H3C设备的ipsec_vpn主模式配置方法

IT1

H3C设备的ipsec_vpn主模式配置方法3台MSR3620路由器如下部署，RT1和RT2都做NAT实现内部网络

游客，本帖隐藏的内容需要积分高于 500 才可浏览，您当前积分为 0

上网（nat放在最后做），再此基础之上配置主模式的ipsec_vpn，实现内网互通。配置和前面版本不一样，稍微有点不同
拓扑大致如下：接口可能不一样



配置步骤：
1.配置安全ACL，两端互为对称
2.配置IPsec安全提议
3.配置IKE对等体
4.配置IPsec策略组，将前面的配置参数都加入，并应用在接口
5.最后配置私网路由走互联网接口



配置RT1：
第1步，配置acl
[RT1]acl advanced  3000
[RT1-acl-ipv4-adv-3000]rule 5 permit  ip source 192.168.40.0 0.0.0.255 destination 172.16.40.0 0.0.0.255
[RT1-acl-ipv4-adv-3000]quit


第2步，配置安全提议
[RT1]ipsec transform-set  rt1           //h3c不同版本是ipsec proposal rt1
[RT1-ipsec-transform-set-rt1]protocol  esp       //默认采用esp封装
[RT1-ipsec-transform-set-rt1]esp authentication-algorithm md5
[RT1-ipsec-transform-set-rt1]esp encryption-algorithm  3des-cbc
[RT1-ipsec-transform-set-rt1]quit


第3步，配置IKE对等体
[RT1]ike proposal   1111
[RT1-ike-proposal-1111]quit
[RT1]ike  profile ike1                 //配置一个ike协商名
[RT1-ike-profile-ike1]proposal 1111
[RT1-ike-profile-ike1]exchange-mode main        //默认采用主模式
[RT1-ike-profile-ike1]keychain  key1         //先设置好共享密钥的名称，后面具体设置，感觉配置太繁琐了
[RT1-ike-profile-ike1]match remote  identity address  78.30.21.21
[RT1-ike-profile-ike1]quit


[RT1]ike keychain key1
[RT1-ike-keychain-key1]match  local address  114.20.17.18
[RT1-ike-keychain-key1]pre-shared-key address  78.30.21.21 key  simple  123456    //创建共享密钥
[RT1-ike-keychain-key1]quit


第4步，配置ipsec policy策略
[RT1]ipsec policy rt1  1 isakmp            //手动来设置ipsec policy的具体参数
[RT1-ipsec-policy-isakmp-rt1-1]security acl  3000
[RT1-ipsec-policy-isakmp-rt1-1]ike-profile ike1
[RT1-ipsec-policy-isakmp-rt1-1]transform-set rt1
[RT1-ipsec-policy-isakmp-rt1-1]local-address 114.20.17.18
[RT1-ipsec-policy-isakmp-rt1-1]remote-addres 78.30.21.21
[RT1-ipsec-policy-isakmp-rt1-1]quit


在接口上配置，匹配上策略
[RT1]interface Serial 1/0
[RT1-Serial1/0]ipsec apply  policy  rt1


第五步，配置路由
[RT1]ip route-static 172.16.40.0 24 114.20.17.19       //下一跳最好写公网ip,写接口可能出现问题




配置RT2:
第1步，配置acl
[RT2]acl advanced  3000
[RT2-acl-ipv4-adv-3000]rule 5 permit  ip source 172.16.40.0 0.0.0.255 destination 192.168.40.0 0.0.0.255
[RT2-acl-ipv4-adv-3000]quit


第2步，配置安全提议
[RT2]ipsec transform-set  rt2           
[RT2-ipsec-transform-set-rt2]protocol  esp
[RT2-ipsec-transform-set-rt2]esp authentication-algorithm md5
[RT2-ipsec-transform-set-rt2]esp encryption-algorithm  3des-cbc
[RT2-ipsec-transform-set-rt2]quit


第3步，配置IKE对等体
[RT2]ike proposal   1111
[RT2-ike-proposal-1111]quit

[RT2]ike  profile ike2                 //配置一个ike协商名
[RT2-ike-profile-ike2]proposal 1111
[RT2-ike-profile-ike2]exchange-mode main
[RT2-ike-profile-ike2]keychain  key2         //先设置好共享密钥的名称，后面具体设置，感觉配置太繁琐了
[RT2-ike-profile-ike2]match remote  identity address  114.20.17.18
[RT2-ike-profile-ike2]quit


[RT2]ike keychain key2
[RT2-ike-keychain-key2]match  local address  78.30.21.21
[RT2-ike-keychain-key2]pre-shared-key address  114.20.17.18 key  simple  123456    //创建共享密钥
[RT2-ike-keychain-key2]quit


第4步，配置ipsec policy策略
[RT2]ipsec policy rt2  1 isakmp            //手动来设置ipsec policy的具体参数
[RT2-ipsec-policy-isakmp-rt2-1]security acl  3000
[RT2-ipsec-policy-isakmp-rt2-1]ike-profile ike2
[RT2-ipsec-policy-isakmp-rt2-1]transform-set rt2
[RT2-ipsec-policy-isakmp-rt2-1]local-address 78.30.21.21
[RT2-ipsec-policy-isakmp-rt2-1]remote-addres 114.20.17.18
[RT2-ipsec-policy-isakmp-rt2-1]quit


在接口上配置，匹配上策略
[RT2]interface Serial 1/0
[RT2-Serial1/0]ipsec apply  policy  rt2


第五步，配置路由
[RT2]ip route-static 192.168.40.0 24 78.30.21.22

-------------------至此两端基本配置完毕


[RT1]ping -a 192.168.40.254 172.16.40.254   //在RT1上触发主动去协商，下面协商成功截图







配置NAT:
[RT1]acl advanced  3010
[RT1-acl-ipv4-adv-3010]rule 5 deny  ip source  192.168.40.0 0.0.0.255 destination  172.16.40.0 0.0.0.255
[RT1-acl-ipv4-adv-3010]rule  100 permit  ip
[RT1-acl-ipv4-adv-3010]quit

[RT1]interface Serial 1/0
[RT1-Serial1/0]nat outbound 3010
RT2也是如此

RT1配置文件：


[RT1]display  current-configuration
#
version 7.1.075, Alpha 7571
#
sysname RT1
#
system-working-mode standard
xbar load-single
password-recovery enable
lpu-type f-series
#
vlan 1
#
interface Serial1/0
ip address 114.20.17.18 255.255.255.0
nat outbound 3010
ipsec apply policy rt1
#
interface Serial2/0
#
interface Serial3/0
#
interface Serial4/0
#
interface NULL0
#              
interface GigabitEthernet0/0
port link-mode route
combo enable copper
ip address 192.168.40.254 255.255.255.0
#              
interface GigabitEthernet0/1
port link-mode route
combo enable copper
#              
interface GigabitEthernet0/2
port link-mode route
combo enable copper
#              
interface GigabitEthernet5/0
port link-mode route
combo enable copper
#              
interface GigabitEthernet5/1
port link-mode route
combo enable copper
#              
interface GigabitEthernet6/0
port link-mode route
combo enable copper
#              
interface GigabitEthernet6/1
port link-mode route
combo enable copper
#              
scheduler logfile size 16
#              
line class aux
user-role network-operator
#              
line class console
user-role network-admin
#              
line class tty
user-role network-operator
#              
line class vty
user-role network-operator
#              
line aux 0     
user-role network-operator
#              
line con 0     
user-role network-admin
#              
line vty 0 63  
user-role network-operator
#              
ip route-static 0.0.0.0 0 114.20.17.19
ip route-static 172.16.40.0 24 114.20.17.19
#              
acl basic 2000
rule 0 permit
#              
acl advanced 3000
rule 5 permit ip source 192.168.40.0 0.0.0.255 destination 172.16.40.0 0.0.0.255
#              
acl advanced 3010
rule 5 deny ip source 192.168.40.0 0.0.0.255 destination 172.16.40.0 0.0.0.255
rule 100 permit ip
#              
domain system  
#              
domain default enable system
#              
role name level-0
description Predefined level-0 role
#              
role name level-1
description Predefined level-1 role
#              
role name level-2
description Predefined level-2 role
#              
role name level-3
description Predefined level-3 role
#              
role name level-4
description Predefined level-4 role
#              
role name level-5
description Predefined level-5 role
#              
role name level-6
description Predefined level-6 role
#              
role name level-7
description Predefined level-7 role
#              
role name level-8
description Predefined level-8 role
#              
role name level-9
description Predefined level-9 role
#              
role name level-10
description Predefined level-10 role
#              
role name level-11
description Predefined level-11 role
#              
role name level-12
description Predefined level-12 role
#              
role name level-13
description Predefined level-13 role
#              
role name level-14
description Predefined level-14 role
#              
user-group system
#              
ipsec transform-set rt1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#              
ipsec policy rt1 1 isakmp
transform-set rt1
security acl 3000
local-address 114.20.17.18
remote-address 78.30.21.21
ike-profile ike1
#              
ike profile ike1
keychain key1
match remote identity address 78.30.21.21 255.255.255.255
proposal 1111
#              
ike proposal 1111
#              
ike keychain key1
pre-shared-key address 78.30.21.21 255.255.255.255 key cipher $c$3$kPj80yy9UVgBee7hQaXB2Nn4BiSgAwpEoA==
#              
return         
[RT1]

lijun8064

dj19960804

学到了666