IPsec自动方式

DC_BLOG

于 2024-10-03 19:14:56 发布

阅读量89

点赞数 2

分类专栏：路由与交换文章标签：服务器运维 ip 网络

本文链接：https://blog.csdn.net/Jerry_BLOG/article/details/142694793

版权

路由与交换专栏收录该内容

35 篇文章 1 订阅

订阅专栏

文章目录

实验要求
实验配置

在这里插入图片描述

实验要求

配置 IPsec VPN 采用自动方式
同时要满足上网和VPN两种需求
使用NAT进行地址映射
认证方法和加密算法自行配置采用安全的方法

实验配置

R1：

#基本配置
sy
sy R1
dhcp enable
acl 3001
rule 1 deny ip des 192.168.3.0 0.0.0.255
rule 2 permit ip
inter g0/0/0
ip ad 192.168.1.254 24
dhcp select inter
inter g0/0/1
nat outbound 3001
ip ad 12.1.1.1 24

ip route-s 0.0.0.0 0 12.1.1.2

#VPN配置
sy
acl 3000
rule 1 permit ip source 192.168.1.0 0.0.0.255 des 192.168.3.0 0.0.0.255

ipsec proposal To-shanghai
esp auth sha2-256
esp encry aes-256

ike proposal 1
authentication-algorithm md5
encry aes-cbc-256
dh group2

ike peer shanghai v1
exchange-mode main
pre-shared-key cipher huawei
ike-proposal 1
local-address 12.1.1.1
remote-address 23.1.1.3

ipsec policy beijing-VPN 1 isakmp
security acl 3000
proposal To-shanghai
ike-peer shanghai

inter g0/0/1
ipsec policy beijing-VPN

R2：

sy
sy ISP
inter g0/0/0
ip ad 12.1.1.2 24
inter g0/0/1
ip ad 23.1.1.2 24
inter loop 0
ip add 2.2.2.2 32
q

R3：

#基本配置
sy
sy R3
dhcp enable
acl 3001
rule 1 deny ip des 192.168.1.0 0.0.0.255
rule 2 permit ip
inter g0/0/0
ip ad 192.168.3.254 24
dhcp select inter
inter g0/0/1
nat outbound 3001
ip ad 23.1.1.3 24

ip route-s 0.0.0.0 0 23.1.1.2

#VPN配置
sy
acl 3000
rule 1 permit ip source 192.168.3.0 0.0.0.255 des 192.168.1.0 0.0.0.255

ipsec proposal To-beijing
esp auth sha2-256
esp encry aes-256

ike proposal 1
authentication-algorithm md5
encry aes-cbc-256
dh group2

ike peer beijing v1
exchange-mode main
pre-shared-key cipher huawei
ike-proposal 1
local-address 23.1.1.3
remote-address 12.1.1.1

ipsec policy shanghai-VPN 1 isakmp
security acl 3000
proposal To-beijing
ike-peer beijing

inter g0/0/1
ipsec policy shanghai-VPN