目 录
摘 要 ........................................................ I Abstract ..................................................... II 1 绪论 ...................................................... 1 1.1 课题研究背景 ............................................. 1 1.2 国内外研究现状 ........................................... 1 1.3 VPN技术应用于校园网的重要意义 ............................ 3 1.4 本文主要研究内容 ......................................... 3 2 VPN技术剖析 ............................................... 3 2.1 VPN简介 .................................................. 3 2.2 VPN工作原理 .............................................. 4 2.3 VPN关键技术 .............................................. 5 2.4 VPN组网方式 .............................................. 7 3 基于IPSec协议的VPN技术 .................................. 8 3.1 IPSec协议体系结构 ........................................ 9 3.2 IPSec协议工作原理 ....................................... 10 3.3 IPSec协议两种工作模式 ................................... 11 3.4 IPSec协议族的构成 ....................................... 12 3.5 IPSec VPN的优缺点 ....................................... 15 4 VPN产品选型及校园网组网方案 ............................... 16 4.1 校园网设计方案的要求 ..................................... 16 4.2 东方学院校园网组网需求分析 ............................... 16 4.3 校园网对网络设备要求 ..................................... 16 4.4 网络产品选型 ............................................. 17 4.5 东方学院校园网拓扑结构设计 ............................... 19 5 IP地址规划 ................................................ 20 5.1 IP地址划分发展历程 ....................................... 20 5.2 IP地址规划原则 ........................................... 21 5.3 IP地址规划 ............................................... 21 6 组网的方案设计实现 ......................................... 22 6.1 VLAN的配置与实现 ......................................... 23 6.2 VTP的配置与实现 .......................................... 23 6.3 链路聚合的配置与实现 .................................... 25 6.4 三层接口配置 ............................................ 25
1
6.5 HSRP的配置与实现 ........................................ 27 6.6 NAT/PAT的配置与实现 ..................................... 28 6.8 Internet接入之静态路由配置 .............................. 30 6.9 ACL的配置与实现 ......................................... 30 6.10 IPSEC VPN的配置与实现 .................................. 31 7 测试结果 ................................................... 32 7.1 查看各设备的端口配置情况 ................................. 32 7.2 VTP的配置结果 ............................................ 33 7.3 OSPF的配置结果 ........................................... 34 7.4 HSRP测试结果 ............................................. 35 7.5 IPSec测试结果 ............................................ 35 7.6 全网连通性测试结果 ....................................... 37 8 总结 ....................................................... 39 8.1 本文完成的工作 .......................................... 39 8.2 感悟 .................................................... 39 参考文献 ..................................................... 41 致 谢 ....................................................... 42
2
摘 要
随着东方学院校园规模的扩大，如何实现不同校区间的资源安全高效地互访，这是校园网建设面临的重大问题。IPSec VPN是解决此问题的非常有效的手段。
本文首先介绍了IPSec协议族及VPN相关技术，对东方学院校园网的现状及使用IPSec VPN技术设计校园网的可行性与必要性作了详细分析，然后结合网络结构和使用情况提出了基于IPSec VPN的校园网建设的组网方案，通过GNS3网络仿真软件实现了总部和分部两个校区间资源互访，给出了网络拓扑中各个设备的具体配置方法。
关键词：IP安全协议；虚拟专用网；校园网；通用路由封装；隧道
I
Abstract
With the expansion of Oriental College，the college has a major issue to build the construction of the campus network, to actualize a safe and efficient resources exchange among different campuses visits. IPSec protocol and VPN technology is a very effective solution to solve this problem.
The IPSec protocol and VPN technology be called IPSec VPN for short, it is necessary and available based on current situation of campus network. This paper explains the necessity and feasibility in detail first, and then introduces the campus networking solution of IPSec VPN based on network structure and the use. The GNS3 network simulation software actualizes the resources exchange and visit visits between the headquarters and the branch. The network topology method shows the specific configuration of each device in the solution.
Keywords:IPSec;VPN;campus network;GRE;tunnel
II