基于安全GRE隧道的Site-to-Site VPN构建方案研究与实现

为了实现经由Internet连接的两个私有网络之间能够利用隧道技术以私有IP地址的方式相互访问其内部资源，并且可以在隧道中传递动态路由协议信息，在基于Cisco路由器的配置过程中，通过利用GRE与IPSec两种技术共同构建Site—to—Site VPN，即首先使用GRE协议对用户数据和路由协议报文进行隧道封装。然后通过IPSec提供的数据机密性、数据完整性验证以及数据源认证功能保护在GRE隧道中传送的敏感数据，以实现GRE隧道的安全传输。通过结合GRE可支持承载IP组播流量与IPSec提供的安全特性创建Site-to-Site VPN，既解决动态路由协议在IPSec VPN隧道内正常通告的问题，又可以保护敏感数据穿越不安全通道的安全性。

Research and Implementation of Site-to-Site VPN Construction Scheme Based on Secure GRE Tunnel

In order to realize the two private networks to mutually access to the local resources in private IP address by using tunnel technology of Internet,and transfer the dynamic routing protocol message in tunnel,during the process of Cisco router configuration,GRE and IPSec techniques are used to establish Site-to-Site VPN.Firstly,the GRE protocol is used to encapsulate the user data and the message of router protocol.Secondly,to transmit the sensitive data in GRE tunnel safely under the protection of IPSec,which can guarantee data confidentiality,data integrity verification,and data origin authentication function to realize the safe transmission of data.The Site-to-Site VPN is constructed by GRE,which can support IP multicast traffic and the safety feature of the IPSec.It not only solves the normal notice problems of dynamic routing protocol in IPSec VPN tunnel,but also protects the security of sensitive data through unsafe channels.