Oʻzbеkiston rеspublikasi axborot tеxnologiyalari va kommunikatsiyalarini rivojlantirish vazirligi

Download 7,38 Mb. Pdf ko'rish
bet	59/90
Sana	15.12.2023
Hajmi	7,38 Mb.
	#119638

1 ... 55 56 57 58 59 60 61 62 ... 90

Bog'liq
Тармоқ хавфсизлиги 16 шрифт

Amaliy qism
Amaliy qismda Cisco paket tracer simulyatorida VPN
texnologiyasini sozlash koʻrib chiqilgan. VPNni sozlash uchun
quyidagi koʻrsatmalarga amal qilish kerak.
1. Bosh ofis marshrutizatori, filial marshrutizatori va ular
oʻrtasida xizmat koʻrsatuvchi Internet-provayder marshrutizatori
joylashgan tarmoq topologiyasi yaratiladi (13.2-rasm).
2.
Belgilangan
manzildan
chiqadigan
barcha
marshrutizatorlarni sozlang. Quyida har bir marshrutizator uchun
buyruqlar toʻplami berilgan.
13.2-rasm. Tadqiq qilinayotgan tarmoq topologiyasi
ROUTER_1 ga kiritiladigan buyruqlar ketma-ketligi.
Router>enable
Router#conf t

161
Router(config)#int fa 0/0
Router(config-if)#no shut
Router(config-if)#ip nat inside
Router(config-if)#ip address 192.168.1.1 255.255.255.0
Router(config)#int fa 0/1
Router(config-if)#no shut
Router(config-if)#ip address 1.1.1.1 255.255.255.252
Router(config-if)#ip nat outside
Router(config-if)#exit
Router(config)#ip access-list extended for-nat
Router(config-ext-nacl)#deny ip 192.168.2.0 0.0.0.255 192.168.3.0
0.0.0.255
Router(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 any
Router(config-ext-nacl)#exit
Router(config)#ip nat inside source list for-nat int fa 0/1 overload
Router(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.2
Router(config)#ip dhcp pool vl2
Router(dhcp-config)#network 192.168.2.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.2.1
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#exit
Router(config)#crypto isakmp policy 1
Router(config-isakmp)#encryption aes
Router(config-isakmp)#hash md5
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#group 2
Router(config)#crypto isakmp key 123 address 2.2.2.1
Router(config)#crypto ipsec transform-set ts esp-aes esp-md5-hmac
Router(config)#ip access-list extended for-vpn
Router(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 192.168.3.0
0.0.0.255
Router(config-ext-nacl)#exit
Router(config)#crypto map kriptokarta 10 ipsec-isakmp
Router(config-crypto-map)#match address for-vpn
Router(config-crypto-map)#set peer 2.2.2.1
Router(config-crypto-map)#set transform-set ts
Router(config-crypto-map)#exit
Router(config)#int fa 0/1
Router(config-if)#crypto map kriptokarta
*Jan 3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON

162
Router(config-if)#exit (VPN qurish jarayoni)
ROUTER_2 kiritiladigan buyruqlar ketma-ketligi.
Router>enable
Router#conf t
Router(config)#int fa 0/0
Router(config-if)#no shut
Router(config-if)#ip nat inside
Router(config-if)#ip address 192.168.3.1 255.255.255.0
Router(config-if)#exit
Router(config)#int fa 0/1
Router(config-if)#no shut
Router(config-if)#ip address 2.2.2.1 255.255.255.0
Router(config-if)#ip nat outside
Router(config-if)#exit
Router(config)#ip access-list extended for-nat
Router(config-ext-nacl)#deny ip 192.168.3.0 0.0.0.255 192.168.2.0
0.0.0.255
Router(config-ext-nacl)#permit ip 192.168.3.0 0.0.0.255 any
Router(config-ext-nacl)#exit
Router(config)#ip nat inside source list for-nat int fa 0/1 overload
Router(config)#ip route 0.0.0.0 0.0.0.0 2.2.2.2
Router(config)#ip dhcp pool vl3
Router(dhcp-config)#network 192.168.3.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.3.1
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#exit
Router(config)#crypto isakmp policy 1
Router(config-isakmp)#encryption aes
Router(config-isakmp)#hash md5
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#group 2
Router(config-isakmp)#exit
Router(config)#crypto isakmp key 123 address 1.1.1.1
Router(config)#crypto ipsec transform-set ts esp-aes esp-md5-hmac
Router(config)#ip access-list extended for-vpn
Router(config-ext-nacl)#permit ip 192.168.3.0 0.0.0.255 192.168.2.0
0.0.0.255
Router(config-ext-nacl)#exit
Router(config)#crypto map kriptokarta 10 ipsec-isakmp

163
Router(config-crypto-map)#match address for-vpn
Router(config-crypto-map)#set peer 1.1.1.1
Router(config-crypto-map)#set transform-set ts
Router(config-crypto-map)#exit
Router(config)#int fa 0/1
Router(config-if)#crypto map kriptokarta
*Jan 3 07:16:26.785: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
Router(config-if)#exit
ROUTER_3 kiritiladigan buyruqlar ketma-ketligi.
Router>enable
Router#conf t
Router(config)#int fa 0/0
Router(config-if)#no shut
Router(config-if)#ip address 1.1.1.2 255.255.255.252
Router(config)#int fa 0/1
Router(config-if)#no shut
Router(config-if)#ip address 2.2.2.2 255.255.255.0
Router(config-if)#exit
3. DHCP protokoli ishlashini tekshirish (13.3-rasm).
13.3-rasm. DHCP protokoli funksiyasini tekshirish
4. Bosh ofis va filial oʻrtasida aloqani ICMP protokolidan
foydalanib tekshirish (13.4-rasm).

164
13.4-rasm. Korxonaning idoralari oʻrtasidagi aloqani tekshirish
5. VPN kanali orqali uzatiladigan paketlar statistikasi haqida
ma'lumot olish uchun Show crypto ipsec sa buyrugʻidan foydalaniladi
(13.5-rasm).
13.5-rasm. VPN kanali orqali yuborilgan ma'lumot statistikasi

165

Download 7,38 Mb.

1 ... 55 56 57 58 59 60 61 62 ... 90

Download 7,38 Mb.

Pdf ko'rish