华为HCIA学习笔记：总部采用策略模板与分支建立多条IPSec隧道

总部路由器ar1和分部1路由器ar3有固定公网IP地址

分部2路由器ar4没有固定IP地址,其通过pppoe拨号上网

只能由分部路由器向总部路由器发起建立IPSec VPN请求

在总部路由器创建策略模板

此方式适用于分部没有固定IP地址，通过拨号上网的场景使用

ar1

[ar1]int g0/0/1
[ar1-GigabitEthernet0/0/1]ip add 192.168.10.254 24

[ar1]ip route-static 0.0.0.0 0 10.10.10.2
[ar1]ipsec proposal prop1

[ar1]ike peer rut1 v2
[ar1-ike-peer-rut1]pre-shared-key cipher Huawei123

[ar1]ipsec policy-template server 10
[ar1-ipsec-policy-templet-server-10]proposal prop1
[ar1-ipsec-policy-templet-server-10]ike-peer rut1

[ar1]ipsec policy policy1 10 isakmp template server

[ar1-GigabitEthernet0/0/0]ipsec policy policy1

[ar1]int g0/0/0
[ar1-GigabitEthernet0/0/0]ip add 10.10.10.1 24
[ar1-GigabitEthernet0/0/0]ipsec policy policy1

ar2

[ar2]int g0/0/0
[ar2-GigabitEthernet0/0/0]ip add 10.10.10.2 24