【实验拓扑】

【实验目的】

 ×××隧道技术，通过一个公用网络(通常是因特网)建立一个临时的、安全的连接，是一条穿过混乱的公用网络的安全、稳定的隧道.

有基于二层（pptp/l2tp/l2f）和三层(gre/ipsec)的×××隧道技术

今天在H3C防火墙上利用三层的gre协议,实现总公司和分公司的通信。

【实验设备】

 H3C防火墙两台（模拟总/分公司的出口路由器）

 H3C三层交换机（模拟Internet网络环境）

 测试PC两台（总、分公司内网主机）

【配置过程】

 Step1：进入三层交换机，划分两个Vlan（10、20），分别配以公网 

IP,分别作为Intetnet两个边界入口。 

 Step2：分别进入两台H3C防火墙的Eth0/0,配以地址，作为总、分公司的网关参数。 

 Step3：分别进入两台H3C防火墙的Eth0/4,配以公网IP地址，作为内网访问Inetnet的出口。

 Step4：在两台防火墙上分别创建隧道接口，隧道协议选择gre。

【配置参考】

FW-1

interface Ethernet0/0

ip address 192.168.101.254 255.255.255.0

interface Ethernet0/4    

ip address 61.130.130.1 255.255.255.252 

interface Tunnel10                                                                                          

ip address 192.168.4.1 255.255.255.0                                                                       

source 61.130.130.1                                                                                        

destination 61.130.132.1                                                                                

firewall zone trust                                                                                         

add interface Ethernet0/0                                                                                  

set priority 85

firewall zone untrust                                                                                       

add interface Ethernet0/4                                                                                  

add interface Tunnel10                                                                                     

set priority 5

rip                                                                                                         

network 192.168.101.0                                                                                      

network 192.168.4.0                                                                                   

ip route-static 0.0.0.0 0.0.0.0 61.130.130.2 preference 60                                                 

FW-2

interface Ethernet0/0

ip address 192.168.102.254 255.255.255.0 

interface Ethernet0/4    

ip address 61.130.132.1 255.255.255.252

interface Tunnel20                                                                                          

ip address 192.168.4.2 255.255.255.0                                                                       

source 61.130.130.1                                                                                        

destination 61.130.130.1                                                                             

firewall zone trust                                                                                         

add interface Ethernet0/0                                                                                  

set priority 85                                                                                      

firewall zone untrust                                                                                       

add interface Ethernet0/4                                               

add interface Tunnel10                                                                                     

set priority 5                                                                                       

rip                                                                                                         

network 192.168.102.0                                                                                      

network 192.168.4.0                                                                                        

ip route- static 0.0.0.0 0.0.0.0 61.130.132.2 preference 60                                                 

SW(SIP)

sysname ISP                                                 

                  

vlan 1                                                                           

vlan 10                                                 

                       

vlan 20                                                               

interface Vlan-interface10 

ip address 61.130.130.2 255.255.255.252                     

interface Vlan-interface20

ip address 61.130.132.2 255.255.255.252                         

interface Ethernet0/1 

port access vlan 10                                            

interface Ethernet0/2 

port access vlan 20 

#                                                           

【验证分析】

FW-1路由表

FW-2路由表

FW-2上ping测试

分公司主机ping测试