IPsec简单配置

最新推荐文章于 2024-09-04 15:04:22 发布

不爱吃酸菜的酸菜鱼

最新推荐文章于 2024-09-04 15:04:22 发布

阅读量204

点赞数 2

文章标签：网络

本文链接：https://blog.csdn.net/Gahood/article/details/138922648

版权

实验配置

1.配置IP地址

#R1
<Huawei>sys
[Huawei]sys R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 100.1.1.1 24
[R1-GigabitEthernet0/0/0]int g0/0/01
[R1-GigabitEthernet0/0/1]ip add 200.1.1.1 24
[R1-GigabitEthernet0/0/1]int lo0
[R1-LoopBack0]ip add 150.1.1.1 32


#R2
<Huawei>sys
[Huawei]sys R2
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 100.1.1.2 24
[R2]int g0/0/1
[R2-GigabitEthernet0/0/1]ip add 192.168.1.254 24


#R3
<Huawei>sys
[Huawei]sys R3
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ip add 200.1.1.3 24
[R3]int g0/0/1
[R3-GigabitEthernet0/0/1]ip add 172.16.1.254 24

2.配置Easy IP

#R2
[R2]ip route-static 0.0.0.0 0 100.1.1.1
[R2]acl 3000
[R2-acl-adv-3000]rule 5 permit ip source 192.168.1.0 0.0.0.255
[R2-acl-adv-3000]int g0/0/0
[R2-GigabitEthernet0/0/0]nat outbound 3000

#R3
[R3]ip route-static 0.0.0.0 0 200.1.1.1
[R3]acl 3000
[R3-acl-adv-3000]rule 5 permit ip source 172.16.1.0 0.0.0.255
[R3-acl-adv-3000]int g0/0/0
[R3-GigabitEthernet0/0/0]nat outbound 3000

3.测试PC1、PC2与lo0口是否互通

4.手工配置IPsec VPN

#R2
[R2]acl 3001
[R2-acl-adv-3001]rule permit ip source 192.168.1.0 0.0.0.255 destination 172.16.
1.0 0.0.0.255
#创建安全协议
[R2-acl-adv-3001]ipsec proposal qqq                   #创建名为qqq的安全协议
[R2-ipsec-proposal-qqq]encapsulation-mode tunnel      #配置报文封装模式为隧道模式
[R2-ipsec-proposal-qqq]transform esp                  #配置隧道协议为ESP
[R2-ipsec-proposal-qqq]esp authentication-algorithm sha1    #配置认证算法为sha1
[R2-ipsec-proposal-qqq]esp encryption-algorithm des         #配置加密算法为des
#创建安全策略
[R2]ipsec policy P1 10 manual
[R2-ipsec-policy-manual-P1-10]security acl 3000
[R2-ipsec-policy-manual-P1-10]proposal qqq
[R2-ipsec-policy-manual-P1-10]tunnel local 100.1.1.2
[R2-ipsec-policy-manual-P1-10]tunnel remote 200.1.1.2
[R2-ipsec-policy-manual-P1-10]sa	
[R2-ipsec-policy-manual-P1-10]sa spi outbound esp 54321
[R2-ipsec-policy-manual-P1-10]sa spi inbound esp 12345
[R2-ipsec-policy-manual-P1-10]sa string-key outbound esp simple qqq
[R2-ipsec-policy-manual-P1-10]sa string-key inbound esp simple qqq
#应用安全策略
[R2-ipsec-policy-manual-P1-10]int g0/0/0
[R2-GigabitEthernet0/0/0]ipsec policy P1

#R3
[R3]acl 3001
[R3-acl-adv-3001]rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 192.16
8.1.0 0.0.0.255
[R3-acl-adv-3001]ipsec proposal qqq
[R3-ipsec-proposal-qqq]esp authentication-algorithm sha1
[R3-ipsec-proposal-qqq]ipsec policy P1 10 manual
[R3-ipsec-policy-manual-P1-10]security  acl 3001
[R3-ipsec-policy-manual-P1-10]proposal qqq
[R3-ipsec-policy-manual-P1-10]tunnel local 200.1.1.2
[R3-ipsec-policy-manual-P1-10]tunnel remote 100.1.1.2
[R3-ipsec-policy-manual-P1-10]sa spi inbound esp 54321
[R3-ipsec-policy-manual-P1-10]sa spi outbound esp 12345
[R3-ipsec-policy-manual-P1-10]sa string-key outbound esp simple qqq
[R3-ipsec-policy-manual-P1-10]sa string-key inbound esp simple qqq
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ipsec policy P1