Antecedentes de las necesidades del usuario.
La sede de Yulin y la sucursal de Xi'an solicitaron dos IP de red pública y ahora necesitan construir IPsecPN para realizar la intercomunicación de red privada, es decir, 192.168.1.0 accede a 192.168.2.0; (razones de CSDN, no se pueden escribir palabras clave)
La sede y las sucursales 192.168.1.0-192.168.2.0 necesitan acceder a la red pública para probar 12.12.12.12;
Mapa de topología de red
Ideas de configuración
Configure las direcciones IP en la sede y las sucursales respectivamente, abra la intranet y establezca la ruta predeterminada a la red pública;
Darse cuenta de los requisitos de acceso a Internet de los usuarios de la intranet, utilizando la conversión NAT;
Cree IPsec en ambos extremos, llame y finalmente realice la rama de acceso;
Proceso de código experimental
El código de la red pública es demasiado simple y no se mostrará, solo configure la dirección IP de acuerdo con el diagrama
Sede de YL
<Huawei>
<Huawei>sy
[Huawei]undo info-center enable
[Huawei]sysname YL
[YL]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[YL]interface GigabitEthernet 0/0/1
[YL-GigabitEthernet0/0/1]ip address 192.168.1.1 24
[YL-GigabitEthernet0/0/1]dhcp select interface
[YL-GigabitEthernet0/0/1]quit
[YL]interface GigabitEthernet 0/0/0
[YL-GigabitEthernet0/0/0]ip ad
[YL-GigabitEthernet0/0/0]ip address 1.1.1.1 24
[YL-GigabitEthernet0/0/0]quit
[YL]
[YL]
[YL]
[YL-acl-adv-3000]rule deny ip destination 192.168.2.0 0.0.0.255
[YL-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255
[YL-acl-adv-3000]quit
[YL]
[YL]
[YL]int
[YL]interface g
[YL]interface GigabitEthernet 0/0/0
[YL-GigabitEthernet0/0/0]nat outbound 3000
[YL-GigabitEthernet0/0/0]quit
[YL]
[YL]ip route-static 0.0.0.0 0 1.1.1.2
[YL]acl 3001
[YL-acl-adv-3001]rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
[YL]ipsec proposal yl
[YL-ipsec-proposal-yl]esp authentication-algorithm sha2-256
[YL-ipsec-proposal-yl]esp encryption-algorithm aes-128
[YL-ipsec-proposal-yl]quit
[YL]ipsec policy yl 10 manual
[YL-ipsec-policy-manual-yl-10]security acl 3001
[YL-ipsec-policy-manual-yl-10]proposal yl
[YL-ipsec-policy-manual-yl-10]tunnel local 1.1.1.1
[YL-ipsec-policy-manual-yl-10]tunnel remote 2.2.2.1
[YL-ipsec-policy-manual-yl-10]sa spi inbound esp 12345
[YL-ipsec-policy-manual-yl-10]sa spi outbound esp 54321
[YL-ipsec-policy-manual-yl-10]sa string-key inbound esp cipher huawei.com
[YL-ipsec-policy-manual-yl-10]sa string-key outbound esp cipher huawei.com
[YL-ipsec-policy-manual-yl-10]quit
[YL]interface GigabitEthernet 0/0/0
[YL-GigabitEthernet0/0/0]ipsec policy yl
[YL-GigabitEthernet0/0/0]quitSucursal XIAN
<Huawei>sy
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname XIAN
[XIAN]dhc enable //开启DHCP
Info: The operation may take a few seconds. Please wait for a moment.done.
[XIAN]un
[XIAN]undo in en
Info: Information center is disabled.
[XIAN]interface GigabitEthernet 0/0/0
[XIAN-GigabitEthernet0/0/0]ip ad
[XIAN-GigabitEthernet0/0/0]ip address 2.2.2.1 24
[XIAN-GigabitEthernet0/0/0]quit
[XIAN]interface GigabitEthernet 0/0/1
[XIAN-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[XIAN-GigabitEthernet0/0/1]dhcp select interface
[XIAN-GigabitEthernet0/0/1]quit
[XIAN]
[XIAN]acl 3000 //为私网用户开启NAT转换，使其可以访问公网，也就是图中loopback地址，12.12.12.12
[XIAN-acl-adv-3000]rule deny ip destination 192.168.1.0 0.0.0.255 //访问私网192.168.1.0不进行NAT转换
[XIAN-acl-adv-3000]rule permit ip source 192.168.2.0 0.0.0.255//允许192.168.1.0 私网访问互联网
[XIAN-acl-adv-3000]quit
[XIAN]interface GigabitEthernet 0/0/0
[XIAN-GigabitEthernet0/0/0]nat outbound 3000 //出口调用策略
[XIAN-GigabitEthernet0/0/0]quit
[XIAN]ip route-static 0.0.0.0 0 2.2.2.2 //默认路由到公网
[XIAN]
[XIAN]
[XIAN]
[XIAN]acl 3001
[XIAN-acl-adv-3001]rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 //定义需要保护的数据
[XIAN-acl-adv-3001]quit
[XIAN]ipsec proposal xian //创建安全提议，名称“xian”
[XIAN-ipsec-proposal-xian]esp encryption-algorithm aes-128
[XIAN-ipsec-proposal-xian]esp authentication-algorithm sha2-256
[XIAN-ipsec-proposal-xian]quit
[XIAN]ipsec policy xian 10 manual //创建IPsec策略，名称xian,编号10
[XIAN-ipsec-policy-manual-xian-10]security acl 3001 //调用安全策略
[XIAN-ipsec-policy-manual-xian-10]proposal xian //调用安全提议
[XIAN-ipsec-policy-manual-xian-10]tunnel remote 1.1.1.1 //设置隧道终点IP
[XIAN-ipsec-policy-manual-xian-10]tunnel local 2.2.2.1 //设置隧道起点IP
[XIAN-ipsec-policy-manual-xian-10]sa spi inbound esp 54321 //SPI密钥，和总部密钥相反
[XIAN-ipsec-policy-manual-xian-10]sa spi outbound esp 12345//SPI密钥，和总部密钥相反
[XIAN-ipsec-policy-manual-xian-10]sa string-key inbound esp cipher huawei.com
[XIAN-ipsec-policy-manual-xian-10]sa string-key outbound esp cipher huawei.com
[XIAN-ipsec-policy-manual-xian-10]quit
[XIAN]interface GigabitEthernet 0/0/0 //出口下调用IPsec策略
[XIAN-GigabitEthernet0/0/0]ipsec policy xian
[XIAN-GigabitEthernet0/0/0]quit
[XIAN]
prueba
prueba de captura de paquetes
