H3C-F100-S-G-IPSEC案例.doc

H3C F100-S-G案例：

点对点ipsec
总部一台F100-S-G,分部一台F100-S-G。
总部内网网段10.10.10.0/24,10.0.0.0/24
两端外网口为固定地址
F100-S-G-分部配置：
#
acl number 3001 \\用于匹配IPSEC 保护流
description Protect-Vpndata
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 10 permit ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 15 permit ip source 192.168.2.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
#
acl number 3002
\\此条ACL作用在nat outbound 保证在访问对端内网同时访问互联网
description Nat-Deny-Vpn
rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
rule 5 deny ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 10 deny ip source 192.168.2.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
rule 15 deny ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 20 permit ip
分部IPSEC配置
ike peer peer
pre-shared-key cipher $c$3$V27Lx8P8XlcjEBdTwsA93xbVHc7XYA==
remote-address 1.1.1.1 \\总部地址为1.1.1.1
#
ipsec transform-set tran1
encapsulation-mode tunnel
transform esp
esp authentication-algorithm sha1
esp encryption-algorithm des
#
ipsec policy map1 10 isakmp
security acl 3001
ike-peer peer
transform-set tran1
#

总部配置：
#
acl number 3101
rule 0 permit ip source 10.10.10.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 10 permit ip source 10.0.0.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 15 permit ip source 10.0.0.0 0.0.0.255 destination 192.168.2. 0.0.0.255
acl number 3102
rule 0 deny ip source 10.10.10.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 192.168.2. 0.0.0.255
rule 10 deny ip source 10.0.0.0 0.0.0.255 destination 192.168.1. 0.0.0.255
rule 15 deny ip source 10.0.0.0 0.0.0.255 destination 192.168.2.0.0.0.255
#
#
ike peer peer
pre-shared-key cipher $c$3$gwetCOoxjJ+dioylV5OqTz/joXiHLerq
remote-address 2.2.2.2 \\分点的外网口地址
#
ipsec transform-set tran1
encapsulation-mode tunnel
transform esp
esp authentication-algorithm sha1
esp encryption-algorithm des
#
ipsec policy use1 10 isakmp
security acl 3101
ike-peer peer
transform-set tran1
#