IPSEC VPN 站点到站点配置

《IPSEC VPN 站点到站点配置》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、实验需求USG-1和USG-2模拟企业边缘设备，分别在2台设备上配置NAT和IPsecVPN实现2边私网可以通过VPN互相通信实验配置R1IP地址配置省略USG-1配置[USG-1]firewallzonetrust     //配置trust区域[USG-1-zone-trust]addinterfaceg0/0/0  //将接口加入trust区域[USG-1-zone-trust]quit[USG-1]firewallzoneuntrust     //配置untrust区域[USG-1-zone-untrust]addintg0/0/1 

2、    //将接口加入untrust区域[USG-1-zone-untrust]quit[USG-1]intg0/0/0[USG-1-GigabitEthernet0/0/0]ipadd192.168.10.124[USG-1-GigabitEthernet0/0/0]intg0/0/1[USG-1-GigabitEthernet0/0/1]ipadd11.0.0.224[USG-1-GigabitEthernet0/0/1]quit[USG-1]iproute-static0.0.0.00.0.0.011.0.0.1 //配置默认路由上公网[

3、USG-1]nat-policyinterzonetrustuntrustoutbound //进入trust到untrust区域out方向的策略视图[USG-1-nat-policy-interzone-trust-untrust-outbound]policy1  //创建一个策略[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policysource192.168.10.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outb

4、ound-1]policydestination192.168.20.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outbound-1]actionno-nat //以上三条命令意思是不允许将源为192.168.10.0/24网段目标为192.168.20.0/24网段的数据包进行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-1]quit[USG-1-nat-policy-interzone-trust-untrust-ou

5、tbound]policy2 //创建策略2[USG-1-nat-policy-interzone-trust-untrust-outbound-2]actionsource-nat//允许对源IP进行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-2]easy-ipg0/0/1//对接口G0/0/1地址复用[USG-1-nat-policy-interzone-trust-untrust-outbound-2]quit[USG-1-nat-policy-interzone-trust

6、-untrust-outbound]quit---------------------------阶段一-----------------------------------------------------[USG-1]ikeproposal1  //配置一个安全提议[USG-1-ike-proposal-1]authentication-methodpre-share //配置IKE认证方式为预共享密钥[USG-1-ike-proposal-1]authentication-algorithmsha1 //配置IKE认证算法为sha1[U

7、SG-1-ike-proposal-1]integrity-algorithmaes-xcbc-96 //配置IKE完整性算法[USG-1-ike-proposal-1]dhgroup2 //配置IKE密钥协商DH组[USG-1-ike-proposal-1]quit[USG-1]ikepeerUSG-2      //创建一个IKE对等体名字为USG-2[USG-1-ike-peer-usg-2]pre-shared-keyabc123  //配置预共享密钥[USG-1-ike-peer-usg-2]remote-address12.0.0.

8、2 //配置对等体IP地址[USG-1-ike-peer-usg-2]ike-proposal1   //调用ike安全提议[USG-1-ike-pe