华为路由交换IPSEC VPN 互通 + 上 网配置示例
1 IPSEC VPN 互通 + 上网配置示例
2、实验目的
掌握 NAT 的配置
掌握 IPSEC VPN 的基础配置
3、实验拓扑
3、配置要点
总公司的配置
sysname ZongGongSi
acl number 3000
rule 5 deny ip source 172.16.10.0 0.0.0.255 destination 172.16.20.0 0.0.0.255
rule 10 permit ip
acl number 3001
rule 5 permit ip source 172.16.10.0 0.0.0.255 destination 172.16.20.0 0.0.0.255
ipsec proposal test
ike proposal 1
ike peer test v2
pre-shared-key simple cbe.com
remote-address 23.1.1.2
ipsec policy test 10 isakmp
security acl 3001
ike-peer test
proposal test
interface GigabitEthernet0/0/0
ip address 172.16.10.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0
ipsec policy test
nat outbound 3000
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
sysname FenGongSi
acl number 3000
rule 5 deny ip source 172.16.20.0 0.0.0.255 destination 172.16.10.0 0.0.0.255
rule 10 permit ip
acl number 3001
rule 5 permit ip source 172.16.20.0 0.0.0.255 destination 172.16.10.0 0.0.0.255
ipsec proposal test
ike peer test v2
pre-shared-key simple cbe.com
remote-address 12.1.1.1
ipsec policy test 10 isakmp
security acl 3001
ike-peer test
proposal test
interface GigabitEthernet0/0/0
ip address 172.16.20.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 23.1.1.2 255.255.255.0
ipsec policy test
nat outbound 3000
ip route-static 0.0.0.0 0.0.0.0 23.1.1.1
互联网的配置
sysname Internet
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
interface GigabitEthernet0/0/1
ip address 23.1.1.1 255.255.255.0
interface LoopBack100
ip address 100.100.100.100 255.255.255.0
interface LoopBack200
ip address 200.200.200.200 255.255.255.0
四、互通测试
主机上 ping 分支 上网
路由器上校验
dis ike sa v2