eNSP桥接现网模拟IPSec VPN.docVIP

eNSP桥接现网模拟IPSec VPN 网络拓扑 如下图所示，FW1和FW2模拟公司分部1和分部2的出口网关，通过在FW1和FW2上部署IPSec VPN，实现分部互访的同时还可以访问互联网。 注：（1）互联网：无线网络共享→本地loopback0网卡→桥接到eNSP。 （2）PC1、PC2：本地loopback1网卡→桥接到eNSP。 （3）这里多处使用NAT的原因是，有些家用路由器不支持配置静态路由。 2、现网配置 # sysname fw1 # acl number 3000 rule 5 permit ip source 55 destination 55 # ipsec proposal fw1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 1 encryption-algorithm aes-256 dh group2 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer fw1 pre-shared-key nihao ike-proposal 1 remote-address # ipsec policy fw1 1 isakmp security acl 3000 ike-peer fw1 proposal fw1 # interface GigabitEthernet1/0/0 undo shutdown ip address # interface GigabitEthernet1/0/1 undo shutdown ip address 52 ipsec policy fw1 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/1 # ip route-static # security-policy default action permit # nat-policy rule name 1 source-zone trust destination-zone untrust source-address 24 destination-address 24 action no-nat rule name 2 source-zone trust destination-zone untrust source-address 24 action nat easy-ip ------------------------------------------------------- # sysname fw3 # interface GigabitEthernet1/0/0 undo shutdown ip address dhcp-alloc # interface GigabitEthernet1/0/1 undo shutdown ip address 52 # interface GigabitEthernet1/0/2 undo shutdown ip address 52 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/1 add interface GigabitEthernet1/0/2 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/0 # security-policy default action permit # nat-policy rule name 1 source-zone trust destination-zone untrust source-address 30 source-address 30 action nat easy-ip ---------------------------------------------- # sysname fw2 # acl number 3000 rule 5 permit ip source 55 destination 55 # ipsec p