Scribd Logo
Upload

Welcome to Scribd!

  • 10 views

    Somativa7 Redes

    Uploaded by

    matheuszanellato

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    Somativa7 Redes

    Uploaded by

    matheuszanellato
    10 views4 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    10 views4 pages

    Somativa7 Redes

    Uploaded by

    matheuszanellato

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    You are on page 1of 4

    1) Antes de gerar qualquer tráfego entre os computadores verifique o estado do

    túnel IPsec:

    No Router A:
    PARIS#show crypto map
    Crypto Map IPSECWAN 100 ipsec-isakmp
    Peer = 10.0.0.2
    Extended IP access list 100
    access-list 100 permit ip 10.1.1.0 0.0.0.255 172.16.2.0 0.0.0.255
    Current peer: 10.0.0.2
    Security association lifetime: 4608000 kilobytes/86400 seconds
    PFS (Y/N): Y
    Transform sets={
    SECUREWAN,
    }
    Interfaces using crypto map IPSECWAN:
    FastEthernet0/1

    PARIS#show crypto ipsec transform-set


    Transform set SECUREWAN: { { esp-aes esp-sha-hmac }
    will negotiate = { Tunnel, },

    Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }


    will negotiate = { Transport, },
    Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }
    will negotiate = { Transport, },

    PARIS#show crypto isakmp sa


    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status

    IPv6 Crypto ISAKMP SA

    PARIS#show crypto isakmp sa


    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status

    IPv6 Crypto ISAKMP SAPARIS#show crypto map


    Crypto Map IPSECWAN 100 ipsec-isakmp
    Peer = 10.0.0.2
    Extended IP access list 100
    access-list 100 permit ip 10.1.1.0 0.0.0.255 172.16.2.0 0.0.0.255
    Current peer: 10.0.0.2
    Security association lifetime: 4608000 kilobytes/86400 seconds
    PFS (Y/N): Y
    Transform sets={
    SECUREWAN,
    }
    Interfaces using crypto map IPSECWAN:
    FastEthernet0/1

    PARIS#show crypto ipsec transform-set


    Transform set SECUREWAN: { { esp-aes esp-sha-hmac }
    will negotiate = { Tunnel, },

    Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }


    will negotiate = { Transport, },
    Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }
    will negotiate = { Transport, },

    PARIS#show crypto isakmp sa


    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status

    IPv6 Crypto ISAKMP SA

    No Router B:
    NEWYORK#show crypto map
    Crypto Map IPSECWAN 100 ipsec-isakmp
    Peer = 172.16.1.1
    Extended IP access list 100
    access-list 100 permit ip 172.16.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    Current peer: 172.16.1.1
    Security association lifetime: 4608000 kilobytes/86400 seconds
    PFS (Y/N): Y
    Transform sets={
    SECUREWAN,
    }
    Interfaces using crypto map IPSECWAN:
    FastEthernet0/1

    NEWYORK#show crypto ipsec transform-set


    Transform set SECUREWAN: { { esp-aes esp-sha-hmac }
    will negotiate = { Tunnel, },

    Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }


    will negotiate = { Transport, },
    Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }
    will negotiate = { Transport, },

    NEWYORK#show crypto isakmp sa


    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status

    IPv6 Crypto ISAKMP SA

    2) Mostre a informação sobre a Política e a Associação de Segurança criada nos


    roteadores do túnel:

    Efetue um ping entre um computador da rede A e da rede B

    Em seguida, verifique novamente o estado na associação de segurança:

    No Router A:
    PARIS#show crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status
    10.0.0.2 172.16.1.1 QM_IDLE 1096 0 ACTIVE

    IPv6 Crypto ISAKMP SA

    PARIS#show crypto ipsec sa

    interface: FastEthernet0/1
    Crypto map tag: IPSECWAN, local addr 172.16.1.1

    protected vrf: (none)


    local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (172.16.2.0/255.255.255.0/0/0)
    current_peer 10.0.0.2 port 500
    PERMIT, flags={origin_is_acl,}
    #pkts encaps: 7, #pkts encrypt: 7, #pkts digest: 0
    #pkts decaps: 6, #pkts decrypt: 6, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

    local crypto endpt.: 172.16.1.1, remote crypto endpt.:10.0.0.2


    path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1
    current outbound spi: 0x19DE1DE4(433987044)

    inbound esp sas:


    spi: 0xE673BF29(3866345257)

    No Router B:
    NEWYORK#show crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst src state conn-id slot status
    172.16.1.1 10.0.0.2 QM_IDLE 1075 0 ACTIVE

    IPv6 Crypto ISAKMP SA

    NEWYORK#show crypto ipsec sa

    interface: FastEthernet0/1
    Crypto map tag: IPSECWAN, local addr 10.0.0.2

    protected vrf: (none)


    local ident (addr/mask/prot/port): (172.16.2.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
    current_peer 172.16.1.1 port 500
    PERMIT, flags={origin_is_acl,}
    #pkts encaps: 6, #pkts encrypt: 6, #pkts digest: 0
    #pkts decaps: 7, #pkts decrypt: 7, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

    local crypto endpt.: 10.0.0.2, remote crypto endpt.:172.16.1.1


    path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1
    current outbound spi: 0xE673BF29(3866345257)

    inbound esp sas:


    spi: 0x19DE1DE4(433987044)

    Localize o código SPI do tráfego envido de A para B e do tráfego enviado de B para


    A.
    Paris
    outbound: 0x19DE1DE4(433987044)
    inbound: 0xE673BF29(3866345257)

    New York
    outbound: 0xE673BF29(3866345257)
    inbound: 0x19DE1DE4(433987044)

    4) Usando o modo simulador, mostre o formato dos pacotes nos seguites trajetos:

    Edit Filters: Misc: ISAKMP + IPsec, IPv4: ICMP + UDP

    SRC IP - DST IP - ICMP


    ou
    SRP IP - DST IP - ESP - SRC IP - DST IP - ICMP

    a) Entre o HOST e o RouterA


    SRC IP:10.1.1.1
    DST IP:172.16.2.2
    ICMP

    b) Entre o RouterA e a Internet


    SRC IP:172.16.1.1
    DST IP:10.0.0.2
    ESP SPI:2076327031

    c) Entre a Internet e o RouterB


    SRC IP:172.16.1.1
    DST IP:10.0.0.2
    ESP SPI:2076327031

    d) Entre o RouterB e o HOST


    SRC IP:10.1.1.1
    DST IP:172.16.2.2
    ICMP

    5) Responda as seguintes perguntas:

    a) Como o protocolo de negociação de chaves do IPSEC (ISAKMP) é encapsulado


    R: UDP na porta 500

    b) Os pacotes ICMP enviados pelo computador estão protegidos antes de chegar no


    computador? Como os pacotes IP identificam o protocolo ICMP?
    R: Não.
    Pelo Campo: PRO:0x01 no cabeçalho do IP

    b) Os pacotes ICMP estão protegidos através da Internet? Como os pacotes IP


    identificam o protocolo ICMP protegido?
    R: Sim.
    PRO:0x32 = Código do IPsec ESP

    You might also like