华为防火墙点对点IPsec隧道

huaweiFW1

基础配置：

sysname huaweiFW1

interface GigabitEthernet0/0/1
 ip address 192.168.1.10 255.255.255.0
quit
interface GigabitEthernet0/0/0
 ip address 202.100.1.10 255.255.255.0
quit
firewall zone trust
 add interface GigabitEthernet0/0/1
quit
firewall zone untrust
 add interface GigabitEthernet0/0/0
quit

配置区域访问权限：允许trust与untrust，untrust与local互相访问

policy interzone local untrust inbound
 policy 0
  action permit

quit

quit
policy interzone trust untrust inbound
 policy 1
  action permit
quit

quit
policy interzone trust untrust outbound
 policy 1
  action permit

quit

quit

定义要保护的数据

acl number 3000
 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

quit

配置IKE安全提议

<