eNSP—DNS+WEB+IPSec实验

德暮

已于 2023-03-09 23:34:09 修改

阅读量2.2k

点赞数 1

文章标签：网络互联

于 2022-04-10 19:55:14 首次发布

本文链接：https://blog.youkuaiyun.com/m0_46237205/article/details/124084059

版权

本文档详细介绍了如何在华为路由器R1和R3上配置IPSec技术，实现两台设备间的安全通信。配置步骤包括设置接口IP地址、定义感兴趣流ACL、创建IPSec安全提议、制定安全策略以及在接口上应用策略。同时，路由器R2作为中转设备，配置了相应的静态路由以确保通信路径的畅通。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

该实验基础上使用IPSec技术实现
拓扑如下：
在这里插入图片描述
【1】R1的配置命令:

< Huawei >sys
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip add 192.168.1.254 24
[Huawei-GigabitEthernet0/0/0]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip add 10.0.12.1 24
[Huawei-GigabitEthernet0/0/1]quit

#1，配置感兴趣流acl

[Huawei]acl 3000
[Huawei-acl-adv-3000]rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255
[Huawei-acl-adv-3000]quit

#2，配置IPSec安全提议proposal

[Huawei]ipsec proposal one 
[Huawei-ipsec-proposal-one]encapsulation-mode tunnel 
[Huawei-ipsec-proposal-one]transform esp 
[Huawei-ipsec-proposal-one]esp encryption-algorithm des
[Huawei-ipsec-proposal-one]esp authentication-algorithm md5 
[Huawei-ipsec-proposal-one]quit

#3，配置IPSec安全策略

[Huawei]ipsec policy one1 10 manual 
[Huawei-ipsec-policy-manual-one1-10]security acl 3000
[Huawei-ipsec-policy-manual-one1-10]proposal one
[Huawei-ipsec-policy-manual-one1-10]tunnel local 10.0.12.1
[Huawei-ipsec-policy-manual-one1-10]tunnel remote 10.0.23.1	
[Huawei-ipsec-policy-manual-one1-10]sa spi inbound esp 54321	
[Huawei-ipsec-policy-manual-one1-10]sa string-key inbound esp cipher huawei
[Huawei-ipsec-policy-manual-one1-10]sa spi outbound esp 12345
[Huawei-ipsec-policy-manual-one1-10]sa string-key outbound esp cipher huawei
[Huawei-ipsec-policy-manual-one1-10]quit

#4，在接口应用IPSec安全策略

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ipsec policy one1
[Huawei-GigabitEthernet0/0/1]quit

[Huawei]ip route-static 0.0.0.0 0 10.0.12.2

【2】R3的配置命令：

< Huawei >sys
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip add 172.16.1.254 24
[Huawei-GigabitEthernet0/0/1]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip add 10.0.23.1 24

#1，配置感兴趣流acl

[Huawei]acl 3000
[Huawei-acl-adv-3000]rule 10 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
[Huawei-acl-adv-3000]quit

#2，配置IPSec安全提议proposal

[Huawei]ipsec proposal two	
[Huawei-ipsec-proposal-two]encapsulation-mode tunnel 
[Huawei-ipsec-proposal-two]transform esp 
[Huawei-ipsec-proposal-two]esp encryption-algorithm des	
[Huawei-ipsec-proposal-two]esp authentication-algorithm md5
[Huawei-ipsec-proposal-two]quit

#3，配置IPSec安全策略

[Huawei]ipsec policy two2 10 manual 
[Huawei-ipsec-policy-manual-two2-10]security acl 3000
[Huawei-ipsec-policy-manual-two2-10]proposal two	
[Huawei-ipsec-policy-manual-two2-10]tunnel local 10.0.23.1
[Huawei-ipsec-policy-manual-two2-10]tunnel remote 10.0.12.1
#R3这边入方向相当于R1那边的出方向，所以应为12345
[Huawei-ipsec-policy-manual-two2-10]sa spi inbound esp 12345
[Huawei-ipsec-policy-manual-two2-10]sa string-key inbound esp cipher huawei
#R3这边出方向相当于R1那边的入方向，所以应为54321
[Huawei-ipsec-policy-manual-two2-10]sa spi outbound esp 54321
[Huawei-ipsec-policy-manual-two2-10]sa string-key outbound esp cipher huawei
[Huawei-ipsec-policy-manual-two2-10]quit

#4，在接口应用IPSec安全策略

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ipsec policy two2
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]ip route-static 0.0.0.0 0 10.0.23.2

【3】R2的配置命令：

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip add 10.0.12.2 24
[Huawei-GigabitEthernet0/0/0]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip add 10.0.23.2 24
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip add 8.8.8.254 24
[Huawei-GigabitEthernet0/0/2]

[Huawei]ip route-static 192.168.1.0 24 10.0.12.1