多拠点の構成では、1台のルータがセンターの役割を担うのが一般的ですが、 このケースでは、拠点数が少ないときに、 すべての拠点が直接的に通信する構成を考えます。
---------+---- 192.168.0.0/24 | | | 192.168.0.1/24 +--------+--------+ | | | ルータ1 | | 名前:router1 | | | +--------+--------+ # # | # # | アドレス: 固定 # # | 172.16.0.1 # # | # # | PPPoE # # | # インターネットへ # # #################### ######################## # # インターネットへ インターネットへ # | # | # | PPPoE # | PPPoE # | # | # | アドレス: 固定 # | アドレス: 固定 # | 172.17.0.1 # | 172.18.0.1 # | # | +--------+--------+ +--------+--------+ | | <######## VPN ########> | | | ルータ2 | | ルータ3 | | 名前:router2 | 暗号方式: 3DES-CBC | 名前:router3 | | | 認証方式: HMAC-SHA1 | | +--------+--------+ +--------+--------+ | 192.168.1.1/24 | 192.168.2.1/24 | | | | ---------+---- 192.168.1.0/24 ---------+---- 192.168.2.0/24
Rev.6.02系のファームウェアの設定例です。
[ルータ1の設定例]
# # LAN1 interface # ip lan1 address 192.168.0.1/24 # # PP interface # pp select 1 pppoe use lan2 pp always-on on ppp lcp mru on 1454 ip pp mtu 1454 ip route default gateway pp 1 ppp ccp type none pp auth accept pap chap pp auth myname NAME PASSWORD ip pp address 172.16.0.1/32 ip pp nat descriptor 1 pp enable 1 # # IKE # ipsec auto refresh on # # IKE (ルータ2に関する設定) # ipsec ike local address 1 172.16.0.1 ipsec ike remote address 1 172.17.0.1 ipsec ike pre-shared-key 1 text himitsu1 ipsec sa policy 101 1 esp 3des-cbc sha-hmac # # IKE (ルータ3に関する設定) # ipsec ike local address 2 172.16.0.1 ipsec ike remote address 2 172.18.0.1 ipsec ike pre-shared-key 2 text himitsu2 ipsec sa policy 102 2 esp 3des-cbc sha-hmac # # TUNNEL interface (ルータ2に関する設定) # tunnel select 1 ipsec tunnel 101 ip route 192.168.1.0/24 gateway tunnel 1 tunnel enable 1 # # TUNNEL interface (ルータ3に関する設定) # tunnel select 2 ipsec tunnel 102 ip route 192.168.2.0/24 gateway tunnel 2 tunnel enable 2 # # NAT descriptor # nat descriptor type 1 masquerade nat descriptor address outer 1 172.16.0.1 nat descriptor address inner 1 172.16.0.1 192.168.0.1-192.168.0.254 nat descriptor masquerade static 1 1 172.16.0.1 udp 500 nat descriptor masquerade static 1 2 172.16.0.1 esp *
[ルータ2の設定例]
# # LAN1 interface # ip lan1 address 192.168.1.1/24 # # PP interface # pp select 1 pppoe use lan2 pp always-on on ppp lcp mru on 1454 ip pp mtu 1454 ip route default gateway pp 1 ppp ccp type none pp auth accept pap chap pp auth myname NAME PASSWORD ip pp address 172.17.0.1/32 ip pp nat descriptor 1 pp enable 1 # # IKE # ipsec auto refresh on # # IKE (ルータ3に関する設定) # ipsec ike local address 1 172.17.0.1 ipsec ike remote address 1 172.18.0.1 ipsec ike pre-shared-key 1 text himitsu3 ipsec sa policy 101 1 esp 3des-cbc sha-hmac # # IKE (ルータ1に関する設定) # ipsec ike local address 2 172.17.0.1 ipsec ike remote address 2 172.16.0.1 ipsec ike pre-shared-key 2 text himitsu1 ipsec sa policy 102 2 esp 3des-cbc sha-hmac # # TUNNEL interface (ルータ3に関する設定) # tunnel select 1 ipsec tunnel 101 ip route 192.168.2.0/24 gateway tunnel 1 tunnel enable 1 # # TUNNEL interface (ルータ1に関する設定) # tunnel select 2 ipsec tunnel 102 ip route 192.168.0.0/24 gateway tunnel 2 tunnel enable 2 # # NAT descriptor # nat descriptor type 1 masquerade nat descriptor address outer 1 172.17.0.1 nat descriptor address inner 1 172.17.0.1 192.168.1.1-192.168.1.254 nat descriptor masquerade static 1 1 172.17.0.1 udp 500 nat descriptor masquerade static 1 2 172.17.0.1 esp *
[ルータ3の設定例]
# # LAN1 interface # ip lan1 address 192.168.2.1/24 # # PP interface # pp select 1 pppoe use lan2 pp always-on on ppp lcp mru on 1454 ip pp mtu 1454 ip route default gateway pp 1 ppp ccp type none pp auth accept pap chap pp auth myname NAME PASSWORD ip pp address 172.18.0.1/32 ip pp nat descriptor 1 pp enable 1 # # IKE # ipsec auto refresh on # # IKE (ルータ1に関する設定) # ipsec ike local address 1 172.18.0.1 ipsec ike remote address 1 172.16.0.1 ipsec ike pre-shared-key 1 text himitsu1 ipsec sa policy 101 1 esp 3des-cbc sha-hmac # # IKE (ルータ2に関する設定) # ipsec ike local address 2 172.18.0.1 ipsec ike remote address 2 172.17.0.1 ipsec ike pre-shared-key 2 text himitsu2 ipsec sa policy 102 2 esp 3des-cbc sha-hmac # # TUNNEL interface (ルータ1に関する設定) # tunnel select 1 ipsec tunnel 101 ip route 192.168.0.0/24 gateway tunnel 1 tunnel enable 1 # # TUNNEL interface (ルータ2に関する設定) # tunnel select 2 ipsec tunnel 102 ip route 192.168.1.0/24 gateway tunnel 2 tunnel enable 2 # # NAT descriptor # nat descriptor type 1 masquerade nat descriptor address outer 1 172.18.0.1 nat descriptor address inner 1 172.18.0.1 192.168.2.1-192.168.2.254 nat descriptor masquerade static 1 1 172.18.0.1 udp 500 nat descriptor masquerade static 1 2 172.18.0.1 esp *