華為路由交換IPSEC VPN 互通 + 上 網配置示例
華為路由交換IPSEC VPN 互通 + 上 網配置示例
1 IPSEC VPN 互通 + 上網配置示例
2、實驗目的
掌握 NAT 的配置
掌握 IPSEC VPN 的基礎配置
3、實驗拓撲
3、配置要點
總公司的配置
sysname ZongGongSi
acl number 3000
rule 5 deny ip source 172.16.10.0 0.0.0.255 destination 172.16.20.0 0.0.0.255
rule 10 permit ip
acl number 3001
rule 5 permit ip source 172.16.10.0 0.0.0.255 destination 172.16.20.0 0.0.0.255
ipsec proposal test
ike proposal 1
ike peer test v2
pre-shared-key simple cbe.com
remote-address 23.1.1.2
ipsec policy test 10 isakmp
security acl 3001
ike-peer test
proposal test
interface GigabitEthernet0/0/0
ip address 172.16.10.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0
ipsec policy test
nat outbound 3000
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
sysname FenGongSi
acl number 3000
rule 5 deny ip source 172.16.20.0 0.0.0.255 destination 172.16.10.0 0.0.0.255
rule 10 permit ip
acl number 3001
rule 5 permit ip source 172.16.20.0 0.0.0.255 destination 172.16.10.0 0.0.0.255
ipsec proposal test
ike peer test v2
pre-shared-key simple
remote-address 12.1.1.1
ipsec policy test 10 isakmp
security acl 3001
ike-peer test
proposal test
interface GigabitEthernet0/0/0
ip address 172.16.20.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 23.1.1.2 255.255.255.0
ipsec policy test
nat outbound 3000
ip route-static 0.0.0.0 0.0.0.0 23.1.1.1
網際網路的配置
sysname Internet
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
interface GigabitEthernet0/0/1
ip address 23.1.1.1 255.255.255.0
interface LoopBack100
ip address 100.100.100.100 255.255.255.0
interface LoopBack200
ip address 200.200.200.200 255.255.255.0
四、互通測試
主機上 ping 分支 上網
路由器上校驗
dis ike sa v2