IPsec Mannul

一、topo

二、配置

AR1：

sys
sys AR1 
dhcp enable

acl 2000
rule permit source 192.168.10.0 0.0.0.255

int g0/0/0
ip ad 192.168.10.254 24
dhcp select int
int g0/0/1
ip ad 12.0.0.1 24
nat outbound 2000



ip route-static 0.0.0.0 0 12.0.0.2


AR1

感兴趣流
acl 3000
rule permit ip so 192.168.10.0 0.0.0.255 dest 192.168.20.0 0.0.0.255 

提议(proposal):
#
ipsec proposal AR1toAR3
 transform esp
 esp authentication-algorithm sha2-256 
 esp encryption-algorithm aes-128

策略（policy）:
#
ipsec policy AR1toAR3 1 manual
 security acl 3000
 proposal AR1toAR3
 tunnel local 12.0.0.1
 tunnel remote 23.0.0.3
 sa spi inbound esp 123456
 sa string-key inbound esp cipher 123456
 sa spi outbound esp 123456
 sa string-key outbound esp cipher 123456

调用：
int g0/0/1
ipsec policy AR1toAR3

 

ISP

sys
sys ISP
int g0/0/0
ip ad 12.0.0.2 24
int g0/0/1
ip ad 23.0.0.2 24
int loopback 0
ip ad 2.2.2.2 32

AR3

sys
sys AR3
dhcp enable

acl 2000
rule permit source 192.168.20.0 0.0.0.255

int g0/0/1
ip ad 192.168.20.254 24
dhcp select int
int g0/0/0
ip ad 23.0.0.3 24
nat outbound 2000



ip route-static 0.0.0.0 0 23.0.0.2

AR3

感兴趣流
acl 3000
rule permit ip so 192.168.20.0 0.0.0.255 dest 192.168.10.0 0.0.0.255 

提议(proposal):
#
ipsec proposal AR3toAR1
 transform esp
 esp authentication-algorithm sha2-256 
 esp encryption-algorithm aes-128

策略（policy）:
#
ipsec policy AR3toAR1 1 manual
 security acl 3000
 proposal AR3toAR1
 tunnel local 23.0.0.3
 tunnel remote 12.0.0.1
 sa spi inbound esp 123456
 sa string-key inbound esp cipher 123456
 sa spi outbound esp 123456
 sa string-key outbound esp cipher 123456

调用：
int g0/0/0
ipsec policy AR3toAR1

 

三、结果

内网并不能互通，问题就在NAT acl和感兴趣流acl上。

四、感兴趣流匹配问题

五、解决方法