华为路由器ipsec

《华为路由器ipsec》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、华为路由器ipsec-vpn实战-公网全静态ip2013-11-1918:06:09#配置访问控制列表，定义vpn的数据流，注意在没有建立vpn之前，两个客户端是不通的。aclnumber3000rule5permitipsource192.168.10.00.0.0.255destination172.16.10.00.0.0.255rule10denyip#创建安全提议tran1，默认是隧道模式和esp的封装，加密算法是des，总之两端一样就行了。ipsecproposaltran1espauthentication-algorithmsha1#配置对等体，共享密钥

2、，对端的ip地址ikepeerpeerv2pre-shared-keysimple12345678remote-address222.1.1.2#创建安全策略map1，ipsecpolicymap110isakmpsecurityacl3000引用aclike-peerpeer引用ike的对待体proposaltran1引用安全提议#在wan口上应用安全策略。#interfaceGigabitEthernet0/0/0ipaddress211.1.1.2255.255.255.0ipsecpolicymap1#中间的路由器只需要接口配个ip即可，模拟公网。对端的路由器配

3、置参考以上配置。检测：在client1上ping对端的client2：PC>ping172.16.10.10Ping172.16.10.10:32databytes,PressCtrl_CtobreakFrom172.16.10.10:bytes=32seq=1ttl=127time=16msFrom172.16.10.10:bytes=32seq=2ttl=127time=31msFrom172.16.10.10:bytes=32seq=3ttl=127time=15msFrom172.16.10.10:bytes=32seq=4ttl=127time=15msFro

4、m172.16.10.10:bytes=32seq=5ttl=127time=15ms遗憾的是在vpn路由器上无法进行这样的ping。查看安全联盟[r1]disipsecsa===============================Interface:GigabitEthernet0/0/0PathMTU:1500注意vpn经常因为mtu的原因导致不稳定，可以修改适合的mtu===============================-----------------------------IPSecpolicyname:"map1"Sequencenumber:

5、10AclGroup:3000Aclrule:5Mode:ISAKMP-----------------------------ConnectionID:8Encapsulationmode:TunnelTunnellocal:211.1.1.2Tunnelremote:222.1.1.2Flowsource:192.168.10.0/255.255.255.00/0Flowdestination:172.16.10.0/255.255.255.00/0Qospre-classify:Disable[OutboundESPSAs]SPI:197300795(0xbc29

6、23b)Proposal:ESP-ENCRYPT-DES-64ESP-AUTH-SHA1SAremainingkeyduration(bytes/sec):1887434148/2480Maxreceivedsequence-number:30Anti-replaywindowsize:32UDPencapsulationusedforNATtraversal:N查看安全提议，这里没有建立成vpn也能查看[r1]disipsecproposalNumberofproposals:1IPSecproposalname:tran1Encapsulationmode:Tunn

7、elTransform:esp-newESPprotocol:AuthenticationSHA1-HMAC-96EncryptionDES查看安全策略[r1]disipsecpolicy===========================================IPSecpolicygroup:"map1"Usinginterface:GigabitEthernet0/0/0===========================================Sequencenumber:10Securitydataflow: