image

 

1 beijing 配置

f1

ike local-name f1

firewall packet-filter enable 开启包过滤的功能

firewall packet-filter default permit 默认的为允许

 

 

ike peer peer1 指定peer的 对等体

exchange-mode aggressive 配置ipsec 为野蛮模式

pre-shared-key 123456 配置预共享的密钥

id-type name 配置为名字的方式

remote-name f2

 

ike peer peer2指定peer的 对等体

exchange-mode aggressive配置ipsec 为野蛮模式

pre-shared-key 654321 配置预共享的密

id-type name配置为名字的方式

remote-name f3

 

ipsec proposal tran1 安全提议tran1

 

ipsec proposal tran2 安全提议tran2

 

ipsec policy policy1 10 isakmp 安全策略

security acl 3000 引用acl规则

ike-peer peer1 指定ike的对等体

proposal tran1引用协商

 

ipsec policy policy1 20 isakmp安全策略

security acl 3001引用acl规则

ike-peer peer2指定ike的对等体

proposal tran2引用协商

 

acl number 3000

rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

rule 1 deny ip source any dest any

acl number 3001

rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

rule 1 deny ip source  any dest any

 

interface Ethernet0/0

ip address 192.168.1.254 255.255.255.0

#

interface Ethernet0/3

ip address 202.196.10.100 255.255.255.0

ipsec policy policy1 在接口上应用相应的规则

firewall zone trust

add interface Ethernet0/0

add interface Ethernet0/3

add interface Ethernet0/4

set priority 85

ip route-static 0.0.0.0 0.0.0.0 202.196.10.1 preference 60 默认的路由

[F1]dis ipsec proposal 查看安全提议

IPsec proposal name: tran2

encapsulation mode: tunnel

transform: esp-new

ESP protocol: authentication md5-hmac-96, encryption des

IPsec proposal name: tran1

encapsulation mode: tunnel

transform: esp-new

ESP protocol: authentication md5-hmac-96, encryption des

[F1]dis ipsec tunnel 查看隧道的信息

 

 

上海的配置

 

f2

 

ike local-name f2

 

firewall packet-filter enable

firewall packet-filter default permit

 

ike peer peer1

exchange-mode aggressive

pre-shared-key 123456

id-type name

remote-name f1

remote-address 202.196.10.100 需要指定远程的ip地址

 

ipsec proposal tran1

 

ipsec policy policy1 10 isakmp

security acl 3000

ike-peer peer1

proposal tran1

 

acl number 3000

rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

rule 1 deny ip source any destination any

 

interface Ethernet0/0

ip address 192.168.2.254 255.255.255.0

 

interface Ethernet0/3

ip address dhcp-alloc

ipsec policy policy1

 

firewall zone trust

add interface Ethernet0/0

add interface Ethernet0/3

add interface Ethernet0/4

set priority 85

ip route-static 0.0.0.0 0.0.0.0 202.196.20.1 preference 60

 

 

zhengzhou的配置

f3

ike local-name f3

 

firewall packet-filter enable

firewall packet-filter default permit

 

ike peer peer2

exchange-mode aggressive

pre-shared-key 654321

id-type name

remote-name f1

remote-address 202.196.10.100 需要指定远端的ip地址

 

ipsec proposal tran2

 

ipsec policy policy1 20 isakmp

security acl 3001

ike-peer peer2

proposal tran2

 

acl number 3001

rule 0 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

rule 1 deny ip source any dest any

interface Ethernet0/0

ip address 192.168.3.254 255.255.255.0

 

interface Ethernet0/3

ip address dhcp-alloc

ipsec policy policy1

 

firewall zone trust

add interface Ethernet0/0

add interface Ethernet0/3

add interface Ethernet0/4

set priority 85

 

ip route-static 0.0.0.0 0.0.0.0 202.196.30.1 preference 60

 

sw  3层SW的配置

 

dhcp server ip-pool shanghai

network 202.196.20.0 mask 255.255.255.0

 

dhcp server ip-pool zhengzhou

network 202.196.30.0 mask 255.255.255.0

 

vlan 1

vlan 10

vlan 20

vlan 30

 

interface Vlan-interface1

ip address 192.168.100.33 255.255.255.0

 

interface Vlan-interface10

ip address 202.196.10.1 255.255.255.0

 

interface Vlan-interface20

ip address 202.196.20.1 255.255.255.

 

interface Vlan-interface30

ip address 202.196.30.1 255.255.255.0

interface Ethernet0/6

port access vlan 10

interface Ethernet0/12

port access vlan 20

 

interface Ethernet0/18

port access vlan 30

 

dhcp server forbidden-ip 202.196.20.1

dhcp server forbidden-ip 202.196.30.1

 

dis dhcp server ip-in-use all 查看dhcp服务器的状态

 

Global pool:

IP address Hardware address Lease expiration Type

202.196.20.2 3ce5-a67f-374b Mar 29 2012 18:31:43 PM Auto:COMMITTED

202.196.30.2 3ce5-a6ce-1895 Mar 29 2012 19:52:32 PM Auto:COMMI

 

测试：

北京到上海分公司

wps_clip_image-5239

北京到郑州分公司

wps_clip_image-2432