华为ipsec 技术

拓扑

fw1 1.1.1.1 fw2 2.2.2.2 建立ipsec

技术细节 ike 安全提议

ike 对等体 在ike 对等体中运用ike安全提议

ipsec 安全提议

ipsec 安全策略

acl 定义数据流

ipsec 安全策略运用 ike 对等体 ipsec 安全提议 ipsec acl

设备配置

sysname fw1

#

l2tp domain suffix-separator @

#

ipsec sha2 compatible enable

#

undo telnet server enable

undo telnet ipv6 server enable

#

update schedule location-sdb weekly Sun 22:49

#

firewall defend action discard

#

banner enable

#

user-manage web-authentication security port 8887

undo privacy-statement english

undo privacy-statement chinese

page-setting

user-manage security version tlsv1.1 tlsv1.2

password-policy

level high

user-manage single-sign-on ad

user-manage single-sign-on tsm

user-manage single-sign-on radius

user-manage auto-sync online-user

#

web-manager security version tlsv1.1 tlsv1.2

web-manager enable

web-manager security enable

#

firewall dataplane to manageplane application-apperceive default-action drop

#

undo ips log merge enable

#

decoding uri-cache disable

#

update schedule ips-sdb daily 01:23

update schedule av-sdb daily 01:23

update schedule sa-sdb daily 01:23

update schedule cnc daily 01:23

update schedule file-reputation daily 01:23

#

ip vpn-instance default

ipv4-family

#

time-range worktime

period-range 08:00:00 to 18:00:00 working-day

#

acl number 3000

rule 1 permit ip source 1.1.1.1 0 destination 2.2.2.2 0

#

ipsec proposal 1

esp authentication-algorithm sha2-256

esp encryption-algorithm aes-256

#

ike proposal default

encryption-algorithm aes-256 aes-192 aes-128

dh group14

authentication-algorithm sha2-512 sha2-384 sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

ike proposal 1

encryption-algorithm aes-256

dh group14

authentication-algorithm sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

#

ike peer fw3

pre-shared-key %^%#[@G*PGGTb%p\tG@e;=+LlcWRFN6ocQLdBg>&c[q'%^%#

ike-proposal 1

remote-address 10.1.1.2

#

ipsec policy 1 1 isakmp

security acl 3000

ike-peer fw3

proposal 1

#

aaa

authentication-scheme default

authentication-scheme admin_local

authentication-scheme admin_radius_local

authentication-scheme admin_hwtacacs_local

authentication-scheme admin_ad_local

authentication-scheme admin_ldap_local

authentication-scheme admin_radius

authentication-scheme admin_hwtacacs

authentication-scheme admin_ad

authorization-scheme default

accounting-scheme default

domain default

service-type internetaccess ssl-vpn l2tp ike

internet-access mode password

reference user current-domain

manager-user audit-admin

password cipher @%@%$#7F>H3CUQU*IUF%G0iQYQf@H^O'2hg+4W&G*RLq34bYQfCY@%@%

service-type web terminal

level 15

manager-user api-admin

password cipher @%@%\Ol~&]dxg~1kWzN#=G-%(6n8*~/lL,F>[9iPnL'@7G376n;(@%@%

level 15

manager-user admin

password cipher @%@%*yi~RPVVZR9<8h/N,l!Gk7)wj@r;@BAmIEoB"SDaaHDL7)zk@%@%

service-type web terminal

level 15

role system-admin

role device-admin

role device-admin(monitor)

role audit-admin

bind manager-user audit-admin role audit-admin

bind manager-user admin role system-admin

#

l2tp-group default-lns

#

interface GigabitEthernet0/0/0

undo shutdown

ip binding vpn-instance default

ip address 192.168.0.1 255.255.255.0

alias GE0/METH

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 10.1.1.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

ipsec policy 1

#

interface GigabitEthernet1/0/1

undo shutdown

#

interface GigabitEthernet1/0/2

undo shutdown

#

interface GigabitEthernet1/0/3

undo shutdown

#

interface GigabitEthernet1/0/4

undo shutdown

#

interface GigabitEthernet1/0/5

undo shutdown

#

interface GigabitEthernet1/0/6

undo shutdown

#

interface Virtual-if0

#

interface NULL0

#

interface LoopBack1

ip address 1.1.1.1 255.255.255.255

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/0

#

firewall zone dmz

set priority 50

#

ip route-static 0.0.0.0 0.0.0.0 10.1.1.2

#

undo ssh server compatible-ssh1x enable

ssh authentication-type default password

ssh server cipher aes256_ctr aes128_ctr

ssh server hmac sha2_256 sha1

ssh client cipher aes256_ctr aes128_ctr

ssh client hmac sha2_256 sha1

#

firewall detect ftp

#

user-interface con 0

authentication-mode aaa

user-interface vty 0 4

authentication-mode aaa

protocol inbound ssh

user-interface vty 16 20

#

pki realm default

#

sa

#

location

#

multi-linkif

mode proportion-of-weight

#

right-manager server-group

#

device-classification

device-group pc

device-group mobile-terminal

device-group undefined-group

#

user-manage server-sync tsm

#

security-policy

rule name hulian

source-zone local

source-zone untrust

destination-zone local

destination-zone untrust

source-address 10.1.1.0 mask 255.255.255.0

destination-address 10.1.1.0 mask 255.255.255.0

action permit

rule name 1.1.1.1-2.2.2.2

source-zone local

source-zone untrust

destination-zone local

destination-zone untrust

source-address 1.1.1.1 mask 255.255.255.255

source-address 2.2.2.2 mask 255.255.255.255

destination-address 1.1.1.1 mask 255.255.255.255

destination-address 2.2.2.2 mask 255.255.255.255

action permit

#

auth-policy

#

traffic-policy

#

policy-based-route

#

nat-policy

#

quota-policy

#

pcp-policy

#

dns-transparent-policy

#

rightm-policy

#

return

#

==============================================================

fw2

[fw2] display current-configuration

2023-02-26 02:31:50.110

!Software Version V500R005C10SPC300

#

sysname fw2

#

l2tp domain suffix-separator @

#

ipsec sha2 compatible enable

#

undo telnet server enable

undo telnet ipv6 server enable

#

update schedule location-sdb weekly Sun 05:46

#

firewall defend action discard

#

banner enable

#

user-manage web-authentication security port 8887

undo privacy-statement english

undo privacy-statement chinese

page-setting

user-manage security version tlsv1.1 tlsv1.2

password-policy

level high

user-manage single-sign-on ad

user-manage single-sign-on tsm

user-manage single-sign-on radius

user-manage auto-sync online-user

#

web-manager security version tlsv1.1 tlsv1.2

web-manager enable

web-manager security enable

#

firewall dataplane to manageplane application-apperceive default-action drop

#

undo ips log merge enable

#

decoding uri-cache disable

#

update schedule ips-sdb daily 04:46

update schedule av-sdb daily 04:46

update schedule sa-sdb daily 04:46

update schedule cnc daily 04:46

update schedule file-reputation daily 04:46

#

#

ip vpn-instance default

ipv4-family

#

time-range worktime

period-range 08:00:00 to 18:00:00 working-day

#

acl number 3000

rule 1 permit ip source 2.2.2.2 0 destination 1.1.1.1 0

#

ipsec proposal 1

esp authentication-algorithm sha2-256

esp encryption-algorithm aes-256

#

ike proposal default

encryption-algorithm aes-256 aes-192 aes-128

dh group14

authentication-algorithm sha2-512 sha2-384 sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

ike proposal 1

encryption-algorithm aes-256

dh group14

authentication-algorithm sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

#

ike peer fw1

pre-shared-key %^%#,VAC.XNmAF0;1*&;4oo''$}F@.+*A!7uO@O=cVIU%^%#

ike-proposal 1

remote-address 10.1.1.1

#

ipsec policy 1 1 isakmp

security acl 3000

ike-peer fw1

proposal 1

#

aaa

authentication-scheme default

authentication-scheme admin_local

authentication-scheme admin_radius_local

authentication-scheme admin_hwtacacs_local

authentication-scheme admin_ad_local

authentication-scheme admin_ldap_local

authentication-scheme admin_radius

authentication-scheme admin_hwtacacs

authentication-scheme admin_ad

authorization-scheme default

accounting-scheme default

domain default

service-type internetaccess ssl-vpn l2tp ike

internet-access mode password

reference user current-domain

manager-user audit-admin

password cipher @%@%v%^hLqIut$cI8dF|e2cAiY>FfF~fI@#mb"-wM*F!b~~ZY>Ii@%@%

service-type web terminal

level 15

manager-user api-admin

password cipher @%@%%~np/];+,7s5`|U/Ez]3*:AMQ"Qt*ktICHDmX^QT5TQ8:AP*@%@%

level 15

manager-user admin

password cipher @%@%#)Yy3X#Vb4_56!:=O/A%EiJg)}PC4;>6]B(B`*>6nW}4iJjE@%@%

service-type web terminal

level 15

role system-admin

role device-admin

role device-admin(monitor)

role audit-admin

bind manager-user audit-admin role audit-admin

bind manager-user admin role system-admin

#

l2tp-group default-lns

#

interface GigabitEthernet0/0/0

undo shutdown

ip binding vpn-instance default

ip address 192.168.0.1 255.255.255.0

alias GE0/METH

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 10.1.1.2 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

ipsec policy 1

#

interface GigabitEthernet1/0/1

undo shutdown

#

interface GigabitEthernet1/0/2

undo shutdown

#

interface GigabitEthernet1/0/3

undo shutdown

#

interface GigabitEthernet1/0/4

undo shutdown

#

interface GigabitEthernet1/0/5

undo shutdown

#

interface GigabitEthernet1/0/6

undo shutdown

#

interface Virtual-if0

#

interface NULL0

#

interface LoopBack1

ip address 2.2.2.2 255.255.255.255

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/0

#

firewall zone dmz

set priority 50

#

ip route-static 0.0.0.0 0.0.0.0 10.1.1.1

#

undo ssh server compatible-ssh1x enable

ssh authentication-type default password

ssh server cipher aes256_ctr aes128_ctr

ssh server hmac sha2_256 sha1

ssh client cipher aes256_ctr aes128_ctr

ssh client hmac sha2_256 sha1

#

firewall detect ftp

#

user-interface con 0

authentication-mode aaa

user-interface vty 0 4

authentication-mode aaa

protocol inbound ssh

user-interface vty 16 20

#

pki realm default

#

sa

#

location

#

multi-linkif

mode proportion-of-weight

#

right-manager server-group

#

device-classification

device-group pc

device-group mobile-terminal

device-group undefined-group

#

user-manage server-sync tsm

#

security-policy

rule name hulian

source-zone local

source-zone untrust

destination-zone local

destination-zone untrust

source-address 10.1.1.0 mask 255.255.255.0

destination-address 10.1.1.0 mask 255.255.255.0

action permit

rule name 1.1.1.1-2.2.2.2

source-zone local

source-zone untrust

destination-zone local

destination-zone untrust

source-address 1.1.1.1 mask 255.255.255.255

source-address 2.2.2.2 mask 255.255.255.255

destination-address 1.1.1.1 mask 255.255.255.255

destination-address 2.2.2.2 mask 255.255.255.255

action permit

#

auth-policy

#

traffic-policy

#

policy-based-route

#

nat-policy

#

quota-policy

#

pcp-policy

#

dns-transparent-policy

#

rightm-policy

#

return