华为ensp IPsec -VPN 配置---静态手工密钥配置

1、R1/R2/R3的IP地址配置

[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[AR1-GigabitEthernet0/0/0]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip add 12.1.1.1 24

[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]ip add 12.1.1.2 24
[AR2-GigabitEthernet0/0/0]int g0/0/1
[AR2-GigabitEthernet0/0/1]ip add 23.1.1.2 24

[AR3]int g0/0/0
[AR3-GigabitEthernet0/0/0]ip add 23.1.1.1 24
[AR3-GigabitEthernet0/0/0]int g0/0/1
[AR3-GigabitEthernet0/0/1]ip add 192.168.2.1 24

2、在R1/R2/R3上置OSPF

[AR1]ospf 
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]net 12.1.1.0 0.0.0.255

[AR2]ospf 
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]net 12.1.1.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]net 23.1.1.0 0.0.0.255

[AR3]ospf
[AR3-ospf-1]area 0
[AR3-ospf-1-area-0.0.0.0]net 23.1.1.0 0.0.0.255

1、创建ACL感兴趣流

[AR1]acl 3000
[AR1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
[AR3]acl 3000
[AR3-acl-adv-3000]rule permit ip source 192.168.2.0 0.0.0.255 destination 192.16
8.1.0 0.0.0.255

2、创建安全提议

[AR1]ipsec proposal sp1
[AR3]ipsec proposal sp1

封装模式

[AR1-ipsec-proposal-sp1]encapsulation-mode tunnel
[AR3-ipsec-proposal-sp1]encapsulation-mode tunnel

封装协议

[AR1-ipsec-proposal-sp1]transform ah
[AR3-ipsec-proposal-sp1]transform ah

验证算法

[AR1-ipsec-proposal-sp1]ah authentication-algorithm sha1
[AR3-ipsec-proposal-sp1]ah authentication-algorithm sha1

3、创建安全策略

[AR1]ipsec policy celu 10 manual 
[AR3]ipsec policy celu 10 manual 

调用感兴趣流

[AR1-ipsec-policy-manual-celu-10]security acl 3000
[AR3-ipsec-policy-manual-celu-10]security acl 3000

调用安全提议

[AR1-ipsec-policy-manual-celu-10]proposal sp1
[AR3-ipsec-policy-manual-celu-10]proposal sp1

 

在策略中定义隧道源IP和目标IP

[AR1-ipsec-policy-manual-celu-10]tunnel remote 23.1.1.1
[AR1-ipsec-policy-manual-celu-10]tunnel local 12.1.1.1
[AR3-ipsec-policy-manual-celu-10]tunnel remote 12.1.1.1
[AR3-ipsec-policy-manual-celu-10]tunnel local 23.1.1.1

定义安全联盟SPI

[AR1-ipsec-policy-manual-celu-10]sa spi outbound ah 123456
[AR1-ipsec-policy-manual-celu-10]sa spi inbound ah 654321
[AR3-ipsec-policy-manual-celu-10]sa spi outbound ah 654321
[AR3-ipsec-policy-manual-celu-10]sa spi inbound ah 123456

定义AH验证钥匙

[AR1-ipsec-policy-manual-celu-10]sa string-key outbound ah simple hw54321
[AR1-ipsec-policy-manual-celu-10]sa string-key inbound ah simple hw12345
[AR3-ipsec-policy-manual-celu-10]sa string-key outbound ah simple hw12345
[AR3-ipsec-policy-manual-celu-10]sa string-key inbound ah simple hw54321

4、在出接口调用策略

[AR1-GigabitEthernet0/0/1]ipsec policy celu
[AR3-GigabitEthernet0/0/0]ipsec policy celu

5、设置隧道静态理由条目

[AR1]ip route-static 192.168.2.0 255.255.255.0 23.1.1.1
[AR3]ip route-static 192.168.1.0 255.255.255.0 12.1.1.1

验证

查询

[AR1]dis ipsec proposal name sp1