ENSP配置IPSEC 实验

拓扑

首先基础网络做通

配置

总部：

[zongbu]acl number 3000 //创建ACl，用作感兴趣流

[zongbu-acl-adv-3000]rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 //配置允许192.168.1.0 网段访问192.168.2.0网段

[zongbu]ipsec proposal huawei //新建安全提议，名字为huawei

[zongbu-ipsec-proposal-huawei]esp authentication-algorithm sha1 //设置加密方式sha1，默认MD5

[zongbu]ipsec policy huawei 10 manual //配置ipsec策略，策略名为huawei，编号为10，模式为手动配置模式

[zongbu-ipsec-policy-manual-huawei-10]security acl 3000 //匹配感兴趣流，就是让这个数据（192.168.1.0访问192.168.2.0的数据）走VPN

[zongbu-ipsec-policy-manual-huawei-10]proposal huawei //引用名为huawei的提议

[zongbu-ipsec-policy-manual-huawei-10]tunnel local 192.168.12.1 //本地隧道地址

[zongbu-ipsec-policy-manual-huawei-10]tunnel remote 192.168.23.3 //对端隧道地址

[zongbu-ipsec-policy-manual-huawei-10]sa spi inbound esp 54321 //安全联盟入方向，SPI为54321，本端入方向SPI必须和对端出方向SPI一致

[zongbu-ipsec-policy-manual-huawei-10]sa string-key inbound esp cipher huawei //安全联盟密钥，入方向为加密的huawei，本端入方向密钥必须和对端出方向密钥一致

[zongbu-ipsec-policy-manual-huawei-10]sa spi outbound esp 12345 //安全联盟出方向，SPI为12345，本端出方向SPI必须和对端入方向SPI一致

[zongbu-ipsec-policy-manual-huawei-10]sa string-key outbound esp cipher huawei123//安全联盟密钥，出方向为加密的huawei，本端入方向密钥必须和对端出方向密钥一致

[huawei]interface GigabitEthernet0/0/0 //进入端口0/0/0

[zongbu-GigabitEthernet0/0/0]ipsec policy huawei //在端口上应用

分支：

[fenzhi]acl number 3000

[fenzhi-acl-adv-3000]rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

[fenzhi]ipsec proposal huawei

[fenzhi-ipsec-proposal-huawei]esp authentication-algorithm sha1

[fenzhi]ipsec policy huawei 10 manual

[fenzhi-ipsec-policy-manual-huawei-10]security acl 3000

[fenzhi-ipsec-policy-manual-huawei-10]proposal huawei

[fenzhi-ipsec-policy-manual-huawei-10]tunnel local 192.168.23.3

[fenzhi-ipsec-policy-manual-huawei-10]tunnel remote 192.168.12.1

[fenzhi-ipsec-policy-manual-huawei-10]sa spi inbound esp 12345

[fenzhi-ipsec-policy-manual-huawei-10]sa string-key inbound esp cipher huawei123

[fenzhi-ipsec-policy-manual-huawei-10]sa spi outbound esp 54321

[fenzhi-ipsec-policy-manual-huawei-10]sa string-key outbound esp cipher huawei

[fenzhi]interface GigabitEthernet0/0/1

[fenzhi-GigabitEthernet0/0/0]ipsec policy huawei

最终效果：PC1ping通PC2