一、【组网和实验环境】
 
 

 
 
 
按如上的接口ip先作配置
 本文实验采用的交换机是H3C模拟器，下载地址如下：http://forum.h3c.com/forum.php?
 
mod=viewthread&tid=109740&highlight=H3C%E6%A8%A1%E6%8B%9F%E5%99%A8 有兴趣的朋 友可以在论坛上去下载。
 
二、【实验过程】
 
先查看R2通过PPP协商后是否被分配了IP地址
<R2>dis int s
<R2>dis int Serial 0/6/0
Serial0/6/0 current state: UP  
Line protocol current state: UP
Description: Serial0/6/0 Interface
The Maximum Transmit Unit is 1500, Hold timer is 10(sec) 
Internet Address is negotiated, 20.1.12.2/32
Link layer protocol is PPP 
LCP opened, IPCP opened
Output queue : (Urgent queuing : Size/Length/Discards)  0/50/0
Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0 
Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0
Interface is V35
    41 packets input,  518 bytes
    41 packets output,  514 bytes
 
 
用R2ping对端的Loopback地址，可以通
2>  ping -a 192.168.2.1 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=20 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=20 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=26 ms
 
 
查看ike 和ipsec的sa是否已经建立
<R2>
<R2>
<R2>dis ike sa
    total phase-1 SAs:  1
    connection-id  peer            flag        phase   doi
  ----------------------------------------------------------
        6          20.1.12.1       RD|ST         1     IPSEC 
        7          20.1.12.1       RD|ST         2     IPSEC 
 
  flag meaning
  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
<R2>
<R2>
<R2>
<R2>dis ipsec sa
===============================
Interface: Serial0/6/0
    path MTU: 1500
===============================
 
  -----------------------------
  IPsec policy name: "policy2"
  sequence number: 10
  mode: isakmp
  -----------------------------
    connection id: 4
    encapsulation mode: tunnel
    perfect forward secrecy: None
    tunnel:
        local  address: 20.1.12.2
        remote address: 20.1.12.1
    Flow :
        sour addr: 192.168.2.1/255.255.255.255  port: 0  protocol: IP
        dest addr: 192.168.1.1/255.255.255.255  port: 0  protocol: IP
 
    [inbound ESP SAs] 
      spi: 256854815 (0xf4f4b1f)
      proposal: ESP-ENCRYPT-3DES ESP-AUTH-SHA1
      sa remaining key duration (bytes/sec): 1887436464/3341
      max received sequence-number: 4
      udp encapsulation used for nat traversal: N
 
    [outbound ESP SAs] 
      spi: 52604977 (0x322b031)
      proposal: ESP-ENCRYPT-3DES ESP-AUTH-SHA1
      sa remaining key duration (bytes/sec): 1887436464/3341
      max sent sequence-number: 5
      udp encapsulation used for nat traversal: N
 
 
已经建立，实验成功。
 
 
三【配置文本】
 
 
 version 5.20, Alpha 1011
#
 sysname R1
#
 password-control login-attempt 3 exceed lock-time 120
#
 undo voice vlan mac-address 00e0-bb00-0000
#
 ike local-name rta
#
 ipsec cpu-backup enable
#
 undo cryptoengine enable
#
 ip pool 1 20.1.12.2 20.1.12.254
#
 domain default enable system
#
vlan 1
#
domain system
 access-limit disable
 state active   
 idle-cut disable
 self-service-url disable
#
ike peer rtb
 exchange-mode aggressive
 pre-shared-key cipher J5fBBpuCrvQ=
 id-type name
 remote-name rtb
#
ipsec proposal tran1
 esp authentication-algorithm sha1
 esp encryption-algorithm 3des
#
ipsec policy policy1 10 isakmp
 security acl 3000
 ike-peer rtb
 proposal tran1
#
acl number 3000
 rule 0 permit ip source 192.168.1.1 0 destination 192.168.2.1 0
 rule 1 deny ip
#
interface Serial0/6/0
 link-protocol ppp
 remote address pool 1
 ip address 20.1.12.1 255.255.255.0
 ipsec policy policy1
#
interface Serial0/6/1
 link-protocol ppp
#
interface Serial0/6/2
 link-protocol ppp
#
interface Serial0/6/3
 link-protocol ppp
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.1.1 255.255.255.255
#
interface Ethernet0/4/0
 port link-mode bridge
#
interface Ethernet0/4/1
 port link-mode bridge
#
interface Ethernet0/4/2
 port link-mode bridge
#
interface Ethernet0/4/3
 port link-mode bridge
#
interface Ethernet0/4/4
 port link-mode bridge
#
interface Ethernet0/4/5
 port link-mode bridge
#
interface Ethernet0/4/6
 port link-mode bridge
#
interface Ethernet0/4/7
 port link-mode bridge
#
 ip route-static 0.0.0.0 0.0.0.0 Serial0/6/0
#
 load xml-configuration
#
user-interface con 0
user-interface vty 0 4
#
return
 
 
 
<R2>DIS CU
#
 version 5.20, Alpha 1011
#
 sysname R2
#
 password-control login-attempt 3 exceed lock-time 120
#
 undo voice vlan mac-address 00e0-bb00-0000
#
 ike local-name rtb
#
 ipsec cpu-backup enable
#
 undo cryptoengine enable
#
 domain default enable system
#
vlan 1
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
ike peer rta
 exchange-mode aggressive
 pre-shared-key cipher J5fBBpuCrvQ=
 id-type name
 remote-name rta
 remote-address 20.1.12.1
#
ipsec proposal tran2
 esp authentication-algorithm sha1
 esp encryption-algorithm 3des
#
ipsec policy policy2 10 isakmp
 security acl 3000
 ike-peer rta
 proposal tran2
#
acl number 3000
 rule 0 permit ip source 192.168.2.1 0 destination 192.168.1.1 0
 rule 1 deny ip
#
interface Serial0/6/0
 link-protocol ppp
 ip address ppp-negotiate
 ipsec policy policy2
#
interface Serial0/6/1
 link-protocol ppp
#
interface Serial0/6/2
 link-protocol ppp
#
interface Serial0/6/3
 link-protocol ppp
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.2.1 255.255.255.255
#
interface Ethernet0/4/0
 port link-mode bridge
#
interface Ethernet0/4/1
 port link-mode bridge
#               
interface Ethernet0/4/2
 port link-mode bridge
#
interface Ethernet0/4/3
 port link-mode bridge
#
interface Ethernet0/4/4
 port link-mode bridge
#
interface Ethernet0/4/5
 port link-mode bridge
#
interface Ethernet0/4/6
 port link-mode bridge
#
interface Ethernet0/4/7
 port link-mode bridge
#
 ip route-static 0.0.0.0 0.0.0.0 Serial0/6/0
#
 load xml-configuration
#
user-interface con 0
user-interface vty 0 4
#
return