华为vpn简单配置

原理图

以 r1为例 r3的配置和r1一样

第一阶段

配置ike sa的安全协议

[r1]ike proposal 1	
[r1-ike-proposal-1]encryption-algorithm aes-cbc-128
[r1-ike-proposal-1]authentication-method pre-share 
[r1-ike-proposal-1]authentication-algorithm md5 
[r1-ike-proposal-1]dh group2
[r1-ike-proposal-1]sa duration 3600
[r1-ike-proposal-1]q

配置ike sa的认证信息

[r1]ike peer aaa v1	
[r1-ike-peer-aaa]exchange-mode main 
[r1-ike-peer-aaa]pre-shared-key cipher 1234
[r1-ike-peer-aaa]ike-proposal 1
[r1-ike-peer-aaa]remote-address 200.1.1.1
[r1-ike-peer-aaa]q

配置感兴趣流

[r1]acl 3000	
[r1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 de	
[r1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

第二阶段

配置ipsec的提议安全参数

[r1]ipsec proposal aaa
[r1-ipsec-proposal-aaa]esp authentication-algorithm sha1	
[r1-ipsec-proposal-aaa]esp encryption-algorithm 3des 	
[r1-ipsec-proposal-aaa]encapsulation-mode tunnel 
[r1-ipsec-proposal-aaa]q

配置安全策略

[r1]ipsec policy aaa 1 isakmp 	
[r1-ipsec-policy-isakmp-aaa-1]security acl 3000
[r1-ipsec-policy-isakmp-aaa-1]ike-peer aaa
[r1-ipsec-policy-isakmp-aaa-1]proposal aaa
[r1-ipsec-policy-isakmp-aaa-1]q

在接口释放安全策略

[r1]int g0/0/1
[r1-GigabitEthernet0/0/1]ipsec policy aaa
[r1-GigabitEthernet0/0/1]

测试