MSR系列路由器pppoe拨号接口配置IPSec功能案例.docVIP

MSR系列路由器拨号接口上配置IPSec功能的配置关键词：MSR;PPP;PAP;PPPoE;Client;Server;Dialer;IPSec;IKE一、组网需求：PPPoE Client和PPPoE Server通过PPPoE建立拨号关系，双方在拨号接口和虚模板上配置IPSec策略，使两边的私有数据得以加密传送设备清单：MSR系列路由器2台二、组网图：三、配置步骤：设备和版本：MSR系列、Version 5.20, Release 1509PPPoE_Client的配置# //配置拨号规则允许IP包通过 dialer-rule 1 ip permit#//配置IKE Peerike peer pppoeserver //共享身份密钥 pre-shared-key sunshine //对端地址 remote-address 1.1.1.1#//IPSec提议ipsec proposal pppoeserver#//IPSec策略ipsec policy pppoeserver 1 isakmp //指定ACL security acl 3000 //指定IKE Peerike-peer pppoeserver//指定IPSec提议 proposal pppoeserver#//ACL3000允许两个内部网络之间的通信acl number 3000 rule 0 permit ip source 192.168.0.0 0.0.0.255 destination 172.32.0.0 0.0.0.255#//拨号口的配置interface Dialer0 //链路协议为PPP link-protocol ppp //PAP认证配置 ppp pap local-user msr password simple msr //IP地址为PPP协商 ip address ppp-negotiate //拨号用户，可以任意配置 dialer user anyone //指定拨号规则即全局配置的Dialer-rule 1 dialer-group 1 //所属的拨号绑定组 dialer bundle 1 //配置IPSec策略 ipsec policy pppoeserver#interface GigabitEthernet0/0 port link-mode route //指定PPPoe-Client使用绑定组1 pppoe-client dial-bundle-number 1 combo enable copper#interface GigabitEthernet0/1 port link-mode route combo enable copper //内部网络接口 ip address 192.168.0.1 255.255.255.0# //默认路由指向拨号口0 ip route-static 0.0.0.0 0.0.0.0 Dialer0#PPPoE Server配置# //配置地址池0 ip pool 0 1.1.1.2 1.1.1.5#//配置IKE Peerike peer pppoeclient //共享身份密钥 pre-shared-key sunshine //指定对端地址范围 remote-address 1.1.1.2 1.1.1.5#//IPSec提议ipsec proposal pppoeclient#//IPSec策略ipsec policy pppoeclient 1 isakmp //指定ACL security acl 3000 //指定IKE Peerike-peer pppoeclient//指定IPSec提议 proposal pppoeclient#//PPP认证用户配置local-user msr //密码msr password simple msr //服务类型PPP service-type ppp#acl number 3000 //私网间通信的Rule rule 0 permit ip source 172.32.0.0 0.0.0.255 destination 192.168.0.0 0.0.0.255#//创建虚模板0interface Virtual-Template0 //ppp认证类型 ppp authentication-mode pap //指定对端地址池，此处为全局配置的地址池0 remote address pool //虚模板地址 ip address 1.1.1.1 255.255.255.0 //绑定IPSec策略 ipsec policy pppoeclient#interface GigabitEthernet0/0 port link-