华为AR路由器策略模板建立ipsec过程

华为AR系列路由器使用策略模板建立ipsec vpn专用线路

display current-configuration
[V200R003C00]

sysname ZB

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load portalpage.zip

drop illegal-mac alarm

set cpu-usage threshold 80 restore 75

acl number 3000
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

rule 10 deny ip

ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128

ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96

ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name FA
remote-address 1.1.1.1

ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % K8m.Nt84DZ}e#<0`8bmE3Uw}% %
local-user admin service-type http

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 192.168.2.1 255.255.255.0

interface GigabitEthernet0/0/1
ip address 2.2.2.1 255.255.255.0
ipsec policy 1

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 2.2.2.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

##上边是总部路由器配置

[FA]display current-configuration
[V200R003C00]

sysname FA

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load portalpage.zip

drop illegal-mac alarm

set cpu-usage threshold 80 restore 75

acl number 3000
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

rule 10 deny ip

ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128

ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96

ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name ZB
remote-address 2.2.2.1

ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % K8m.Nt84DZ}e#<0`8bmE3Uw}% %
local-user admin service-type http

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 1.1.1.1 255.255.255.0
ipsec policy 1

interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 1.1.1.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return
[FA]
[FA]

Please check whether system data has been changed, and save data in time

Configuration console time out, please press any key to log on

dis display cu display current-configuration [V200R003C00] # sysname FA # snmp-agent local-engineid 800007DB03000000000000 snmp-agent # clock timezone China-Standard-Time minus 08:00:00 # portal local-server load portalpage.zip # drop illegal-mac alarm # set cpu-usage threshold 80 restore 75 # acl number 3000 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

rule 10 deny ip

ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128

ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96

ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name ZB
remote-address 2.2.2.1

ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % K8m.Nt84DZ}e#<0`8bmE3Uw}% %
local-user admin service-type http

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 1.1.1.1 255.255.255.0
ipsec policy 1

interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

ip route-static 0.0.0.0 0.0.0.0 1.1.1.2

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return

上边是分支路由器配置

display current-configuration
[V200R003C00]

sysname inter

snmp-agent local-engineid 800007DB03000000000000
snmp-agent

clock timezone China-Standard-Time minus 08:00:00

portal local-server load portalpage.zip

drop illegal-mac alarm

set cpu-usage threshold 80 restore 75

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % K8m.Nt84DZ}e#<0`8bmE3Uw}% %
local-user admin service-type http

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 1.1.1.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 2.2.2.2 255.255.255.0

interface GigabitEthernet0/0/2

interface NULL0

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return


上边上互联网配置