Cert:\LocalMachine\My\rключ -destination Cert:\LocalMachine\Webhosting\
  New-IISSiteBinding -Name 'Default Web Site' -BindingInformation "*:443:" -Protocol https -CertificateThumbPrint ключ
  Start-WebSite -Name "Default Web Site"
  Get-CACrlDistributionPoint | Remove-CACrlDistributionPoint -force
  Get-CAAuthorityInformationAccess |Remove-CAAuthorityInformationAccess -force
  Get-CAAuthorityInformationAccess
  |Remove-CAAuthorityInformationAccess -force
  Restart-Service CertSrc

  Ответить