H3C-×××的配置

拓扑图

  1. 配置IP地址
    <R1>system-view
    [R1]interface e0/1
    [R1-Ethernet0/1]ip address 192.168.100.254 255.255.255.0
    [R1]interface e0/0
    [R1-Ethernet0/0]ip address 192.168.13.1 255.255.255.0
     
    <R2>system-view
    [R2]interface e0/1
    [R2-Ethernet0/1]ip address 192.168.200.254 255.255.255.0
    [R2]interface e0/0
    [R2-Ethernet0/0]ip address 192.168.23.2 255.255.255.0
     
     
    <R3>system-view
    [R3]interface e0/0
    [R3-Ethernet0/0]ip address 192.168.13.3 255.255.255.0
    [R3]interface e0/1
    [R3-Ethernet0/1]ip address 192.168.23.3 255.255.255.0
     
    PC1的设置

    PC2的设置

  2. 配置手工方式的Tunnel
    [R1]acl 3000
    [R1-acl-3000]rule permit ip source 192.168.100.1 0.0.0.255 destination 192.168.200.2 0.0.0.255
    [R1-acl-3000]rule deny ip source any destination any
    [R1-acl-3000]quit
    //创建访问规则
    [R1]ipsec proposal trans1
    [R1-ipsec-proposal-trans1]encapsulation-mode tunnel
    [R1-ipsec-proposal-trans1]transform esp-new
    [R1-ipsec-proposal-trans1]esp-new authentication md5-hmac-96
    [R1-ipsec-proposal-trans1]esp-new encryption-algorithm des
    [R1-ipsec-proposal-trans1]quit
    //创建提议，以及对提议的加密、认证方式
    [R1]ipsec policy p1 100 manual
    [R1-ipsec-policy-p1-100]security acl 3000
    [R1-ipsec-policy-p1-100]proposal trans1
    [R1-ipsec-policy-p1-100]tunnel local 192.168.13.1
    [R1-ipsec-policy-p1-100]tunnel remote 192.168.23.2
    [R1-ipsec-policy-p1-100]sa inbound esp spi 123456
    [R1-ipsec-policy-p1-100]sa inbound esp string-key asdf
    [R1-ipsec-policy-p1-100]sa outbound esp spi 654321
    [R1-ipsec-policy-p1-100]sa outbound esp string-key fdsa
    [R1-ipsec-policy-pl -100]quit
    //创建策略，包含上述提议，该策略将应用于Tunnel中，需要注意的是Tunnel两端的路由器策略配置，R1中的tunnel local地址是R2的tunnel remote， inbound是R2的outbound。
    [R1]interface e0/0
    [R1-Ethernet0/0]ipsec policy p1
    //在出口上应用策略
     
     
    [R2]acl 3001
    [R2-acl-3001]rule permit ip source 192.168.200.2 0.0.0.255 destination 192.168.100.1 0.0.0.255
    [R2-acl-3001]rule deny ip source any destination any
    [R2-acl-3001]quit
    //创建访问规则
    [R2]ipsec proposal trans2
    [R2-ipsec-proposal-trans2]encapsulation-mode tunnel
    [R2-ipsec-proposal-trans2]transform esp-new
    [R2-ipsec-proposal-trans2]esp-new authentication md5-hmac-96
    [R2-ipsec-proposal-trans2]esp-new encryption-algorithm des
    [R2-ipsec-proposal-trans2]quit
    //创建提议，以及对提议的加密、认证方式
    [R2]ipsec policy p2 200 manual
    [R2-ipsec-policy-p2-200]security acl 3001
    [R2-ipsec-policy-p2-200]proposal trans2
    [R2-ipsec-policy-p2-200]tunnel local 192.168.23.2
    [R2-ipsec-policy-p2-200]tunnel remote 192.168.13.1
    [R2-ipsec-policy-p2-200]sa inbound esp spi 654321
    [R2-ipsec-policy-p2-200]sa inbound esp string-key fdsa
    [R2-ipsec-policy-p2-200]sa outbound esp spi 123456
    [R2-ipsec-policy-p2-200]sa outbound esp string-key asdf
    [R2-ipsec-policy-p2-200]quit
    [R2]interface e0/0
    [R2-Ethernet0/0]ipsec policy p2
  3. 在Tunnel两端的路由器上各添加一条默认路由，是内网地址能够和外部连接。
    ip route-static 0.0.0.0 0.0.0.0 192.168.13.3 preference 60    //R1上的默认路由
    ip route-static 0.0.0.0 0.0.0.0 192.168.23.3 preference 60    //R2上的默认路由
  4. 查看Tunnel状态，以及PC1和PC2之间的连通性。
    ipsec policy name: p1
     ipsec policy sequence: 100
     negotiation mode: manual
     security acl: 3000
     local address: 192.168.13.1
     remote address: 192.168.23.2
     proposal name: trans1
     esp(inbound) setting:
       esp spi: 654321 (0x9fbf1)
       esp string-key: fdsa
       esp encryption-hex:
       esp authen-hex:
     esp(outbound) setting:
       esp spi: 123456 (0x1e240)
       esp string-key: asdf
       esp encryption-hex:
       esp authen-hex:
     OutBound SA has been established.
     InBound SA has been established.
    //路由器R1端的Tunnel状态
    ipsec policy name: p2
    ipsec policy sequence: 200
    negotiation mode: manual
    security acl: 3001
    local address: 192.168.23.2
    remote address: 192.168.13.1
    proposal name: trans2
    esp(inbound) setting:
     esp spi: 123456 (0x1e240)
     esp string-key: asdf
     esp encryption-hex:
     esp authen-hex:
    esp(outbound) setting:
     esp spi: 654321 (0x9fbf1)
     esp string-key: fdsa
     esp encryption-hex:
     esp authen-hex:
    OutBound SA has been established.
    InBound SA has been established.
    //路由器R2端的Tunnel状态
     
    //在PC1上pingPC2
    正在 Ping 192.168.200.2 具有 32 字节的数据:
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=9ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=9ms TTL=254
  5. 配置自动方式的Tunnel。
    [R1]ipsec policy p3 300 isakmp
    [R1-ipsec-policy-p3-300]security acl 3000
    [R1-ipsec-policy-p3-300]proposal trans1
    [R1-ipsec-policy-p3-300]tunnel local 192.168.13.1
    [R1-ipsec-policy-p3-300]tunnel remote 192.168.23.2
    [R1-ipsec-policy-p3-300]quit
    [R1]ike pre-shared-key 12345 remote 192.168.23.2
    [R1]interface e0/0
    [R1-Ethernet0/0]ipsec policy p3
    //提议和手工方式一样，策略修改为自动方式的，而且共享密钥的设置，Tunnel两端要一致。
    [R2]ipsec policy p4 400 isakmp
    [R2-ipsec-policy-p4-400]security acl 3001
    [R2-ipsec-policy-p4-400]proposal trans2
    [R2-ipsec-policy-p4-400]tunnel local 192.168.23.2
    [R2-ipsec-policy-p4-400]tunnel remote 192.168.13.1
    [R2-ipsec-policy-p4-400]quit
    [R2]ike pre-shared-key 12345 remote 192.168.13.1
    [R2]interface e0/0
    [R2-Ethernet0/0]ipsec policy p4
  6. Tunnel状态以及PC1和PC2之间的连通性。
    ipsec policy name: p3
    ipsec policy sequence: 300
    negotiation mode: isakmp
    security acl: 3000
    remote address 0: 192.168.23.2
    Proposal name: trans1
    ipsec sa duration: 3600 seconds
    ipsec sa duration: 1843200 kilobytes
    OutBound SA has been established.
    InBound SA has been established.
    //路由器R1端的Tunnel状态
    ipsec policy name: p4
    ipsec policy sequence: 400
    negotiation mode: isakmp
    security acl: 3001
    remote address 0:192.168.13.1
    Proposal name: trans2
    ipsec sa duration: 3600 seconds
    ipsec sa duration: 1843200 kilobytes
    OutBound SA has been established.
    InBound SA has been established.
    //路由器R2端的Tunnel状态
    正在 Ping 192.168.200.2 具有 32 字节的数据:
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=9ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    来自 192.168.200.2 的回复: 字节=32 时间=3ms TTL=254
    //从PC1 ping PC2的情况