{"id":166,"date":"2023-08-13T13:20:26","date_gmt":"2023-08-13T09:50:26","guid":{"rendered":"https:\/\/zharfpouyan.net\/docs\/?p=166"},"modified":"2023-08-17T09:12:49","modified_gmt":"2023-08-17T05:42:49","slug":"ipsec-config","status":"publish","type":"post","link":"https:\/\/zharfpouyan.net\/docs\/ipsec-config\/","title":{"rendered":"8-5. \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec"},"content":{"rendered":"<p>IPsec \u06a9\u0647 \u0645\u062e\u0641\u0641 \u0639\u0628\u0627\u0631\u062a Internet Protocol Security \u0627\u0633\u062a\u060c \u06cc\u06a9 \u0645\u062c\u0645\u0648\u0639\u0647 \u067e\u0631\u0648\u062a\u06a9\u0644 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0645\u0646 \u06a9\u0631\u062f\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u067e\u0631\u0648\u062a\u06a9\u0644 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a (IP) \u0645\u06cc\u200c\u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0645\u0646\u0638\u0648\u0631 \u0627\u0632 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0628\u0633\u062a\u0647\u200c\u0647\u0627\u06ccIP \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06cc\u06a9 \u0646\u0634\u0633\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n<p>\u0627\u06cc\u0646 \u0633\u0631\u0648\u06cc\u0633 \u0634\u0627\u0645\u0644 \u062a\u0639\u062f\u0627\u062f\u06cc \u067e\u0631\u0648\u062a\u06a9\u0644 \u0628\u0631\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0648 \u0637\u0631\u0641\u0647 \u0628\u06cc\u0646 \u0633\u06cc\u0633\u062a\u0645\u200c \u0647\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0634\u0631\u0648\u0639 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0648 \u0627\u0646\u062a\u0642\u0627\u0644 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u06a9\u0647 \u062f\u0631 \u0637\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f\u060c \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.<\/p>\n<p>\u0628\u0631\u0627\u06cc \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06ccVPN \u0628\u06cc\u0646 \u062f\u0648 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 IPsec \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n<p>\u0628\u0631\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u0645\u0646 \u062f\u0631 \u06cc\u06a9 \u0634\u0628\u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641\u06cc \u0646\u0638\u06cc\u0631SSL \u060c TLS\u00a0 \u0648 \u06cc\u0627SSH \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0646\u0645\u0648\u062f\u060c \u0648\u0644\u06cc \u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc\u06a9\u0647 \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u062f\u0631 \u0645\u062f\u0644 TCP\/IP \u062f\u0631 \u0644\u0627\u06cc\u0647 \u0628\u0627\u0644\u0627\u062a\u0631 \u0639\u0645\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u0646\u0631\u0645 \u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062e\u0648\u0627\u0647\u062f \u0627\u0632 \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f\u060c \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0645\u0646\u0638\u0648\u0631 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0627\u0634\u062f. \u0628\u0631 \u062e\u0644\u0627\u0641 \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f\u060c IPsec \u0627\u0632 \u062a\u0645\u0627\u0645 \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0639\u0628\u0648\u0631\u06cc \u0628\u0631 \u0631\u0648\u06cc \u0634\u0628\u06a9\u0647 IP \u0645\u062d\u0627\u0641\u0638\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0646\u06cc\u0627\u0632\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 \u0628\u0631\u0646\u0627\u0645\u0647 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u06a9\u0647 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u06cc\u0645\u0646 \u062f\u0627\u0631\u062f\u060c \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0645\u0646\u0638\u0648\u0631 \u0637\u0631\u0627\u062d\u06cc \u0645\u062c\u062f\u062f \u0634\u0648\u062f.<\/p>\n<p>&nbsp;<\/p>\n<p>IPsec \u0628\u0631\u0627\u06cc \u0627\u0646\u062c\u0627\u0645 \u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u062e\u062a\u0644\u0641 \u0627\u0632 \u067e\u0631\u0648\u062a\u06a9\u0644\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n<ul>\n<li><strong>AH<\/strong> &#8211; <strong>Authentication<\/strong> <strong>Headers<\/strong> : \u0648\u0638\u06cc\u0641\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u062a\u06a9\u0644 \u062a\u0636\u0645\u06cc\u0646 \u062f\u0631\u0633\u062a\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627 \u062f\u0631 \u06cc\u06a9 \u0627\u062a\u0635\u0627\u0644 \u0628\u062f\u0648\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 (Connectionless) \u0648 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0646\u0628\u0639 \u062f\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc IP datagram \u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0645\u062d\u0627\u0641\u0638\u062a \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 p\u0645\u0644\u0647 Replay \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.<\/li>\n<li><strong>ESP<\/strong> &#8211; <strong>Encapsulating<\/strong> <strong>Security<\/strong> <strong>Payloads<\/strong> : \u0648\u0638\u06cc\u0641\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u062a\u06a9\u0644 \u062a\u0636\u0645\u06cc\u0646 \u0645\u062d\u0631\u0645\u0627\u0646\u0647 \u0628\u0648\u062f\u0646\u060c \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0646\u0628\u0639 \u062f\u0627\u062f\u0647\u060c \u062f\u0631\u0633\u062a\u06cc \u0627\u062a\u0635\u0627\u0644 \u062f\u0631 \u062d\u0627\u0644\u062a \u0628\u062f\u0648\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 (connectionless) \u0648 \u0633\u0631\u0648\u06cc\u0633anti-replay \u0645\u06cc\u200c\u0628\u0627\u0634\u062f.<\/li>\n<li><strong>SA<\/strong> &#8211; <strong>Security<\/strong> <strong>Associations<\/strong> : \u0648\u0638\u06cc\u0641\u0647 \u0627\u06cc\u0646 \u067e\u0631\u0648\u062a\u06a9\u0644 \u062a\u062f\u0627\u0631\u06a9 \u0645\u062c\u0645\u0648\u0639\u0647 \u0627\u06cc \u0627\u0632 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c \u0647\u0627 \u0648 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627\u0631\u0627\u0645\u062a\u0631 \u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 \u0628\u0631\u0627\u06cc \u0627\u0646\u062c\u0627\u0645 \u0639\u0645\u0644\u06cc\u0627\u062a AH \u0648 ESP \u0631\u0627 \u0634\u0627\u0645\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0627\u06cc\u0646 \u067e\u0631\u0648\u062a\u06a9\u0644 \u0627\u0632 ISAKMP &#8211; Internet Security Association and Key Management Protocol \u06a9\u0647 \u0634\u0627\u0645\u0644 \u06cc\u06a9 \u0686\u0627\u0631\u0686\u0648\u0628 \u0628\u0631\u0627\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0647\u0648\u06cc\u062a \u0648 \u062a\u0628\u0627\u062f\u0644 \u06a9\u0644\u06cc\u062f \u0627\u0633\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/li>\n<\/ul>\n<p><strong>1-8-5. \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec \u0628\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628<\/strong><\/p>\n<p>\u0628\u0631\u0627\u06cc \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPsec \u0628\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u060c \u0628\u0627\u06cc\u062f \u062f\u0631 \u0647\u0631 \u06a9\u062f\u0627\u0645 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u060c \u062a\u0646\u0638\u06cc\u0645\u0627\u062a\u06cc \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u062f. \u062a\u0646\u0638\u06cc\u0645 \u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc \u0627\u0631\u062a\u0628\u0627\u0637\u06cc IPsec \u062f\u0631 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0627\u0633\u0631\u06cc \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u0634\u0648\u062f.<\/p>\n<p>\u062f\u0631 \u0632\u06cc\u0631 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPsec \u062a\u0648\u0636\u06cc\u062d \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>ISAKMP Policy<\/strong><strong> :<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# crypto isakmp policy number<\/pre>\n<p>\u062f\u0631 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0634\u0645\u0627\u0631\u0647 \u0627\u06cc \u06a9\u0647 \u062f\u0631\u062c \u0645\u06cc\u0634\u0648\u062f \u062f\u0631 \u0648\u0627\u0642\u0639 \u0645\u0642\u062f\u0627\u0631 \u0627\u0648\u0644\u0648\u06cc\u062a protection suite \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u062a\u0648\u0627\u0646\u062f \u0639\u062f\u062f\u06cc \u0628\u06cc\u0646 1 \u062a\u0627 10000 \u0628\u0627\u0634\u062f<\/p>\n<p>\u0628\u0627 \u0627\u0639\u0645\u0627\u0644 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0631\u0648\u062a\u0631 \u0648\u0627\u0631\u062f \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc isakmp policy \u0634\u062f\u0647 \u0648 \u0622\u0645\u0627\u062f\u0647 \u062f\u0631\u06cc\u0627\u0641\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#<\/pre>\n<p><strong>\u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u0647\u0645 \u062f\u0631 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u00a0 <\/strong><strong>isakmp Policy<\/strong><strong>:<\/strong><\/p>\n<ul>\n<li><strong>authentication<\/strong><\/li>\n<\/ul>\n<p>\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0646\u0648\u0639 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a IPSec \u0631\u0627\u00a0 \u062a\u0639\u06cc\u06cc\u0646 \u06a9\u0631\u062f. \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641 \u0641\u0642\u0637 \u0627\u0632 \u06cc\u06a9 \u0631\u0648\u0634 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc \u06a9\u0646\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)# authentication pre-share<\/pre>\n<ul>\n<li><strong>Encryption<\/strong><\/li>\n<\/ul>\n<p>\u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0627\u0632 \u0627\u0648\u0644 IPsec \u06cc\u0627 \u0647\u0645\u0627\u0646 \u062a\u0628\u0627\u062f\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u0646\u0645\u0627\u06cc\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)# encryption { 3des | aes | blowfish | camellia | des }<\/pre>\n<ul>\n<li><strong>group<\/strong><\/li>\n<\/ul>\n<p>\u062a\u0646\u0638\u06cc\u0645 \u06af\u0631\u0648\u0647 Diffie-Hellman \u0628\u0631\u0627\u06cc policy \u0645\u0648\u0631\u062f \u0646\u0638\u0631<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)# group { 1 | 2 | 5 }<\/pre>\n<ul>\n<li><strong>hash<\/strong><\/li>\n<\/ul>\n<p>\u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0641\u0627\u0632 \u0627\u0648\u0644 IPsec \u06cc\u0627 \u0647\u0645\u0627\u0646 \u062a\u0628\u0627\u062f\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u0646\u0645\u0627\u06cc\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)# hash { MD5 | sha1 | sha256 | sha382 | sha512 }<\/pre>\n<ul>\n<li><strong>lifetime<\/strong><\/li>\n<\/ul>\n<p>\u062a\u0639\u06cc\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0628\u0631 \u062d\u0633\u0628 \u062b\u0627\u0646\u06cc\u0647 \u0627\u0646\u0642\u0636\u0627 \u0628\u0631\u0627\u06cc ISAKMP-SA<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)# lifetime &lt;60-86400&gt;<\/pre>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>ISAKMP key<\/strong><\/p>\n<p>\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u0645 pre-share key \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u0634\u062e\u0635 \u06a9\u0631\u062f<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# crypto isakmp key password address ip-address<\/pre>\n<p>\u062f\u0631 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u0642\u062f\u0627\u0631 \u06a9\u0644\u06cc\u062f \u06cc\u0627 \u0647\u0645\u0627\u0646 \u0631\u0645\u0632\u0639\u0628\u0648\u0631 \u0628\u0631\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062a\u0639\u06cc\u06cc\u0646 \u0645\u06cc\u0634\u0648\u062f. \u0627\u06cc\u0646 \u06a9\u0644\u06cc\u062f \u062a\u0648\u0633\u0637 \u0647\u0631 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u062f\u0631 IPsec \u0628\u0627\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0648 \u062a\u0639\u0631\u06cc\u0641 \u0634\u0648\u062f. \u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u062f\u0633\u062a\u0648\u0631 \u0622\u062f\u0631\u0633 IP \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631\u062c \u0645\u06cc\u0634\u0648\u062f<\/p>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>IPsec transform-set<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# crypto ipsec transform-set name { ah-md5-hmac | ah-sha-hmac | ah-sha256-hmac | ah-sha284-hmac | ah-sha512-hmac | esp-3des | esp-aes | esp-blowfish | esp-camellia | esp-des | esp-md5-hmac  |esp-sha-hmac | esp-sha256-hamc | esp-sha384-hamc | esp-sha512-hmac } [ transform-set-2 ] [ transform-set-3 ]<\/pre>\n<p><em>name<\/em> :\u0646\u0627\u0645\u06cc \u0627\u0646\u062a\u062e\u0627\u0628\u06cc \u0628\u0631\u0627\u06cc transform-set \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647<\/p>\n<p>\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc \u00a0Transform set \u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc IPSec \u0645\u0634\u062e\u0635 \u0645\u06cc\u06a9\u0646\u06cc\u0645. \u0647\u0645\u0686\u0646\u06cc\u0646 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 \u0631\u0645\u0632 \u0646\u06af\u0627\u0631\u06cc \u0648 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0631 \u0641\u0627\u0632 \u062f\u0648\u0645 IPSec \u0645\u0634\u062e\u0635 \u0645\u06cc \u0634\u0648\u062f<\/p>\n<p>\u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 \u0648\u0627\u0631\u062f \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u062c\u062f\u06cc\u062f \u0645\u06cc \u0634\u0648\u062f:<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(cfg-crypto-trans)#<\/pre>\n<p>\u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0633\u0637\u062d \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632:<\/p>\n<p><strong>mode<\/strong>: \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0646\u0648\u0639 \u062a\u0628\u0627\u062f\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0645\u0634\u062e\u0635\u06cc \u06a9\u0631\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(cfg-crypto-trans)#mode { tunnel | transport }<\/pre>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>IPsec Profile<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# crypto ipsec profile name<\/pre>\n<p>\u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631 \u0628\u0627\u0644\u0627 \u0631\u0648\u062a\u0631 \u0648\u0627\u0631\u062f \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u00a0 ipsec profile \u0634\u062f\u0647 \u0648 \u0622\u0645\u0627\u062f\u0647 \u062b\u0628\u062a \u062a\u0639\u0631\u06cc\u0641 \u06a9\u0627\u0631\u0628\u0631 \u0627\u0632 ipsec profile \u0645\u06cc \u0628\u0627\u0634\u062f.<\/p>\n<p>&nbsp;<\/p>\n<p>\u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u0646\u062f \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632:<\/p>\n<p><strong>set pfs<\/strong> :\u062b\u0628\u062a \u06af\u0631\u0648\u0647 Diffie-Hellman \u0628\u0631\u0627\u06cc profile \u0645\u0648\u0631\u062f \u0646\u0638\u0631<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-ipsec)# set pfs{ group1 | group2 | group5 }<\/pre>\n<p><strong>set security-association<\/strong> : \u062a\u0639\u06cc\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0627\u0646\u0642\u0636\u0627 \u0628\u0631\u0627\u06cc IPsec-SA<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-ipsec)# set security-association lifetime seconds  &lt;120-86400&gt;<\/pre>\n<p><strong>set transform-set<\/strong> : \u0628\u0647 \u0648\u0633\u06cc\u0644\u0647 \u06cc \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u062f transform-set \u06a9\u0647 \u0642\u0628\u0644\u0627 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a \u0631\u0627 \u0628\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u062c\u0627\u0631\u06cc \u0636\u0645\u06cc\u0645\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-ipsec)# set transform-set name<\/pre>\n<p>\u0648 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0628\u0627 \u0627\u0639\u0645\u0627\u0644 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 IPsec \u0633\u0627\u062e\u062a \u0634\u062f\u0647 \u062f\u0631 Tunnel\u060c\u00a0 \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0647\u0627\u06cc Tunnel \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Ipsec \u0645\u062d\u0627\u0641\u0638\u062a \u0648 \u0631\u0645\u0632 \u0646\u06af\u0627\u0631\u06cc \u0645\u06cc \u0634\u0648\u062f.<\/p>\n<p>\u0628\u0631\u0627\u06cc \u0627\u06cc\u0646\u06a9\u0627\u0631 \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a \u0648\u0627\u0631\u062f \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0627\u06cc\u0646\u062a\u0631\u0641\u06cc\u0633 tunnel \u0634\u062f\u0647 \u0648 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f:<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-if)# tunnel protection ipsec profile name<\/pre>\n<p><em>name<\/em> :\u0646\u0627\u0645 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 IPSec<\/p>\n<p>&nbsp;<\/p>\n<p><strong>1-4-4. \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec Site-to-Site \u0628\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628<\/strong><\/p>\n<p>\u0628\u0631\u0627\u06cc \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPsec \u0628\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u060c \u0628\u0627\u06cc\u062f \u062f\u0631 \u0647\u0631 \u06a9\u062f\u0627\u0645 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u060c \u062a\u0646\u0638\u06cc\u0645\u0627\u062a\u06cc \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u062f.<\/p>\n<p>\u0628\u0631\u0627\u06cc \u062a\u0646\u0638\u06cc\u0645 \u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc \u0627\u0631\u062a\u0628\u0627\u0637\u06cc IPsec\u060c \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0627\u0633\u0631\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u0634\u0648\u062f.<\/p>\n<p>\u062f\u0631 \u0632\u06cc\u0631 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0633\u0631\u0648\u06cc\u0633 IPsec \u062a\u0648\u0636\u06cc\u062d \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>ISAKMP Policy<\/strong><strong> :<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)#crypto isakmp policy number<\/pre>\n<p><em>number<\/em>:\u00a0 \u0634\u0645\u0627\u0631\u0647 policy \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647<\/p>\n<p>\u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0631\u0648\u062a\u0631 \u0648\u0627\u0631\u062f \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc isakmp policy \u0634\u062f\u0647 \u0648 \u0622\u0645\u0627\u062f\u0647 \u062f\u0631\u06cc\u0627\u0641\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f<\/p>\n<p><strong>\u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u0647\u0645 \u062f\u0631 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc\u00a0 <\/strong><strong>Isakmp Policy<\/strong><strong>:<\/strong><\/p>\n<p><strong>authentication<\/strong> : \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 \u0646\u0648\u0639 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a IPSec \u0631\u0627\u00a0 \u062a\u0639\u06cc\u06cc\u0646 \u06a9\u0646\u06cc\u0645. \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641 \u0641\u0642\u0637 \u0627\u0632 \u06cc\u06a9 \u0645\u062a\u062f \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc \u06a9\u0646\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#authentication pre-share<\/pre>\n<p><strong>Encryption<\/strong>: \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0627\u0632 \u0627\u0648\u0644 IPsec \u06cc\u0627 \u0647\u0645\u0627\u0646 \u062a\u0628\u0627\u062f\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u0646\u0645\u0627\u06cc\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#encryption { 3des | aes | blowfish | camellia | des }<\/pre>\n<p><strong>group<\/strong>: \u062a\u0646\u0638\u06cc\u0645 \u06af\u0631\u0648\u0647 Diffie-Hellman \u0628\u0631\u0627\u06cc policy \u0645\u0648\u0631\u062f \u0646\u0638\u0631<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#group { 1 | 2 | 5 }<\/pre>\n<p><strong>hash<\/strong>: \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 Hash \u0631\u0627 \u062f\u0631 \u0641\u0627\u0632 \u0627\u0648\u0644 IPsec \u06cc\u0627 \u0647\u0645\u0627\u0646 \u062a\u0628\u0627\u062f\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u0646\u0645\u0627\u06cc\u062f.<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#hash { MD5 | sha1 }<\/pre>\n<p><strong>lifetime<\/strong>: \u062a\u0639\u06cc\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0627\u0646\u0642\u0636\u0627 \u0628\u0631\u0627\u06cc ISAKMP-SA<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config-isakmp)#lifetime &lt;60-86400&gt;<\/pre>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>ISAKMP key<\/strong><\/p>\n<p>\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u0645 pre-share key \u0645\u0648\u0631\u062f \u0646\u0638\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u0634\u062e\u0635\u06cc \u06a9\u0631\u062f<\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# crypto isakmp key Key address ip-address<\/pre>\n<p><em>key<\/em> : \u06a9\u0644\u06cc\u062f\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0637\u0631\u0641 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631\u060c \u062a\u0648\u0633\u0637 \u0647\u0631 \u06cc\u06a9 \u0627\u0632 \u0637\u0631\u0641\u06cc\u0646 \u062a\u0628\u0627\u062f\u0644\u060c \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc \u0634\u0648\u062f.<\/p>\n<p><em>ip-address<\/em>: \u0622\u062f\u0631\u0633 IP \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0631\u0627\u0647 \u062f\u0648\u0631<\/p>\n<p><strong>\u062a\u0639\u0631\u06cc\u0641 <\/strong><strong>crypto map<\/strong><strong> :<\/strong><\/p>\n<pre class=\"lang:default decode:true \">Zharf(config)# crypto map name  &lt;1-65535&gt;  ipsec-isakmp<\/pre>\n<p><em>name<\/em> : \u0646\u0627\u0645\u06cc \u0627\u0646\u062a\u062e\u0627\u0628\u06cc \u0628\u0631\u0627\u06cc <strong>crypto map<\/strong> \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647<\/p>\n<p>&lt;1-65535&gt; : \u0634\u0645\u0627\u0631\u0647 \u062e\u0637 crypto map \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0627\u0639\u0645\u0627\u0644 \u062f\u0633\u062a\u0648\u0631\u0627\u062a<\/p>\n<p>\u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u060c \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0648\u0627\u0631\u062f \u0633\u0637\u062d config-crypto-map \u0634\u062f\u0647 \u0648 \u0622\u0645\u0627\u062f\u0647 \u062f\u0631\u06cc\u0627\u0641\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u0628\u0627\u0634\u062f<\/p>\n<p>\u062f\u0633\u062a\u0648\u0631\u0627\u062a\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0633\u0637\u062d \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f \u0639\u0628\u0627\u0631\u062a\u0646\u062f \u0627\u0632:<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config-crypto-map)# set peer { ip-address | hostname }<\/pre>\n<p><em>ip-address<\/em>: \u0622\u062f\u0631\u0633 IP \u0637\u0631\u0641 \u0645\u0642\u0627\u0628\u0644 \u0628\u0631\u0627\u06cc \u0628\u0631\u0642\u0631\u0627\u0631\u06cc IPsec<\/p>\n<p><em>hostname<\/em>: \u00a0Hostname \u0637\u0631\u0641 \u0645\u0642\u0627\u0628\u0644 \u0628\u0631\u0627\u06cc \u0628\u0631\u0642\u0631\u0627\u0631\u06cc IPsec<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config-crypto-map)# set transform-set  name<\/pre>\n<p><em>name<\/em> :\u0646\u0627\u0645 \u0627\u0646\u062a\u062e\u0627\u0628 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc transform-set \u062f\u0631 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0642\u0628\u0644\u06cc<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config-crypto-map)# match address acl-number<\/pre>\n<p>&nbsp;<\/p>\n<p><strong>2-4-4. \u0646\u0645\u0648\u0646\u0647 \u0627\u06cc \u0627\u0632 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec<\/strong><\/p>\n<p>\u062f\u0631 \u0632\u06cc\u0631 \u0646\u0645\u0648\u0646\u0647 \u0627\u06cc \u0627\u0632 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0633\u0631\u0648\u06cc\u0633 IPSec \u062f\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641 \u0622\u0648\u0631\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full wp-image-142\" src=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-config.png\" alt=\"\" width=\"958\" height=\"132\" srcset=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-config.png 958w, https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-config-300x41.png 300w, https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-config-768x106.png 768w\" sizes=\"(max-width: 958px) 100vw, 958px\" \/><\/p>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0648\u06cc\u00a0 <\/strong><strong>Router-1<\/strong><strong>:<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF1(config)#interface gbeth0\r\nZHARF1(config-if)#ip address 192.168.2.1 255.255.255.0\r\nZHARF1(config)#interface gbeth1\r\nZHARF1(config-if)#ip address 192.192.192.1 255.255.255.0\r\nZHARF1(config)#ip route 10.0.0.0\/24 1.1.1.2\r\nZHARF1(config)#crypto isakmp policy 1\r\nZHARF1(config-isakmp)#authentication pre-share\r\nZHARF1(config-isakmp)#encryption aes\r\nZHARF1(config-isakmp)# hash md5\r\nZHARF1(config-isakmp)# exit\r\nZHARF1(config)#crypto isakmp key test address 192.168.2.2\r\nZHARF1(config)#crypto ipsec transform-set t1 esp-aes esp-md5-hmac\r\nZHARF1(config)#crypto ipsec profile p1\r\nZHARF1(config-ipsec)# set transform-set t1\r\nZHARF1(config-if)# interface tunnel1\r\nZHARF1(config-if)# ip address source 1.1.1.1 destination 1.1.1.2 netmask 255.255.255.0\r\nZHARF1(config-if)# tunnel source 192.168.2.1\r\nZHARF1(config-if)# tunnel destination 192.168.2.2\r\nZHARF1(config-if)#  tunnel protection ipsec profile p1\r\n<\/pre>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0648\u06cc\u00a0 <\/strong><strong>Router-2<\/strong><strong>:<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF2(config)#interface gbeth0\r\nZHARF2(config-if)#ip address 192.168.2.2 255.255.255.0\r\nZHARF2(config)#interface gbeth1\r\nZHARF2(config-if)#ip address 10.0.0.1 255.0.0.0\r\nZHARF2(config)#ip route 192.192.192.0\/24 1.1.1.1\r\nZHARF2(config)#crypto isakmp policy 1\r\nZHARF2(config-isakmp)#authentication pre-share\r\nZHARF2(config-isakmp)# encryption aes\r\nZHARF2(config-isakmp)# hash md5\r\nZHARF2(config-isakmp)# exit\r\nZHARF2(config)#crypto isakmp key test address 192.168.2.1\r\nZHARF2(config)#crypto ipsec transform-set t1 esp-aes esp-md5-hmac\r\nZHARF2(config)#crypto ipsec profile p1\r\nZHARF2(config-ipsec)# set transform-set t1\r\nZHARF2(config-if)# interface tunnel1\r\nZHARF2(config-if)#  ip address source 1.1.1.2 destination 1.1.1.1 netmask 255.255.255.0\r\nZHARF2(config-if)# tunnel source 192.168.2.1\r\nZHARF2(config-if)# tunnel destination 192.168.2.2\r\nZHARF2(config-if)#  tunnel protection ipsec profile p1\r\n<\/pre>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0644\u0627\u0632\u0645 \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0645\u062c\u0627\u0648\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0647\u0627:<\/strong><\/p>\n<p>\u062a\u0646\u0638\u06cc\u0645 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u06cc \u0627\u06cc\u0633\u062a\u0627 (\u062a\u0646\u0638\u06cc\u0645 default gateway) \u0628\u0631 \u0631\u0648\u06cc \u0647\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0645\u062c\u0627\u0648\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628<\/p>\n<p>\u067e\u0633 \u0627\u0632 \u0627\u0639\u0645\u0627\u0644 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0630\u06a9\u0631 \u0634\u062f\u0647 \u0628\u0627\u06cc\u062f \u0622\u062f\u0631\u0633 10.0.0.2 \u0627\u0632 Router-1 \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633 \u0628\u0627\u0634\u062f (Ping \u0628\u0631\u0642\u0631\u0627\u0631 \u0628\u0627\u0634\u062f)<\/p>\n<p>&nbsp;<\/p>\n<p><strong>2-8-5. \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec \u0645\u06cc\u0627\u0646 \u0633\u06cc\u0633\u06a9\u0648 \u0648 \u0698\u0631\u0641<\/strong><\/p>\n<p>\u06cc\u06a9\u06cc \u0627\u0632 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0627\u06cc \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641 \u060c \u062a\u0648\u0627\u0646\u0627\u06cc\u06cc \u0628\u0631\u0642\u0631\u0627\u0631\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u00a0IPsec \u0628\u0627 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0633\u06cc\u0633\u06a9\u0648 \u0645\u06cc \u0628\u0627\u0634\u062f. \u0627\u06cc\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u062d\u0627\u0644\u062a tunnel \u0628\u0631\u0642\u0631\u0627\u0631 \u0634\u0648\u062f \u06a9\u0647 \u062f\u0631 \u0645\u062b\u0627\u0644 \u0632\u06cc\u0631 \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"size-full wp-image-143 aligncenter\" src=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/zharf-cisco.png\" alt=\"\" width=\"340\" height=\"178\" srcset=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/zharf-cisco.png 340w, https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/zharf-cisco-300x157.png 300w\" sizes=\"(max-width: 340px) 100vw, 340px\" \/><\/p>\n<p><strong>\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641:<\/strong><\/p>\n<pre class=\"lang:default decode:true \">ZHARF(config)# interface gbeth 0\r\nZHARF(config-if)# ip address 192.168.1.1\/24\r\nZHARF(config-if)# no shutdown\r\nZHARF(config-if)# exit\r\nZHARF(config)#crypto isakmp policy 1\r\nZHARF(config-isakmp)#authentication pre-share\r\nZHARF(config-isakmp)# encryption aes\r\nZHARF(config-isakmp)# hash md5\r\nZHARF (config-isakmp)# exit\r\nZHARF(config)#crypto isakmp key test address 192.168.1.2\r\nZHARF(config)#crypto ipsec transform-set t1 esp-aes esp-md5-hmac\r\nZHARF(config)#crypto ipsec profile p1\r\nZHARF(config-ipsec)# set transform-set t1\r\nZHARF(config-if)# interface tunnel1\r\nZHARF(config-if)#  ip address source 1.1.1.1 destination 1.1.1.2 netmask 255.255.255.0\r\nZHARF(config-if)# tunnel source 192.168.1.1\r\nZHARF(config-if)# tunnel destination 192.168.1.2\r\nZHARF(config-if)#  tunnel protection ipsec profile p1\r\n<\/pre>\n<p><strong>\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0633\u06cc\u0633\u06a9\u0648 :<\/strong><\/p>\n<pre class=\"lang:default decode:true \">CISCO(config)# Interface gigabitEthernet 0\/0\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)# ip address 192.168.1.2 255.255.255.0\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)# no shutdown\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)# exit\r\nCISCO(config)# crypto isakmp policy 1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-isakmp)#encryption aes\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-isakmp)#hash md5\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-isakmp)#authentication pre-share\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-isakmp)#exit\r\nCISCO(config)# crypto isakmp key test address 192.168.1.1 \r\nCISCO(config)# crypto ipsec transform-set AES_MD5 esp-aes esp-md5-hmac\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(cfg-crypto-trans)#exit\r\nCISCO(config)#crypto ipsec profile prf1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(ipsec-profile)#set transform-set AES_MD5\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(ipsec-profile)#exit\r\nCISCO(config)#interface Tunnel 1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)#ip address 1.1.1.2 255.255.255.0\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)#tunnel source 192.168.1.2\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)#tunnel destination 192.168.1.1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\nCISCO(config-if)#tunnel protection ipsec profile prf1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\n<\/pre>\n<p>\u0628\u0631\u0627\u06cc \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0635\u062d\u062a \u0627\u0631\u062a\u0628\u0627\u0637 IPsec \u0648 \u0627\u0646\u062a\u0642\u0627\u0644 \u0628\u0633\u062a\u0647 \u0647\u0627 \u0628\u0627 \u062a\u06af esp \u00a0\u0645\u0631\u0627\u062d\u0644 \u0632\u06cc\u0631 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u0634\u0648\u062f:<\/p>\n<ul>\n<li>\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 ip protocol-discovery \u0631\u0648\u06cc \u0627\u06cc\u0646\u062a\u0631\u0641\u06cc\u0633 gbeth0 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">ZHARF(config)#interface gbeth0\r\nZHARF(config-if)# ip protocol-discovery\r\n<\/pre>\n<ul>\n<li>\u0628\u0631\u0631\u0633\u06cc \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0628\u0648\u062f\u0646 \u0622\u062f\u0631\u0633 1.1.1 \u0627\u0632 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0633\u06cc\u0633\u06a9\u0648 ( \u062a\u0639\u062f\u0627\u062f 100 \u0628\u0633\u062a\u0647 \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc\u06a9\u0646\u06cc\u0645)<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">CISCO#ping 1.1.1.1 re 100<\/pre>\n<ul>\n<li>\u0627\u0639\u0645\u0627\u0644 \u062f\u0633\u062a\u0648\u0631 <strong>show<\/strong> <strong>ip<\/strong> <strong>protocol<\/strong>&#8211;<strong>discovery<\/strong> \u062f\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0698\u0631\u0641 \u0648 \u0645\u0634\u0627\u0647\u062f\u0647 \u0628\u0633\u062a\u0647 \u0647\u0627\u06cc esp<\/li>\n<\/ul>\n<pre class=\"lang:default decode:true \">ZHARF# show ip protocol-discovery protocol esp<\/pre>\n<p>&nbsp;<\/p>\n<p><strong>3-8-5. \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec \u0645\u06cc\u0627\u0646 \u0633\u06cc\u0633\u06a9\u0648 \u0648 \u0698\u0631\u0641 (site-to-site)<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"size-full wp-image-144 aligncenter\" src=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-cisco.png\" alt=\"\" width=\"703\" height=\"177\" srcset=\"https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-cisco.png 703w, https:\/\/zharfpouyan.net\/docs\/wp-content\/uploads\/2023\/08\/ipsec-cisco-300x76.png 300w\" sizes=\"(max-width: 703px) 100vw, 703px\" \/><\/p>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0631\u0648\u062a\u0631 <\/strong><strong>Zharf1<\/strong><\/p>\n<pre class=\"lang:default decode:true \">Zharf1(config)#interface gbeth 1\r\nZharf1 (config-if)#ip address 192.168.40.1\/24\r\nZharf1 (config-if)#no shutdown\r\nZharf1 (config-if)#exit\r\nZharf1 (config)#interface gbeth 0\r\nZharf1 (config-if)#ip address 192.168.30.1\/24\r\nZharf1 (config-if)#no shutdown\r\nZharf1 (config-if)#exit\r\nZharf1 (config)# router ospf \r\nZharf1 (config-router)# network 192.168.40.0 255.255.255.0 area 0\r\nZharf1 (config-router)# network 192.168.30.0 255.255.255.0 area 0\r\n<\/pre>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0631\u0648\u062a\u0631 <\/strong><strong>Zharf2<\/strong><\/p>\n<pre class=\"lang:default decode:true \">Zharf2(config)# crypto isakmp policy 1\r\nZharf2 (config-isakmp)# authentication pre-share\r\nZharf2 (config-isakmp)# encryption aes\r\nZharf2 (config-isakmp)# hash md5\r\nZharf2 (config-isakmp)# exit\r\nZharf2 (config)# crypto isakmp key test address 192.168.40.2\r\nZharf2 (config)# crypto ipsec transform-set t1 esp-aes esp-md5-hmac\r\nZharf2 (config)# crypto map test 10 ipsec-isakmp\r\nZharf2 (config-crypto-map)# set transform-set t1\r\nZharf2 (config-crypto-map)# set peer 192.168.40.2\r\nZharf2 (config-crypto-map)# match address 110\r\nZharf2 (config-crypto-map)# exit\r\nZharf2 (config)# interface gbeth 2\r\nZharf2 (config-if)# ip address 192.168.20.2\/24\r\nZharf2 (config-if)# no shutdown\r\nZharf2 (config)# interface gbeth 0\r\nZharf2 (config-if)# ip address 192.168.30.2\/24\r\nZharf2 (config-if)# no shutdown\r\nZharf2 (config-if)# crypto map test\r\nZharf2 (config)# access-list 110 permit ip host 192.168.20.1 host 192.168.10.1\r\nZharf2 (config)# router ospf    \r\nZharf2 (config-router)# network 192.168.20.0 255.255.255.0 area 0\r\nZharf2 (config-router)# network 192.168.30.0 255.255.255.0 area 0\r\n<\/pre>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0633\u06cc\u0633\u06a9\u0648<\/strong><\/p>\n<pre class=\"lang:default decode:true \">cisco(config)# crypto isakmp policy 1\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-isakmp)# encryption aes\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-isakmp)# hash md5\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-isakmp)# authentication pre-share\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-isakmp)# exit\r\ncisco (config)#  crypto isakmp key test address 192.168.30.2\r\ncisco (config)# crypto ipsec transform-set AES_MD5 esp-aes esp-md5-hmac\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config)# crypto map test 10 ipsec-isakmp\r\ncisco (config-crypto-map)#set transform-set AES_MD5\r\ncisco (config-crypto-map)#set peer 192.168.30.2\r\ncisco (config-crypto-map)#match address 110\r\ncisco (config-crypto-map)#exit\r\ncisco (config)# interface gigabitEthernet 0\/1\r\ncisco (config-if)# ip address 192.168.40.2 255.255.255.0\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-if)# no shutdown\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-if)# crypto map test\r\ncisco (config-if)#exit\r\ncisco (config)# interface gigabitEthernet 0\/2\r\ncisco (config-if)# ip address 192.168.10.2 255.255.255.0\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-if)# no shutdown\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\u202c\r\ncisco (config-if)# exit\r\ncisco (config)# access-list 110 permit ip host 192.168.10.1 host 192.168.20.1\r\ncisco (config)# router ospf 1   \r\ncisco (config-router)# network 192.168.40.0 0.0.0.255 area 0\r\ncisco (config-router)# network 192.168.10.0 0.0.0.255 area 0\r\n<\/pre>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0644\u0627\u0632\u0645 \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0645\u062c\u0627\u0648\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0647\u0627:<\/strong><\/p>\n<p>\u062a\u0646\u0638\u06cc\u0645 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628\u06cc \u0627\u06cc\u0633\u062a\u0627 (\u062a\u0646\u0638\u06cc\u0645 default gateway) \u0628\u0631 \u0631\u0648\u06cc \u0647\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0645\u062c\u0627\u0648\u0631 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628<\/p>\n<p>\u067e\u0633 \u0627\u0632 \u0627\u0639\u0645\u0627\u0644 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0630\u06a9\u0631 \u0634\u062f\u0647 \u0628\u0627\u06cc\u062f \u0622\u062f\u0631\u0633 1.1.1.2 \u0627\u0632 pc(192.168.20.1) \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633 \u0628\u0627\u0634\u062f.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>5-8-4. \u0633\u0631\u0648\u06cc\u0633 DPD<\/strong><\/p>\n<p>IPsec \u00a0\u062f\u0627\u0631\u0627\u06cc \u0646\u0648\u0639\u06cc \u067e\u06cc\u0627\u0645 \u0647\u0627\u06cc \u062f\u0648\u0631\u0647 \u0627\u06cc Keep Alive \u0628\u0647 \u00a0\u0646\u0627\u0645 DPD \u06cc\u0627 Dead Peer Detection \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0622\u0646 \u0628\u0631\u0627\u06cc \u0645\u0637\u0644\u0639 \u0634\u062f\u0646 \u0627\u0632 \u0648\u0636\u0639\u06cc\u062a \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0647\u0627\u06cc \u0647\u0645\u0633\u0627\u06cc\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u06a9\u0646\u062f<\/p>\n<p><strong>\u062d\u0627\u0644\u062a \u0647\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u067e\u06cc\u0627\u0645 \u0647\u0627\u06cc <\/strong><strong>DPD<\/strong><strong>:<\/strong><\/p>\n<p>\u067e\u06cc\u0627\u0645 \u0647\u0627\u06cc DPD\u00a0 \u0628\u0647 \u062f\u0648 \u0635\u0648\u0631\u062a \u0642\u0627\u0628\u0644 \u0627\u0631\u0633\u0627\u0644 \u0647\u0633\u062a\u0646\u062f .<\/p>\n<ul>\n<li><strong>Periodic<\/strong> : \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0628\u0647 \u0635\u0648\u0631\u062a \u0645\u0646\u0638\u0645 \u062f\u0631 \u0641\u0648\u0627\u0635\u0644 \u0632\u0645\u0627\u0646\u06cc \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u062a\u0627\u06cc\u0645\u0631\u060c \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 DPD \u0645\u06cc\u06a9\u0646\u062f \u06a9\u0647 \u0645\u0632\u06cc\u062a \u0627\u06cc\u0646 \u0631\u0648\u0634 \u06a9\u0634\u0641 \u0632\u0648\u062f\u0647\u0646\u06af\u0627\u0645 peer \u0627\u0632 \u062f\u0633\u062a\u0631\u0633 \u062e\u0627\u0631\u062c \u0634\u062f\u0647 \u0627\u0633\u062a<\/li>\n<li><strong>On-demand<\/strong><strong>:<\/strong> \u0627\u0631\u0633\u0627\u0644 \u0622\u067e\u062f\u06cc\u062a \u0647\u0627\u06cc DPD \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0645\u0646\u0648\u0637 \u0628\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0645\u0648\u062c\u0648\u062f \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0627\u0633\u062a \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u062a\u0642\u0627\u0636\u0627\u06cc\u06cc \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u062f\u060c \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 DPD \u00a0\u0645\u06cc\u0646\u0645\u0627\u06cc\u062f \u0648 \u0642\u0628\u0644 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0631\u0627 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f \u0628\u0627\u06cc\u062f \u0627\u0632 \u0635\u062d\u062a \u0645\u0648\u062c\u0648\u062f \u0628\u0648\u062f\u0646 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0645\u0642\u0635\u062f \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0635\u0644 \u06a9\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f DPD Hello \u00a0\u0647\u0645 \u0627\u0631\u0633\u0627\u0644 \u0646\u0645\u06cc\u0634\u0648\u062f<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>\u062a\u0646\u0638\u06cc\u0645 \u0633\u0631\u0648\u06cc\u0633 <\/strong><strong>DPD <\/strong><strong>:<\/strong><\/p>\n<p>\u0628\u0627 \u0627\u0639\u0645\u0627\u0644 \u062f\u0633\u062a\u0648\u0631 \u0627\u0648\u0644 \u062f\u0631 \u0633\u0637\u062d \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0627\u0633\u0631\u06cc \u0627\u06cc\u0646 \u0633\u0631\u0648\u06cc\u0633 \u0641\u0639\u0627\u0644 \u0645\u06cc\u06af\u0631\u062f\u062f \u0648 \u0628\u0627 \u0627\u0639\u0645\u0627\u0644 \u062f\u0633\u062a\u0648\u0631 \u062f\u0648\u0645 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0645\u06cc\u06af\u0631\u062f\u062f<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config)# crypto isakmp keepalive &lt;10-3600&gt; [ &lt;2-60&gt; | on-demand | periodic ]\r\nZharf(config)# no crypto isakmp keepalive\r\n<\/pre>\n<p>\u0627\u0646\u062a\u062e\u0627\u0628 \u0639\u062f\u062f\u06cc \u062f\u0631 \u0628\u0627\u0632\u0647 10 \u062a\u0627 3600 \u062b\u0627\u0646\u06cc\u0647 \u062c\u0647\u062a \u062a\u0639\u06cc\u06cc\u0646 \u0641\u0648\u0627\u0635\u0644 \u0632\u0645\u0627\u0646\u06cc \u0628\u06cc\u0646 \u0627\u0631\u0633\u0627\u0644 \u0628\u0633\u062a\u0647 \u0647\u0627\u06cc KeepAlive \u00a0\u0627\u0633\u062a<\/p>\n<p>\u0627\u0646\u062a\u062e\u0627\u0628 \u0639\u062f\u062f\u06cc \u062f\u0631 \u0628\u0627\u0632\u0647 2 \u062a\u0627 60 \u062b\u0627\u0646\u06cc\u0647 \u062c\u0647\u062a \u062a\u0639\u06cc\u06cc\u0646 \u0632\u0645\u0627\u0646\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0633\u062a\u0647 \u0647\u0627\u06cc KeepAlive \u00a0\u0628\u0647 \u0645\u0642\u0635\u062f \u0646\u0631\u0633\u06cc\u062f\u0647 \u0627\u0646\u062f\u0647 \u0648 \u0628\u0627\u06cc\u062f \u0645\u062c\u062f\u062f\u0627 \u0627\u0631\u0633\u0627\u0644 \u0634\u0648\u0646\u062f.<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p>\u0645\u062b\u0627\u0644 :<\/p>\n<p>\u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u062a\u0646\u0638\u06cc\u0645 DPD \u062f\u0631 \u062d\u0627\u0644\u062a On-Demand \u00a0\u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 \u0628\u0633\u062a\u0647 DPD \u0628\u0627\u0634\u062f \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u062f\u0631 \u0647\u0631 10 \u062b\u0627\u0646\u06cc\u0647 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 \u0622\u0646 \u0645\u06cc\u06a9\u0646\u062f\u00a0 (\u0628\u0631\u0627\u06cc \u063a\u06cc\u0631\u0641\u0639\u0627\u0644\u0633\u0627\u0632\u06cc \u0627\u0632 \u062f\u0633\u062a\u0648\u0631 \u062f\u0648\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u0634\u0648\u062f)<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config)# crypto isakmp keepalive 10 on-demand\r\nZharf(config)# no crypto isakmp keepalive 10  on-demand\r\n<\/pre>\n<p>\u0645\u062b\u0627\u0644 :<\/p>\n<p>\u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u062a\u0646\u0638\u06cc\u0645 DPD \u062f\u0631 \u062d\u0627\u0644\u062a Periodic \u00a0\u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0645\u0627\u062f\u0627\u0645\u06cc \u06a9\u0647 \u0627\u0631\u062a\u0628\u0627\u0637 IPSec \u00a0\u0628\u06cc\u0646 \u062f\u0648 \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u0628\u0631\u0642\u0631\u0627\u0631 \u0627\u0633\u062a\u060c \u0645\u0633\u06cc\u0631\u06cc\u0627\u0628 \u062f\u0631 \u0647\u0631 10 \u062b\u0627\u0646\u06cc\u0647 \u0627\u0642\u062f\u0627\u0645 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 \u0628\u0633\u062a\u0647 \u0647\u0627\u06cc DPD \u00a0\u0645\u06cc\u06a9\u0646\u062f (\u0628\u0631\u0627\u06cc \u063a\u06cc\u0631\u0641\u0639\u0627\u0644\u0633\u0627\u0632\u06cc \u0627\u0632 \u062f\u0633\u062a\u0648\u0631 \u062f\u0648\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u0634\u0648\u062f)<\/p>\n<pre class=\"lang:default decode:true \">Zharf(config)# crypto isakmp keepalive 10 Periodic\r\nZharf(config)# no crypto isakmp keepalive 10 Periodic\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>IPsec \u06a9\u0647 \u0645\u062e\u0641\u0641 \u0639\u0628\u0627\u0631\u062a Internet Protocol Security \u0627\u0633\u062a\u060c \u06cc\u06a9 \u0645\u062c\u0645\u0648\u0639\u0647 \u067e\u0631\u0648\u062a\u06a9\u0644 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0645\u0646 \u06a9\u0631\u062f\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u067e\u0631\u0648\u062a\u06a9\u0644 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a (IP) \u0645\u06cc\u200c\u0628\u0627\u0634\u062f \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0645\u0646\u0638\u0648\u0631 \u0627\u0632 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0628\u0633\u062a\u0647\u200c\u0647\u0627\u06ccIP \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06cc\u06a9 \u0646\u0634\u0633\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0633\u0631\u0648\u06cc\u0633 \u0634\u0627\u0645\u0644 \u062a\u0639\u062f\u0627\u062f\u06cc \u067e\u0631\u0648\u062a\u06a9\u0644 \u0628\u0631\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0648 \u0637\u0631\u0641\u0647 \u0628\u06cc\u0646 \u0633\u06cc\u0633\u062a\u0645\u200c \u0647\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0634\u0631\u0648\u0639 \u0627\u0631\u062a\u0628\u0627\u0637\u060c \u0648 \u0627\u0646\u062a\u0642\u0627\u0644 &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/zharfpouyan.net\/docs\/ipsec-config\/\"> <span class=\"screen-reader-text\">8-5. \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0633\u0631\u0648\u06cc\u0633 IPSec<\/span> \u0627\u062f\u0627\u0645\u0647 \u00bb<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-166","post","type-post","status-publish","format-standard","hentry","category-2"],"_links":{"self":[{"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/posts\/166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/comments?post=166"}],"version-history":[{"count":1,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/posts\/166\/revisions"}],"predecessor-version":[{"id":173,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/posts\/166\/revisions\/173"}],"wp:attachment":[{"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/media?parent=166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/categories?post=166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zharfpouyan.net\/docs\/wp-json\/wp\/v2\/tags?post=166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}