Secpath防火墙中心分支机构ipsecVPN配置.doc

配置如下： SecpathB： [H3C]disp cu # version 5.20, Release 5135 # sysname H3C # undo voice vlan mac-address 00e0-bb00-0000 # ike local-name zb # domain default enable system # dns resolve dns server 8 # port-security enable # undo alg dns undo alg rtsp undo alg h323 undo alg sip undo alg sqlnet undo alg pptp undo alg ils undo alg nbt undo alg msn undo alg qq undo alg tftp undo alg sccp undo alg gtp # session synchronization enable # //对端IP地址之间建立隧道 acl number 3000 rule 0 permit ip source 55 destination 55 rule 5 permit ip source 55 destination 55 rule 10 deny ip //指定IP地址可以通过NAT访问指定地址 acl number 3100 rule 0 deny ip source 55 destination 55 rule 2 permit ip source 55 destination 4 0 rule 4 permit ip source 55 destination 28 0 rule 6 permit ip source 55 destination 12 0 rule 10 deny ip # vlan 1 # domain system access-limit disable state active idle-cut disable self-service-url disable # pki domain default crl check disable # ike peer 1 exchange-mode aggressive pre-shared-key cipher $c$3$RmA7r0O9p1dtNcU0588t7/O+C/NvZgyA id-type name remote-name fz local-address 6 local-name zb # ipsec transform-set 1 encapsulation-mode tunnel transform esp esp authentication-algorithm md5 esp encryption-algorithm des # ipsec policy map1 10 isakmp security acl 3000 ike-peer 1 transform-set 1 # user-group system group-attribute allow-guest # local-user admin password cipher $c$3$zLM0+AeTLSxIyJvo/P7Xg4tK8tXiPX4t authorization-attribute level 3 service-type telnet service-type web # cwmp undo cwmp enable # interface NULL0 # interface GigabitEthernet0/0 port link-mode route ip address # interface GigabitEthernet0/1 port link-mode route # interface GigabitEthernet0/2 port link-mode route # interface GigabitEthernet0/3 port link-mode route # interface GigabitEthernet0/4 port link-mode route nat outbound 3100 ip address 6 24 ipsec policy map1 # vd Root id 1 # zone name Management id 0 priority 10