GRE VPN

bitbot

已于 2022-06-27 09:08:46 修改

阅读量788

点赞数

分类专栏： Network Security 文章标签：网络服务器运维

于 2022-06-25 07:20:00 首次发布

本文链接：https://blog.csdn.net/azenlijing/article/details/125454849

版权

Network Security 专栏收录该内容

13 篇文章 1 订阅

订阅专栏

L7 VPN SSL
L3 VPN GRE IPSEC
L2 VPN L2TP

GRE: Ethernet IP GRE IPX Payload

ip rout peer-site-subnet tunnel-name
tunnel: IP, Protocol, Source IP, Destination IP

Configuration Tip: IP/Zone->Tunnel->Route->Policy

interface tunnel1
 ip add 192.168.3.3 24
 tunnel-protocol GRE
 source 1.1.1.3
 destination 2.2.2.4
ip route-static 172.16.1.0 24 tunnel1
firewall zone dmz
 add interface tunnel1
security-policy
 rule name 1-2
  source-zone trust
  destination-zone dmz
  source-address 10.1.1.0 mask 255.255.255.0
  destination-address 172.16.1.0 mask 255.255.255.0
  service icmp
  action permit
 rule name 2-1.1
  source-zone untrust
  destination-zone local
  source-address 2.2.2.0 mask 255.255.255.0
  destination-address 1.1.1.0 mask 255.255.255.0
  service gre
  action permit
 rule name 2-1.2
  source-zone dmz
  destination-zone trust
  source-address 172.16.1.0 mask 255.255.255.0
  destination-address 10.1.1.0 mask 255.255.255.0
  service icmp
  action permit

Packet after VPN encapsulation will not match security-policies any more but after decapsulation will walk through security-polices another round.
Analyze sessions to get relevant information before configuring deatiled security policies.

dis firewall session table
dis security-policy rule all

firewall packet-filter basic-protocol enable