• 配置两个网关之间通过IPSec VPN互联并通过总部IPSec网关进行NAT后上网

    规格

    适用于V200R002C00及更高版本、所有形态的AR路由器。

    组网需求

    如图1所示，某企业分为总部和两个分支机构。分支机构1和分支机构2分别通过RouterB和RouterC与Internet相连。RouterA为NAT网关，总部RouterA和分支RouterB为固定公网地址，RouterC为动态公网IP地址；RouterA和RouterB以及RouterA和RouterC相互路由可达。企业要求实现如下组网需求：

    • 分支机构PC2、PC3能与总部PC1之间进行安全通信。
    • RouterA、RouterB以及RouterA、RouterC之间分别建立IPSec隧道。RouterB、RouterC不直接建立任何IPSec连接。
    • PC1可以直接访问公网，PC2和PC3通过总部网关访问公网。
    图1 两个网关之间通过IPSec VPN互联并通过总部IPSec网关进行NAT后上网的组网图

    操作步骤
    1. 配置RouterA 

      1. #  
      2.  sysname RouterA 
      3. # 
      4. acl number 3000  
      5.  rule 5 permit ip destination 10.1.2.0 0.0.0.255  
      6.  rule 10 permit ip destination 10.1.3.0 0.0.0.255 
      7. # 
      8. ipsec proposal tran1                                                              
      9.  esp authentication-algorithm sha2-256                                            
      10.  esp encryption-algorithm aes-256    
      11. # 
      12. ike proposal 10  
      13.  encryption-algorithm aes-256                                                     
      14.  dh group14                                                                        
      15.  authentication-algorithm sha2-256                                                
      16.  authentication-method pre-share                                                  
      17.  integrity-algorithm hmac-sha2-256                                                
      18.  prf hmac-sha2-256  
      19. # 
      20. ike peer c  
      21.  pre-shared-key %^%#0ljf5R_9LXP|Qe=WVA6-Y%'}%^%#  
      22.  ike-proposal 10 
      23. #                                                                                
      24. ipsec policy-template temp 1  
      25.  security acl 3000  
      26.  ike-peer c  
      27.  proposal tran1 
      28. # 
      29. ipsec policy map1 10 isakmp template temp 
      30. # 
      31. interface GigabitEthernet0/0/3  
      32.  undo shutdown  
      33.  ip address 10.1.1.1 255.255.255.0 
      34. # 
      35. interface GigabitEthernet0/0/1  
      36.  undo shutdown  
      37.  ip address 1.1.3.1 255.255.255.0  
      38.  ipsec policy map1 
      39. # 
      40. firewall zone trust  
      41. set priority 85  
      42. add interface GigabitEthernet0/0/3 
      43. # 
      44. firewall zone untrust   
      45.  set priority 5   
      46.  add interface GigabitEthernet0/0/1 
      47. # 
      48. ip route-static 0.0.0.0 0.0.0.0 1.1.3.2 
      49. # 
      50. security-policy  
      51.  rule name policy1   
      52.   source-zone trust   
      53.   destination-zone untrust   
      54.   source-address 10.1.1.0 mask 255.255.255.0   
      55.   destination-address 10.1.2.0 mask 255.255.255.0   
      56.   destination-address 10.1.3.0 mask 255.255.255.0   
      57.   action permit  
      58.  rule name policy2   
      59.   source-zone untrust   
      60.   destination-zone trust   
      61.   source-address 10.1.2.0 mask 255.255.255.0   
      62.   source-address 10.1.3.0 mask 255.255.255.0   
      63.   destination-address 10.1.1.0 mask 255.255.255.0   
      64.   action permit  
      65.  rule name policy3   
      66.   source-zone local   
      67.   destination-zone untrust   
      68.   source-address 1.1.3.1 mask 255.255.255.255   
      69.   action permit  
      70.  rule name policy4   
      71.   source-zone untrust   
      72.   destination-zone local   
      73.   destination-address 1.1.3.1 mask 255.255.255.255   
      74.   action permit 
      75. # 
      76. nat-policy  
      77.  rule name policy_nat1   
      78.   source-zone trust   
      79.   destination-zone untrust   
      80.   source-address 10.1.1.0 mask 255.255.255.0   
      81.   destination-address 10.1.2.0 mask 255.255.255.0   
      82.   destination-address 10.1.3.0 mask 255.255.255.0   
      83.   action no-nat  
      84.  rule name policy_nat2   
      85.   source-zone trust   
      86.   source-zone untrust   
      87.   destination-zone untrust   
      88.   source-address 10.1.1.0 mask 255.255.255.0   
      89.   source-address 10.1.2.0 mask 255.255.255.0   
      90.   source-address 10.1.3.0 mask 255.255.255.0   
      91.   action source-nat easy-ip 
      92. # 
      93. return

    2. 配置RouterB 

      1. #  
      2. sysname RouterB 
      3. # 
      4. acl number 3000  
      5.  rule 5 permit ip source 10.1.2.0 0.0.0.255 
      6. # 
      7. ipsec proposal tran1                                                              
      8.  esp authentication-algorithm sha2-256                                            
      9.  esp encryption-algorithm aes-256    
      10. # 
      11. ike proposal 10  
      12.  encryption-algorithm aes-256                                                     
      13.  dh group14                                                                        
      14.  authentication-algorithm sha2-256                                                
      15.  authentication-method pre-share                                                  
      16.  integrity-algorithm hmac-sha2-256                                                
      17.  prf hmac-sha2-256  
      18. # 
      19. ike peer a  
      20.  pre-shared-key %^%#St4#CBb9$L>G`5W(HV*BKTnm%^%#  
      21.  ike-proposal 10  
      22.  remote-address 1.1.3.1 
      23. #                                                                                
      24. ipsec policy map1 10 isakmp  
      25.  security acl 3000  
      26.  ike-peer a  
      27.  proposal tran1 
      28. # 
      29. interface GigabitEthernet0/0/3  
      30.  undo shutdown  
      31.  ip address 10.1.2.1 255.255.255.0 
      32. # 
      33. interface GigabitEthernet0/0/1  
      34.  undo shutdown  
      35.  ip address 1.1.5.1 255.255.255.0  
      36.  ipsec policy map1 
      37. # 
      38. firewall zone trust  
      39.  set priority 85  
      40.  add interface GigabitEthernet0/0/3 
      41. # 
      42. firewall zone untrust   
      43.  set priority 5   
      44.  add interface GigabitEthernet0/0/1 
      45. #  
      46. ip route-static 10.1.0.0 255.255.0.0 GigabitEthernet0/0/1 
      47. # 
      48. security-policy  
      49.  rule name policy1   
      50.   source-zone trust   
      51.   destination-zone untrust   
      52.   source-address 10.1.2.0 mask 255.255.255.0   
      53.   destination-address 10.1.1.0 mask 255.255.255.0   
      54.   destination-address 10.1.3.0 mask 255.255.255.0   
      55.  action permit  
      56.   rule name policy2   
      57.   source-zone untrust   
      58.   destination-zone trust   
      59.   source-address 10.1.1.0 mask 255.255.255.0   
      60.   source-address 10.1.3.0 mask 255.255.255.0   
      61.   destination-address 10.1.2.0 mask 255.255.255.0   
      62.  action permit  
      63.   rule name policy3   
      64.   source-zone local   
      65.   destination-zone untrust   
      66.   source-address 1.1.5.1 mask 255.255.255.255  
      67.   destination-address 1.1.3.1 mask 255.255.255.255   
      68.  action permit 
      69.   rule name policy4   
      70.   source-zone untrust   
      71.   destination-zone local   
      72.   source-address 1.1.3.1 mask 255.255.255.255   
      73.   destination-address 1.1.5.1 mask 255.255.255.255   
      74.   action permit 
      75. # 
      76. return

    3. 配置RouterC 

      1. #  
      2. sysname RouterC 
      3. # 
      4. acl number 3000  
      5.  rule 5 permit ip source 10.1.3.0 0.0.0.255 
      6. # 
      7. ipsec proposal tran1                                                              
      8.  esp authentication-algorithm sha2-256                                            
      9.  esp encryption-algorithm aes-256    
      10. # 
      11. ike proposal 10  
      12.  encryption-algorithm aes-256                                                    
      13.  dh group14                                                                        
      14.  authentication-algorithm sha2-256                                                
      15.  authentication-method pre-share                                                  
      16.  integrity-algorithm hmac-sha2-256                                                
      17.  prf hmac-sha2-256  
      18. # 
      19. ike peer a  
      20.  pre-shared-key %^%#LV|sQ=~fUQO:M$CeqaMEnwVD%^%#  
      21.  ike-proposal 10  
      22.  remote-address 1.1.3.1 
      23. #                                                                                
      24. ipsec policy map1 10 isakmp  
      25.  security acl 3000  
      26.  ike-peer a  
      27.  proposal tran1 
      28. # 
      29. interface GigabitEthernet0/0/3  
      30.  undo shutdown  
      31.  ip address 10.1.3.1 255.255.255.0 
      32. # 
      33. interface GigabitEthernet0/0/1 /*configuration of obtaining IP*/  
      34.  undo shutdown  
      35.  ipsec policy map1 
      36. # 
      37. firewall zone trust  
      38.  set priority 85  
      39.  add interface GigabitEthernet0/0/3 
      40. # 
      41. firewall zone untrust  
      42.  set priority 5   
      43.  add interface GigabitEthernet0/0/1 
      44. #
      45. ip route-static 10.1.0.0 255.255.0.0 GigabitEthernet0/0/1 
      46. # 
      47. security-policy  
      48.  rule name policy1   
      49.   source-zone trust   
      50.   destination-zone untrust   
      51.   source-address 10.1.3.0 mask 255.255.255.0  
      52.   destination-address 10.1.1.0 mask 255.255.255.0   
      53.   destination-address 10.1.2.0 mask 255.255.255.0   
      54.   action permit  
      55.  rule name policy2   
      56.   source-zone untrust   
      57.   destination-zone trust   
      58.   source-address 10.1.1.0 mask 255.255.255.0   
      59.   source-address 10.1.2.0 mask 255.255.255.0   
      60.   destination-address 10.1.3.0 mask 255.255.255.0   
      61.   action permit  
      62.  rule name policy3  
      63.   source-zone local  
      64.   destination-zone untrust   
      65.   destination-address 1.1.3.1 mask 255.255.255.255   
      66.   action permit  
      67.  rule name policy4   
      68.   source-zone untrust  
      69.   destination-zone local   
      70.   source-address 1.1.3.1 mask 255.255.255.255   
      71.   action permit
      72. # 
      73. return

    4. 验证配置结果。
      1. 配置完成后，PC1在任何时候都可以访问公网，可以ping通RouterB的1.1.5.1，同时在RouterA上可以查看NAT转换session表项。 

        1.  display firewall session table
        2.  Current Total Sessions : 5
        3.   icmp  VPN:public --> public 10.1.1.2:61251[1.1.3.1:2048]-->1.1.5.1:2048
        4.   icmp  VPN:public --> public 10.1.1.2:62019[1.1.3.1:2049]-->1.1.5.1:2048
        5.   icmp  VPN:public --> public 10.1.1.2:62275[1.1.3.1:2050]-->1.1.5.1:2048
        6.   icmp  VPN:public --> public 10.1.1.2:62531[1.1.3.1:2051]-->1.1.5.1:2048
        7.   icmp  VPN:public --> public 10.1.1.2:62787[1.1.3.1:2052]-->1.1.5.1:2048

      2. PC2在任何时候可以访问到公网，可以ping通公网的IP地址（假设为1.1.6.1），同时在RouterA上可以查看NAT转换session表项。 

        1.  display firewall session table 
        2. Current Total Sessions : 5
        3.   icmp  VPN:public --> public 10.1.2.2:61251[1.1.3.1:2053]-->1.1.6.1:2048
        4.   icmp  VPN:public --> public 10.1.2.2:62019[1.1.3.1:2054]-->1.1.6.1:2048
        5.   icmp  VPN:public --> public 10.1.2.2:62275[1.1.3.1:2055]-->1.1.6.1:2048
        6.   icmp  VPN:public --> public 10.1.2.2:62531[1.1.3.1:2056]-->1.1.6.1:2048
        7.   icmp  VPN:public --> public 10.1.2.2:62787[1.1.3.1:2057]-->1.1.6.1:2048

      3. PC2发起访问，之后PC1与PC2之间可以相互访问。
      4. 总部RouterA上可以查看到对应的IKE SA。 

        1.  display ike sa      
        2. IKE SA information :             
        3.     Conn-ID     Peer       VPN   Flag(s)   Phase   RemoteType  RemoteID
        4.   -------------------------------------------------------------------------
        5.      83887864   1.1.5.1:500      RD|A       v2:2   IP          1.1.5.1
        6.      83887652   1.1.5.1:500      RD|A       v2:1   IP          1.1.5.1
        7.   Number of IKE SA : 2 
        8.   --------------------------------------------------------------------------
        9.   Flag Description:                                                             
        10.   RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT           
        11.   HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP                
        12.   M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

      5. 分支上RouterB可以查看到对端为总部的IKE SA，RouterB是发起方，标志位为ST。 

        1.  display ike sa
        2. IKE SA information :
        3.     Conn-ID    Peer       VPN   Flag(s)   Phase   RemoteType  RemoteID
        4.   -------------------------------------------------------------------------
        5.     62887864   1.1.3.1:500      RD|ST|A   v2:2    IP              1.1.3.1
        6.     62887652   1.1.3.1:500      RD|ST|A   v2:1    IP              1.1.3.1
        7.   Number of IKE SA : 2 
        8.   -------------------------------------------------------------------------
        9.   Flag Description:                                                             
        10.   RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT           
        11.   HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP                
        12.   M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

      6. 总部RouterA上可以查看到一对双向的IPSec SA，对应分支RouterB。 

        1.  display ipsec sa brief 
        2. Current ipsec sa num:2
        3. Spu board slot 1, cpu 1 ipsec sa information:                                   
        4. Number of SAs:2                                                              
        5.     Src address   Dst address     SPI      VPN  Protocol     Algorithm       
        6. ------------------------------------------------------------------------------- 
        7.      1.1.5.1        1.1.3.1    3923280450        ESP       E:AES-256 A:SHA2_256_128 
        8.      1.1.3.1        1.1.5.1    787858613         ESP       E:AES-256 A:SHA2_256_128

      7. 分支节点RouterB上可以查看到一对双向IPSec SA。 

        1.  display ipsec sa brief 
        2. Current ipsec sa num:2
        3. Spu board slot 1, cpu 1 ipsec sa information:                                   
        4. Number of SAs:2                                                              
        5.     Src address   Dst address     SPI      VPN  Protocol     Algorithm       
        6. ------------------------------------------------------------------------------- 
        7.      1.1.3.1        1.1.5.1    787858613          ESP       E:AES-256 A:SHA2_256_128 
        8.      1.1.5.1        1.1.3.1    3923280450         ESP       E:AES-256 A:SHA2_256_128
  • 相关阅读:
    基于Pytorch框架的轻量级卷积神经网络垃圾分类识别系统
    bp神经网络遗传算法举例,bp神经网络 遗传算法
    【Hbase】第一章——从原理剖析
    麒麟系统上使用linuxdeployqt 编译安装
    被CTO推荐的SQL总结
    JavaScript学习之路---js基础（基本语法，认识js）
    三级分类的数据表设计和构造API数据
    项目复盘：从实践中学习
    这就叫“面试造火箭，工作拧螺丝！”
    Codeforces Round #813 (Div. 2) A. Wonderful Permutation
  • 原文地址：https://blog.csdn.net/2301_76769041/article/details/134087476