[华为路由器ipsec.docVIP

华为路由器ipsec-vpn实战-公网全静态ip2013-11-19 18:06:09#配置访问控制列表，定义vpn的数据流，注意在没有建立vpn之前，两个客户端是不通的。acl number 3000 rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 172.16.10.0 0.0.0.255 rule 10 deny ip #创建安全提议tran1，默认是隧道模式和esp的封装，加密算法是des，总之两端一样就行了。ipsec proposal tran1esp authentication-algorithm sha1#配置对等体，共享密钥，对端的ip地址ike peer peer v2pre-shared-key simpleremote-address 222.1.1.2#创建安全策略map1，ipsec policy map1 10 isakmpsecurity acl 3000 引用aclike-peer peer 引用ike的对待体proposal tran1 引用安全提议#在wan口上应用安全策略。#interface GigabitEthernet0/0/0ip address 211.1.1.2 255.255.255.0 ipsec policy map1#中间的路由器只需要接口配个ip即可，模拟公网。对端的路由器配置参考以上配置。检测：在client1上ping对端的client2： PCping 172.16.10.10 Ping 172.16.10.10: 32 data bytes, Press Ctrl_C to breakFrom 172.16.10.10: bytes=32 seq=1 ttl=127 time=16 msFrom 172.16.10.10: bytes=32 seq=2 ttl=127 time=31 msFrom 172.16.10.10: bytes=32 seq=3 ttl=127 time=15 msFrom 172.16.10.10: bytes=32 seq=4 ttl=127 time=15 msFrom 172.16.10.10: bytes=32 seq=5 ttl=127 time=15 ms遗憾的是在vpn路由器上无法进行这样的ping。查看安全联盟 [r1]dis ipsec sa ===============================Interface: GigabitEthernet0/0/0Path MTU: 1500 注意vpn经常因为mtu的原因导致不稳定，可以修改适合的mtu=============================== -----------------------------IPSec policy name: map1Sequence number : 10Acl Group : 3000Acl rule : 5Mode : ISAKMP-----------------------------Connection ID : 8Encapsulation mode: TunnelTunnel local : 211.1.1.2Tunnel remote : 222.1.1.2Flow source : 192.168.10.0/255.255.255.0 0/0Flow destination : 172.16.10.0/255.255.255.0 0/0Qos pre-classify : Disable [Outbound ESP SAs] SPI: 197300795 (0xbc2923b)Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-SHA1SA remaining key duration (bytes/sec): 1887434148/2480Max received sequence-number: 30Anti-replay window size: 32UDP encapsulation used for NAT traversal: N查看安全提议，这里没有建立成vpn也能查看 [r1]dis ipsec proposal Number of proposals: 1 IPSec proposal name: tran1 Encapsulation mode: Tunnel Transform : esp-newESP protocol : Au