华为IPsec 手动配置实例

R1配置
dhcp en

acl 3001
rule 1 deny ip destination 192.168.20.0 0.0.0.255
rule 2 permit ip

int g0/0/0
ip add 192.168.10.254 24
dhcp sel interface
int g0/0/1
ip add 12.0.0.1 24
nat outbound 3001
ip route-static 0.0.0.0 12.0.0.2

acl 3000
rule 1 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

ipsec proposal toSH
esp Authentication-algorithm sha2-256
esp Encryption-algorithm aes-256

ipsec policy hfvpn 1 manual
security acl 3000
proposal toSH
tunnel local 12.0.0.1
tunnel remote 23.0.0.3
sa spi inbound esp 12345
sa string-key inbound esp cipher wakin
sa spi outbound esp 54321
sa string-key outbound esp cipher wakin

R3配置

dhcp en

acl 3001
rule 1 deny ip destination 192.