H3C or Cisco

《H3C or Cisco》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、CISCO设备（PIX/ASA/ROUTER）:外网口ip：1.1.1.1  内网服务器：192.168.1.1H3Csecpath：外网口ip：2.2.2.2  内网服务器：192.168.2.2通过ipsecvpn，允许两台服务器之间通讯CISCO配置：#步骤1cryptoisakmppolicy10authenticationpre-shareencryption3deshashshagroup2lifetime86400#步骤2cryptoipsectransform-setMysetesp-desesp-sha-hmaccryptomapMyvpn1matchadd

2、ressVPNcryptomapMyvpn1setpeer2.2.2.2cryptomapMyvpn1settransform-setMysetcryptomapMyvpninterfaceoutsidecryptoisakmpidentityaddresscryptoisakmpenableoutsidecryptoisakmppolicy10authenticationpre-shareencryption3deshashshagroup2lifetime86400tunnel-group2.2.2.2typeipsec-l2ltunnel-group2.2.2.2ips

3、ec-attributespre-shared-key123456#定义感兴趣流量access-listVPNextendedpermitiphost192.168.1.1host192.168.2.2H3C的配置：#ikepeerpeermtompre-shared-key123456remote-address1.1.1.1local-address2.2.2.2##对应cisco的步骤1（蓝色标记的参数两边必须一致）ikeproposal1authentication-algorithmshaauthentication-methodpre-shareencryptio

4、n-algorithm3des-cbcdhgroup2saduration86400##对应cisco的步骤2（蓝色标记的参数两边必须一致）ipsecproposalpromtom  encapsulation-modetunneltransformespespencryption-algorithm3desespauthentication-algorithmsha1##ipsecpolicypolicymtom10isakmpsecurityacl3333ike-peerpeermtomproposalpromtom##定义感兴趣流量（必须与cisco中定义的感兴趣流量互

5、为镜像）aclnumber3333rule0permitipsource192.168.2.20destination192.168.1.10rule5denyip##将内网服务器地址从nat转换列表中去除(应尽量放在第一行)假设防火墙上用于NAT转换的acl为2000：aclnumber2000rule0denysource192.168.2.20……#配置到对方内网服务器的静态路由iproute-static192.168.1.132  g1/0      (g1/0为防火墙外网口)#在外网接口上应用ipsec#intg1/0ipsecpolicypolicymtom配置

6、完成后，在防火墙上用以下命令查看vpn是否建立：disikesa  ；若ike协商成功，再用以下命令查看disipsecsa  ；若有输出信息，是否成功你一看就知道了。哈哈