华三IPSec配置（主模式）

1.配置防火墙

（1）配置FW1

<H3C>system
[H3C]sysname FW1
[FW1]display interface brief
[FW1]interface gigabitethernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip address 2.2.2.1 24
[FW1-GigabitEthernet1/0/0]interface gigabitethernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 33.1.1.1 24
[FW1-GigabitEthernet1/0/1]quit
#配置缺省路由指向外网路由器
[FW1]ip route-static 0.0.0.0 0 33.1.1.2

#将接口加入防火墙区域
[FW1]security-zone name trust
[FW1-security-zone-Trust]import interface gigabitethernet 1/0/0
[FW1-security-zone-Trust]security-zone name untrust
[FW1-security-zone-Untrust]import interface gigabitethernet 1/0/1
[FW1-security-zone-Untrust]quit
#本实验主要目的是ipsec，所以此处将全部流量放行。
[FW1]security-policy ip
[FW1-security-policy-ip]rule 5 name test-pass
[FW1-security-policy-ip-5-test-pass]action pass
[FW1-security-policy-ip-5-test-pass]quit
[FW1-security-policy-ip]quit

#配置ike提议
[FW1]ike proposal 1
#配置认证方式为预共享密钥
[FW1-ike-proposal-1]authentication-method pre-share
#配置ike协商时使用的认证算法为SHA
[FW1-ike-proposal-1]authentication-algorithm sha
#配置ike协商时使用的加密算法为3DES
[FW1-ike-proposal-1]encryption-algorithm 3des-cbc
[FW1-ike-proposal-1]quit
#配置ike Keychain,在此处对预共享密钥进行配置，需指定对端地址。
[FW1]ike keychain 1
[FW1-ike-keychain-1]pre-shared-key address 55.1.1.2 key simple a123456789
#配置ike profile
[FW1]ike profile 1
#配置本端身份信息
[FW1-ike-profile-1]local-identity address 33.1.1.1
#配置所匹配的对端身份
[FW1-ike-profile-1]match remote identity address 55.1.1.2
#引用ike Keychain
[FW1-ike-profile-1]keychain 1
#引用porposal
[FW1-ike-profile-1]proposal 1
[FW1-ike-profile-1]quit

#配置ipsec安全提议
[FW1]ipsec transform-set 1
#配置esp使用的认证算法为sha1
[FW1-ipsec-transform-set-1]esp authentication-algorithm sha1
#配置esp使用的加密算法为3des-cbc
[FW1-ipsec-transform-set-1]esp encryption-algorithm 3des-cbc
[FW1-ipsec-transform-set-1]quit

#通过acl，配置感兴趣流，抓取需要通过ipsec传输的数据
[FW1]acl advanced 3001
[FW1-acl-ipv4-adv-3001]rule 5 permit ip source 2.2.2.0 0.0.0.255 destination 1.1.1.0 0.0.0.255
[FW1-acl-ipv4-adv-3001]quit



#创建一条iek协商方式的IPsec安全策略，并进入IPsec安全策略视图。
[FW1]ipsec policy 1 1 isakmp
#指定对端地址
[FW1-ipsec-policy-isakmp-1-1]remote 55.1.1.2
#引用感兴趣流
[FW1-ipsec-policy-isakmp-1-1]security acl 3001
#引用ipsec安全提议
[FW1-ipsec-policy-isakmp-1-1]transform-set 1
#引用ike profile
[FW1-ipsec-policy-isakmp-1-1]ike-profile 1
[FW1-ipsec-policy-isakmp-1-1]quit
#在接口视图下应用ipsec策略
[FW1]interface gigabitethernet 1/0/1
[FW1-GigabitEthernet1/0/1]ipsec apply policy 1
[FW1-GigabitEthernet1/0/1]quit
[FW1]save force

（二）配置FW2,。（除了本端和对端地址反过来以外，其它配置均一致）

<H3C>system
[H3C]sysname FW2
[FW2]interface gigabitethernet 1/0/0
[FW2-GigabitEthernet1/0/0]ip address 1.1.1.1 24
[FW2-GigabitEthernet1/0/0]interface gigabitethernet 1/0/1
[FW2-GigabitEthernet1/0/1]ip address 55.1.1.2 24
[FW2-GigabitEthernet1/0/1]quit
[FW2]ip route-static 0.0.0.0 0 55.1.1.1

[FW2]security-zone name trust
[FW2-security-zone-Trust]import interface gigabitethernet 1/0/0
[FW2-security-zone-Trust]security-zone name untrust
[FW2-security-zone-Untrust]import interface gigabitethernet 1/0/1
[FW2-security-zone-Untrust]quit
[FW2]security-policy ip
[FW2-security-policy-ip]rule 0 name pass
[FW2-security-policy-ip-0-pass]action pass
[FW2-security-policy-ip-0-pass]quit
[FW2-security-policy-ip]quit

[FW2]ike proposal 1
[FW2-ike-proposal-1]authentication-method pre-share
[FW2-ike-proposal-1]encryption-algorithm 3des-cbc
[FW2-ike-proposal-1]authentication-algorithm sha
[FW2-ike-proposal-1]quit

[FW2]ike keychain 1
[FW2-ike-keychain-1]pre-shared-key address 33.1.1.1 key simple a123456789
[FW2-ike-keychain-1]quit

[FW2]ike profile 1
[FW2-ike-profile-1]local-identity address 55.1.1.2
[FW2-ike-profile-1]match remote identity address 33.1.1.1
[FW2-ike-profile-1]proposal 1
[FW2-ike-profile-1]keychain 1
[FW2-ike-profile-1]quit

[FW2]ipsec transform-set 1
[FW2-ipsec-transform-set-1]esp authentication-algorithm sha1
[FW2-ipsec-transform-set-1]esp encryption-algorithm 3des-cbc
[FW2-ipsec-transform-set-1]quit
[FW2]acl advanced 3001
[FW2-acl-ipv4-adv-3001]rule 5 permit ip source 1.1.1.0 0.0.0.255 destination 2.2.2.0 0.0.0.255
[FW2-acl-ipv4-adv-3001]quit

[FW2]ipsec policy 1 1 isakmp
[FW2-ipsec-policy-isakmp-1-1]remote 33.1.1.1
[FW2-ipsec-policy-isakmp-1-1]security acl 3001
[FW2-ipsec-policy-isakmp-1-1]transform-set 1
[FW2-ipsec-policy-isakmp-1-1]ike-profile 1
[FW2-ipsec-policy-isakmp-1-1]quit
[FW2]interface gigabitethernet 1/0/1
[FW2-GigabitEthernet1/0/1]ipsec apply policy 1
[FW2-GigabitEthernet1/0/1]quit
[FW2]save force

2.配置路由器R1

<H3C>system
[H3C]sysname R1
[R1]interface gigabitethernet 0/0
[R1-GigabitEthernet0/0]ip address 33.1.1.2 24
[R1-GigabitEthernet0/0]interface gigabitethernet 0/1
[R1-GigabitEthernet0/1]ip address 55.1.1.1 24
[R1-GigabitEthernet0/1]quit
[R1]save force

3.为PC分配IP（具体过程略，不过记得配网关地址）

4.测试

（1）PC间可以互通，首个数据包会创建隧道。

（2）查看ike sa和ipsec sa

（3）产看路由器R1路由表，两个内网通过ipsec vpn交互数据，R1内无内网路由表项。