设为首页收藏本站language 语言切换
开启辅助访问 切换到宽版

鸿鹄论坛

 找回密码
 论坛注册

QQ登录

先注册再绑定QQ

鸿鹄论坛»鸿鹄论坛 › ≡□≡华为认证≡□≡ › HCIA学习资料 › 华为ipsec怎么确认是配置成功的
12下一页
返回列表 发新帖
查看: 4020|回复: 15
收起左侧

[其他] 华为ipsec怎么确认是配置成功的

[复制链接]
梦幻天崖
发表于 2017-9-9 22:04:33 | 显示全部楼层 |阅读模式
5鸿鹄币
华为ipsec怎么确认是配置成功的，ping通即可吗，还有这个ping 1.1.1.1 source 2.2.2.2不能用啊，这个正确命令是神马，求大神

最佳答案

ackca

查看完整内容

我试过了，没问题， 还有不要用主动模式
回复

使用道具 举报

ackca
发表于 2017-9-9 22:04:34 | 显示全部楼层
我试过了，没问题，
还有不要用主动模式

评分

参与人数 1好评度 +1 收起 理由
梦幻天崖 + 1 很给力!

查看全部评分

沙发 2017-9-9 22:04:34 回复 收起回复
回复

使用道具 举报

ackca
发表于 2017-9-9 22:27:52 | 显示全部楼层
有路由吗？如果IPSec确认没问题，那就是路由的问题
板凳 2017-9-9 22:27:52 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-10 13:51:47 | 显示全部楼层
ackca 发表于 2017-9-9 22:27
有路由吗？如果IPSec确认没问题，那就是路由的问题

ping通问题已解决，请问ipsec怎么验证的
地板 2017-9-10 13:51:47 回复 收起回复
回复

使用道具 举报

ackca
发表于 2017-9-10 14:32:17 | 显示全部楼层
梦幻天崖 发表于 2017-9-10 13:51
ping通问题已解决，请问ipsec怎么验证的

通了基本上就差不多了，确认的话再看看display ike sa、display ipsec sa brief
5# 2017-9-10 14:32:17 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-10 14:56:54 | 显示全部楼层
ackca 发表于 2017-9-10 14:32
通了基本上就差不多了，确认的话再看看display ike sa、display ipsec sa brief

只能看到display ike sa的内容，display ipsec sa brief没有内容显示，这算成功吗
6# 2017-9-10 14:56:54 回复 收起回复
回复

使用道具 举报

ackca
发表于 2017-9-10 16:33:27 | 显示全部楼层
梦幻天崖 发表于 2017-9-10 14:56
只能看到display ike sa的内容，display ipsec sa brief没有内容显示，这算成功吗

当然不成功
7# 2017-9-10 16:33:27 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-10 16:52:55 | 显示全部楼层
ackca 发表于 2017-9-10 16:33
当然不成功


ipsec proposal 1
encapsulation-mode tunnel
transform esp
esp encryption-algorithm des
esp authentication-algorithm md5

ike proposal
authentication-algorithm md5
authentication-method pre-share
encryption-algorithm des-cbc

ike peer 1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#

remote-name jie
remote-address 12.1.1.1

ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1

interface Serial0/0/1
link-protocol ppp
ip address 12.1.1.2 255.255.255.0
ipsec policy mao
大哥请看下我的配置，这有什么错吗
5]`0}ZAQF@3C{0`PX)G2``L.png
8# 2017-9-10 16:52:55 回复 收起回复
回复

使用道具 举报

ackca
发表于 2017-9-10 20:14:22 | 显示全部楼层
梦幻天崖 发表于 2017-9-10 16:52
ipsec proposal 1
encapsulation-mode tunnel
transform esp

你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。
9# 2017-9-10 20:14:22 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:04:00 | 显示全部楼层
ackca 发表于 2017-9-10 20:14
你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。

R1
sysname r1
#
ike local-name mao
#
acl number 3000
rule 0 permit ip source 11.1.1.0 0.0.0.255 destination 13.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name jie
remote-address 12.1.1.2
#
ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ip address 12.1.1.1 255.255.255.0
#
interface Serial0/0/1
link-protocol ppp
ipsec policy mao
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 11.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return

[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]dis       
[r1]dis ips       
[r1]dis ipsec sa
No Security Associations established.
[r1]
[r1]dis cu
#
sysname r1
#
ike local-name mao
#
acl number 3000
rule 0 permit ip source 11.1.1.0 0.0.0.255 destination 13.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name jie
remote-address 12.1.1.2
#
ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ip address 12.1.1.1 255.255.255.0
#
interface Serial0/0/1
link-protocol ppp
ipsec policy mao
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 11.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return

R2
sysname r2
#
ike local-name jie
#
acl number 3000
rule 0 permit ip source 13.1.1.0 0.0.0.255 destination 11.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name mao
remote-address 12.1.1.1
#
ipsec policy jie 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ipsec policy jie
#
interface Serial0/0/1
link-protocol ppp
ip address 12.1.1.2 255.255.255.0
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 13.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.1
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return
请过目
10# 2017-9-11 09:04:00 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:04:07 | 显示全部楼层
ackca 发表于 2017-9-10 20:14
你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。

R1
sysname r1
#
ike local-name mao
#
acl number 3000
rule 0 permit ip source 11.1.1.0 0.0.0.255 destination 13.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name jie
remote-address 12.1.1.2
#
ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ip address 12.1.1.1 255.255.255.0
#
interface Serial0/0/1
link-protocol ppp
ipsec policy mao
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 11.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return

[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]
[r1]dis       
[r1]dis ips       
[r1]dis ipsec sa
No Security Associations established.
[r1]
[r1]dis cu
#
sysname r1
#
ike local-name mao
#
acl number 3000
rule 0 permit ip source 11.1.1.0 0.0.0.255 destination 13.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name jie
remote-address 12.1.1.2
#
ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ip address 12.1.1.1 255.255.255.0
#
interface Serial0/0/1
link-protocol ppp
ipsec policy mao
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 11.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return

R2
sysname r2
#
ike local-name jie
#
acl number 3000
rule 0 permit ip source 13.1.1.0 0.0.0.255 destination 11.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name mao
remote-address 12.1.1.1
#
ipsec policy jie 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ipsec policy jie
#
interface Serial0/0/1
link-protocol ppp
ip address 12.1.1.2 255.255.255.0
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 13.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.1
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return
请过目
11# 2017-9-11 09:04:07 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:05:45 | 显示全部楼层
ackca 发表于 2017-9-10 20:14
你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。

请过目
R1
sysname r1
#
ike local-name mao
#
acl number 3000
rule 0 permit ip source 11.1.1.0 0.0.0.255 destination 13.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name jie
remote-address 12.1.1.2
#
ipsec policy mao 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ip address 12.1.1.1 255.255.255.0
#
interface Serial0/0/1
link-protocol ppp
ipsec policy mao
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 11.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return


R2sysname r2
#
ike local-name jie
#
acl number 3000
rule 0 permit ip source 13.1.1.0 0.0.0.255 destination 11.1.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha1
#
ike proposal 1
authentication-algorithm md5
#
ike peer 1 v1
exchange-mode aggressive
pre-shared-key cipher gg^dP=F.[>=H)H2[EInB~.2#
remote-name mao
remote-address 12.1.1.1
#
ipsec policy jie 1 isakmp
security acl 3000
ike-peer 1
proposal 1
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#
local-user admin service-type http
#
firewall zone Local
priority 16
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Serial0/0/0
link-protocol ppp
ipsec policy jie
#
interface Serial0/0/1
link-protocol ppp
ip address 12.1.1.2 255.255.255.0
#
interface Serial0/0/2
link-protocol ppp
#
interface Serial0/0/3
link-protocol ppp
#
interface GigabitEthernet0/0/0
ip address 13.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
wlan
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.1
#
user-interface con 0
user-interface vty 0 4
user-interface vty 16 20
#
return



12# 2017-9-11 09:05:45 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:11:41 | 显示全部楼层
ackca 发表于 2017-9-10 20:14
你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。

接口都已配上ipsec policy ，还是显示不出ipsec sa
13# 2017-9-11 09:11:41 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:11:51 | 显示全部楼层
ackca 发表于 2017-9-10 20:14
你发全了好吧，两个设备，感兴趣流量，路由，关键的地方都没有。。。。。

接口都已配上ipsec policy ，还是显示不出ipsec sa
14# 2017-9-11 09:11:51 回复 收起回复
回复

使用道具 举报

梦幻天崖
 楼主| 发表于 2017-9-11 09:17:03 | 显示全部楼层
梦幻天崖 发表于 2017-9-11 09:11
接口都已配上ipsec policy ，还是显示不出ipsec sa

大神，方便加一下你的QQ或者微信吗
15# 2017-9-11 09:17:03 回复 收起回复
回复

使用道具 举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 论坛注册

本版积分规则

QQ|Archiver|手机版|小黑屋|sitemap|鸿鹄论坛 ( 京ICP备14027439号 )  

GMT+8, 2025-4-26 09:25 , Processed in 0.134756 second(s), 26 queries , Redis On.  

  Powered by Discuz!

  © 2001-2025 HH010.COM

快速回复 返回顶部 返回列表