华为路由器多台设备IPSec vpn隧道配置案例

《华为路由器多台设备IPSec vpn隧道配置案例》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、组网Topo：本例中AR3需要同时和AR1及AR2建立IPSec隧道，这时，AR1配置isakmppolicy，指定remote-address为AR3；AR2配置isakmppolicy，指定remote-address为AR3；AR3配置为template-policy，不需要配置remote-address。AR3上可以配置ACL也可以不用配置ACL，如果AR3配置了ACL，则必须要指定distination，否则协商会出问题，建议AR3上不要配置IPSecACL，ACL可以从AR1和AR2上协商过来。AR1配置：aclnum

2、ber3000rule20permitipsource188.188.188.1880destination189.189.189.1890#ipsecproposal188#ikeproposal1#ikepeer191v2pre-shared-keyhuaweiike-proposal1remote-address192.168.1.191#ipsecpolicy1881isakmpsecurityacl3000ike-peer191proposal188#interfaceEthernet2/0/0ipaddress192.1

3、68.1.188255.255.255.0ipsecpolicy188#interfaceLoopBack0ipaddress188.188.188.188255.255.255.255#AR2配置：aclnumber3000rule20permitipsource189.189.189.1890destination188.188.188.1880#ipsecproposal189#ikeproposal1#ikepeer191v2pre-shared-keyhuaweiike-proposal1remote-address192

4、.168.1.191#ipsecpolicy1891isakmpsecurityacl3000ike-peer191proposal189#interfaceGigabitEthernet0/0/2ipaddress192.168.1.189255.255.255.0ipsecpolicy189#interfaceLoopBack0ipaddress189.189.189.189255.255.255.255#AR3配置：ipsecproposal191#ikeproposal1#ikepeer188&189v2pre-shared

5、-keyhuaweiike-proposal1#ipsecpolicy-template1911ike-peer188&189proposal191#ipsecpolicyar1isakmptemplate191#interfaceEthernet3/0/0ipaddress192.168.1.191255.255.255.0ipsecpolicyar#interfaceLoopBack0ipaddress191.191.191.191255.255.255.255#在AR3上可以看到IPSec的协商情况：<2220-191>dis

6、pikesav2Conn-IDPeerVPNFlag(s)Phase---------------------------------------------------------------61192.168.1.1890RD259192.168.1.1890RD162192.168.1.1880RD260192.168.1.1880RD1FlagDescription:RD--READYST--STAYALIVERL--REPLACEDFD--FADINGTO--TIMEOUTHRT--HEARTBEATLKG--LASTKN

7、OWNGOODSEQNO.BCK--BACKEDUP<2220-191>dispipsecsa===============================Interface:Ethernet3/0/0PathMTU:1500===============================-----------------------------IPSecpolicyname:"ar"Sequencenumber:1Mode:Template-----------------------------ConnectionID:61Enc

8、apsulationmode:TunnelTunnellocal:192.168.1.191Tunnelremote:192.168.1.189Flowsource:188.188.188.188/255.255.255.2550/0