IPSEC点到多点（SA+NAT穿越）策略模板方式成功配置

 

 

IPSEC点到多点（SA+NAT穿越）策略模板方式成功配置

 

USG5500A 与USG5500C、USG5500D建立IPSEC VPN Tunnel，其中USG5500C穿越USG5500B NAT；USG5500A 、USG5500D  undo nat traversal。

ISP配置（用路由器模仿Internet）

<ISP>dis cur

#

sysname ISP

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipherxUpvP4d*n"ECB7Ie7'/)`WB#

 local-user admin service-type http

#

firewall zone permit

#

firewall zone Local

 priority 16

#

interface Ethernet0/0/0

#

interface Ethernet0/0/1

#

interface Serial0/0/0

 link-protocol ppp

#

interface Serial0/0/1

 link-protocol ppp

#

interface Serial0/0/2

 link-protocol ppp

#

interface Serial0/0/3

 link-protocol ppp

#

interface GigabitEthernet0/0/0

#

interface GigabitEthernet0/0/1

 ipaddress 200.0.0.2 255.255.255.0

#

interface GigabitEthernet0/0/2

 ipaddress 200.0.1.2 255.255.255.0

#

interface GigabitEthernet0/0/3

 ip address 200.0.3.2 255.255.255.0

#

wlan

#

interface NULL0

#

ospf 1

 import-route direct

 import-route static

 area0.0.0.0

 network 200.0.0.0 0.0.0.255

 network 200.0.1.0 0.0.0.255

 network 200.0.3.0 0.0.0.255

#

ip route-static 10.0.0.0 255.255.255.0200.0.0.1

ip route-static 10.0.1.0 255.255.255.0200.0.1.1

ip route-static 10.0.2.0 255.255.255.0200.0.3.1

#

user-interface con 0

user-interface vty 0 4

user-interface vty 16 20

#

return

<ISP>

总部防火墙FWA配置

<FWA>dis cur

19:37:14 2014/12/10

#

stp region-configuration

 region-name 30eca215b04c

 active region-configuration

#

acl number 3000

 rule5 permit ip source 10.0.0.0 0.0.0.255 destination 10.0.1.0 0.0.0.255

 rule10 permit ip source 10.0.0.0 0.0.0.255 destination 10.0.2.0 0.0.0.255

#

ike proposal 10

#

ike peer a

 exchange-mode aggressive

 pre-shared-key%$%$@s6v2,mfdGWd,xKf"%H6VSJA%$%$   (注：密码是“Huawei”)

 ike-proposal 10

 local-id-type fqdn

 undonat traversal

#

ipsec proposal tran1

#

ipsec policy-template map1tmp 10

 security acl 3000

 ike-peer a

 proposal tran1

#

ipsec policy map1 10 isakmp templatemap1tmp

#

interface GigabitEthernet0/0/0

 alias GE0/MGMT

 ipaddress 192.168.0.1 255.255.255.0

 dhcpselect interface

 dhcpserver gateway-list 192.168.0.1

#

interface GigabitEthernet0/0/1

 ipaddress 10.0.0.1 255.255.255.0

#

interface GigabitEthernet0/0/2

 ipaddress 200.0.0.1 255.255.255.0

 ipsec policy map1

#

interface GigabitEthernet0/0/3

#

interface GigabitEthernet0/0/4

#

interface GigabitEthernet0/0/5

#

interface GigabitEthernet0/0/6

#

interface GigabitEthernet0/0/7

#

interface GigabitEthernet0/0/8

#

interface NULL0

 alias NULL0

#

interface Tunnel10

 alias Tunnel10

 ipaddress 172.16.10.2 255.255.255.0

#

firewall zone local

 setpriority 100

#

firewall zone trust

 setpriority 85

 addinterface GigabitEthernet0/0/0

 addinterface GigabitEthernet0/0/1

#

firewall zone untrust

 setpriority 5

 addinterface GigabitEthernet0/0/2