华为ipsec_vpn双链路主备备份配置案例

核心思想就是要广域网两台路由器上各加一条静态路由互指主、备链路的网段，因为广域网按理说就是要100开头的网段全互通的

FW_A配置：

dis current-configuration
sysname FW_A

web-manager timeout 1440

ip-link check enable
ip-link name master
destination 100.1.33.1 interface GigabitEthernet1/0/0 mode icmp next-hop 100.1.31.2

ip service-set udp500 type object 16
service 0 protocol udp source-port 0 to 65535 destination-port 500

acl number 3000
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.2.1.0 0.0.0.255

acl number 3001
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.2.1.0 0.0.0.255

ipsec proposal pro1(下面都是默认配置)
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256

ike proposal 10(下面都是默认配置)
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256

ike peer fenduo
pre-shared-key Huawei@123
ike-proposal 10

ipsec policy-template tem1 1
security acl 3000
ike-peer fenduo
proposal pro1

ipsec policy-template tem2 1
security acl 3001
ike-peer fenduo
proposal pro1

ipsec policy policy1 1 isakmp template tem1
ipsec policy policy2 1 isakmp template tem2

interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance d