IPSec NAT穿越原理_ipsec配置为什么要配置nat

2401_84254530

于 2024-06-24 19:20:32 发布

阅读量401

点赞数 3

文章标签：服务器网络运维

本文链接：https://blog.csdn.net/2401_84254530/article/details/139935856

版权

[FW1]firewall zone trust
[FW1-zone-trust]add interface g1/0/1
[FW1-zone-trust]quit
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface g1/0/0
[FW1-zone-untrust]quit

[FW1]acl number 3000
[FW1-acl-adv-3000]rule 5 permit ip source 192.168.0.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

[FW1]ike proposal 10

[FW1]ipsec proposal pro1
[FW1-ipsec-proposal-pro1]transform esp
[FW1-ipsec-proposal-pro1]quit

[FW1]ike peer fenzhi
[FW1-ike-peer-fenzhi]undo version 2
[FW1-ike-peer-fenzhi]pre-shared-key test
Info: The password you entered does not meet the minimum complexity requirement.
The password is suggested to contain at least three types of characters from the
 following four groups: Uppercase letters <A-Z>; Lowercase letters <a-z>; Numera
ls <0-9>; Symbols (all characters not defined as letters or numerals), such as !
,$,#, and %.
[FW1-ike-peer-fenzhi]ike-proposal 10
[FW1-ike-peer-fenzhi]nat traversal 
[FW1-ike-peer-fenzhi]remote-address 2.2.2.10
[FW1-ike-peer-fenzhi]remote-address authentication-address 172.16.0.2

[FW1]ipsec policy policy1 1 isakmp
Info: The ISAKMP policy sequence number should be smaller than the template poli
cy sequence number in the policy group. Otherwise, the ISAKMP policy does not ta
ke effect.
[FW1-ipsec-policy-isakmp-policy1-1]security acl 3000
[FW1-ipsec-policy-isakmp-policy1-1]proposal pro1
[FW1-ipsec-policy-isakmp-policy1-1]ike-peer fenzhi
[FW1-ipsec-policy-isakmp-policy1-1]quit
[FW1]interface g1/0/0
[FW1-GigabitEthernet1/0/0]ipsec policy policy1

[FW1]ip route-static 0.0.0.0 0 1.1.1.2

[FW2]acl number 3000
[FW2-acl-adv-3000]rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255

[FW2-acl-adv-3000]quit
[FW2]ike proposal 10
[FW2-ike-proposal-10]display this
2024-03-10 11:17:22.240 
#
ike proposal 10
 encryption-algorithm aes-256
 dh group14
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
return
[FW2-ike-proposal-10]quit

[FW2]ipsec proposal pro1
[FW2-ipsec-proposal-pro1]transform esp
[FW2-ipsec-proposal-pro1]quit

[FW2]ike peer zongbu
[FW2-ike-peer-zongbu]undo version 2
[FW2-ike-peer-zongbu]pre-shared-key test
Info: The password you entered does not meet the minimum complexity requirement.
The password is suggested to contain at least three types of characters from the
 following four groups: Uppercase letters <A-Z>; Lowercase letters <a-z>; Numera
ls <0-9>; Symbols (all characters not defined as letters or numerals), such as !
,$,#, and %.
[FW2-ike-peer-zongbu]ike-proposal 10
[FW2-ike-peer-zongbu]remote-address 1.1.1.1
[FW2-ike-peer-zongbu]nat traversal
[FW2-ike-peer-zongbu]quit

[FW2]ipsec policy policy1 1 isakmp
Info: The ISAKMP policy sequence number should be smaller than the template poli
cy sequence number in the policy group. Otherwise, the ISAKMP policy does not ta
ke effect.
[FW2-ipsec-policy-isakmp-policy1-1]security acl 3000
[FW2-ipsec-policy-isakmp-policy1-1]proposal pro1
[FW2-ipsec-policy-isakmp-policy1-1]ike-peer zongbu
[FW2-ipsec-policy-isakmp-policy1-1]quit

[FW2]interface g1/0/0
[FW2-GigabitEthernet1/0/0]ipsec policy policy1
[FW2-GigabitEthernet1/0/0]quit

[FW2]ip route-static 0.0.0.0 0 172.16.0.1

[FW1-policy-security]display this
2024-03-10 12:55:27.460 
#
security-policy
 rule name untr_to_local
  source-zone untrust
  destination-zone local
  source-address 2.2.2.0 mask 255.255.255.0
  destination-address 1.1.1.0 mask 255.255.255.0
  action permit
 rule name untr_to_tr
  source-zone untrust
  destination-zone trust
  source-address 172.16.1.0 mask 255.255.255.0
  destination-address 192.168.0.0 mask 255.255.255.0
  action permit
#
return

[FW2]security-policy
[FW2-policy-security]display this
2024-03-10 12:03:26.930 
#
security-policy
 rule name tr_to_untr
  source-zone trust
  destination-zone untrust
  source-address 172.16.1.0 mask 255.255.255.0
  destination-address 192.168.0.0 mask 255.255.255.0
  action permit
 rule name untr_to_local
  source-zone untrust
  destination-zone local
  source-address 1.1.1.0 mask 255.255.255.0
  destination-address 172.16.0.0 mask 255.255.255.0
  action permit
 rule name local_to_untr
  source-zone local
  destination-zone untrust
  source-address 172.16.0.0 mask 255.255.255.0
  destination-address 1.1.1.0 mask 255.255.255.0
  action permit
#
return

[NAT]acl 2001
[NAT-acl-basic-2001]rule permit source 172.16.1.0 0.0.0.255
[NAT-acl-basic-2001]rule permit source 172.16.0.0 0.0.0.255
[NAT-acl-basic-2001]quit
[NAT]nat address-group 1 2.2.2.10 2.2.2.10
[NAT]interface g0/0/2
[NAT-GigabitEthernet0/0/2]nat outbound 2001 address-group 1

测试并抓包分析（防火墙G1/0/0抓包，此处源IP地址还未转换）。