R1为公司分支网关，R2为公司总部网关，分公司与总部通过公网建立通信，并且总部与分公司 的网络已统一规划。分公司子网为：10.1.1.0/24，总部子网为：10.1.2.0/24.现希望对分公司子网与总部子网之间相互访问的流量进行安全保护，并让分公司网关配置能够尽量简单，由总部网关对分公司网关进行集中管理，管理和维护方式采用Ping、Telnet命令。
思路分析
根据分公司子网与总部子网的IP地址经过统一规划，不存在重叠ip情况，由于公司希望总部对分公司能进行集中管理，可以在分公司与总部之间采用Efficient VPN Network-plus模式建立IPSec 隧道来实现保护，更便于维护。
配置步骤
一、在R1与R2上配置各接口的IP地址，以及到达到对端公网、子网的静态路由。
【R1】
[Huawei]sysname R1
[R1-GigabitEthernet0/0/1]ip address 70.1.1.1 24
[R1-GigabitEthernet0/0/2]ip address 10.1.1.1 24
[R1]ip route-static 70.1.2.0 24 70.1.1.2 //配置到达公网的静态路由
[R1]ip route-static 10.1.2.0 24 70.1.1.2
【R2】
[Huawei]sysname R2
[R2-GigabitEthernet0/0/1]ip address 70.1.2.1 24
[R2-GigabitEthernet0/0/2]ip address 10.1.2.1 24
[R2-LoopBack0]ip address 100.1.1.1 24
[R2]ip route-static 70.1.1.0 24 70.1.2.2 //配置到达公网的静态路由
[R2]ip route-static 10.1.1.0 24 70.1.2.2
【Internet】
[Huawei]sysname Internet //模拟公网的路由器配置
[Internet-GigabitEthernet0/0/1]ip address 70.1.1.2 24
[Internet-GigabitEthernet0/0/2]ip address 70.1.2.2 24
二、在R2上配置IP地址池，推送的资源属性、（DNS/WINS）用于动态分配给建立的IPSec隧道,配置IPSec、IKE安全提议、IKE对等体，基于策略模板的安全策略。并用应用公网接口上。
【R2】
[R2]ip pool po1 //配置IP地址池动态分配给IPSec隧道
[R2-ip-pool-po1]network 100.1.1.0 mask 24
[R2-ip-pool-po1]gateway-list 100.1.1.1
[R2]aaa
[R2-aaa]service-scheme sch1 //配置推送资源属性给IPSec隧道
[R2-aaa-service-sch1]ip-pool po1
[R2-aaa-service-sch1]dns-name huawei.com //配置DNS域名
[R2-aaa-service-sch1]dns 2.2.2.2 //配置DNS
[R2-aaa-service-sch1]dns 2.2.2.3 secondary //配置备用DNS
[R2-aaa-service-sch1]wins 3.3.3.2 / /配置WINS
[R2-aaa-service-sch1]wins 3.3.3.3 secondary //配置备用WINS
[R2]ike proposal 5 //配置IKE安全提议
[R2-ike-proposal-5]dh group2 //配置应用组 策略要求只在group2上
[R2-ike-proposal-5]encryption-algorithm 3des-cbc //配置加密算法
[R2]ike peer rut3 v1 //配置IKE对等体采用V1版本
[R2-ike-peer-rut3]exchange-mode aggressive //IKEV1版本中必须为野蛮模式
[R2-ike-peer-rut3]pre-shared-key simple huawei
[R2-ike-peer-rut3]ike-proposal 5 //引用安全提议
[R2-ike-peer-rut3]service-scheme sch1 //引用aaa中资源推送。
[R2]ipsec proposal tra1 //配置IPSec安全提议 采用缺省值
[R2-ipsec-proposal-tra1]q
[R2]ipsec policy-template use1 10 //配置策略模板
[R2-ipsec-policy-templet-use1-10]ike-peer rut3 //引用对等体
[R2-ipsec-policy-templet-use1-10]proposal tra1 //引用安全提议
[R2]ipsec policy policy1 10 isakmp template use1 //在策略模板基础上配置安全策略
[R2-GigabitEthernet0/0/1]ipsec policy policy1 //应用安全策略
三、在R1上采用Network-plus模式配置Efficient VPN策略与R2建立IPSec隧道，并在策略中向总部推送需要IPSec保护的数据流，并将策略应用到公网接口上。
【R1】
[R1]acl number 3001 //定义需保护的数据流
[R1-acl-adv-3001]rule 1 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[R1]ipsec efficient-vpn evpn mode network-plus //配置efficient vpn的模式为 network-plus
[R1-ipsec-efficient-vpn-evpn]security acl 3001 //引用ACL
[R1-ipsec-efficient-vpn-evpn]remote-address 70.1.2.1 v1 //指定对端公网IP
[R1-ipsec-efficient-vpn-evpn]pre-shared-key simple huawei
[R1-GigabitEthernet0/0/1]ipsec efficient-vpn evpn //应用efficient vpn
四、验证测试
<R1>dis ike sa
Conn-ID Peer VPN Flag(s) Phase
---------------------------------------------------------------
37 70.1.2.1 0 RD|ST 2
36 70.1.2.1 0 RD|ST 1
Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
<R1>display ipsec sa
===============================
Interface: GigabitEthernet0/0/1
Path MTU: 1500
===============================
-----------------------------
IPSec efficient-vpn name: "evpn"
Mode : EFFICIENTVPN-NETWORKPLUS MODE
-----------------------------
Connection ID : 37
Encapsulation mode: Tunnel
Tunnel local : 70.1.1.1
Tunnel remote : 70.1.2.1
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 1345866727 (0x50384be7)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887436800/3541
Max sent sequence-number: 0
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 2757755882 (0xa46003ea)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887436800/3541
Max received sequence-number: 0
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
-----------------------------
IPSec efficient-vpn name: "evpn"
Mode : EFFICIENTVPN-NETWORKPLUS MODE
-----------------------------
Connection ID : 38
Encapsulation mode: Tunnel
Tunnel local : 70.1.1.1
Tunnel remote : 70.1.2.1
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 1201968941 (0x47a4972d)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887436800/3541
Max sent sequence-number: 0
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 1006124986 (0x3bf83fba)
Proposal: ESP-ENCRYPT-DES-64 ESP-AUTH-MD5
SA remaining key duration (bytes/sec): 1887436800/3541
Max received sequence-number: 0
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
<R1>display ipsec efficient-vpn
===========================================
IPSec efficient-vpn name: evpn
Using interface : GigabitEthernet0/0/1
===========================================
IPSec Efficient-vpn Name : evpn
IPSec Efficient-vpn Mode : 3 (1:Client 2:Network 3:Network-plus)
ACL Number : 3001
Auth Method : 8 (8:PSK 9:RSA)
VPN name :
Local ID Type : 1 (1:IP 2:Name)
IKE Version : 1 (1:IKEv1 2:IKEv2)
Remote Address : 70.1.2.1 (selected)
Pre Shared Key : huawei
PFS Type : 0 (0:Disable 1:Group1 2:Group2 5:Group5 14:Group14)
Local Address :
Remote Name :
PKI Object :
Anti-replay window size : 32
Qos pre-classify : 0 (0:Disable 1:Enable)
Interface loopback : LoopBack100
Interface loopback IP : 100.1.1.254/24
Dns server IP : 2.2.2.2, 2.2.2.3
Wins server IP : 3.3.3.2, 3.3.3.3
Dns default domain name : huawei.com
Auto-update url :
Auto-update version :
查看结果IKE sa 、IPSec sa 、ipsec efficient-vpn都已完成建立。
PC1(10.1.1.2)与PC2（10.1.2.2）也能相互Ping 通。
PC1>ping 10.1.2.2
Ping 10.1.2.2: 32 data bytes, Press Ctrl_C to break
From 10.1.2.2: bytes=32 seq=1 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=2 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=3 ttl=127 time=31 ms
From 10.1.2.2: bytes=32 seq=4 ttl=127 time=16 ms
From 10.1.2.2: bytes=32 seq=5 ttl=127 time=31 ms
--- 10.1.2.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 16/28/31 ms
PC2>ping 10.1.1.2
Ping 10.1.1.2: 32 data bytes, Press Ctrl_C to break
From 10.1.1.2: bytes=32 seq=1 ttl=127 time=31 ms
From 10.1.1.2: bytes=32 seq=2 ttl=127 time=32 ms
From 10.1.1.2: bytes=32 seq=3 ttl=127 time=15 ms
From 10.1.1.2: bytes=32 seq=4 ttl=127 time=31 ms
From 10.1.1.2: bytes=32 seq=5 ttl=127 time=32 ms
--- 10.1.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 15/28/32 ms
推荐本站淘宝优惠价购买喜欢的宝贝:
本文链接：https://hqyman.cn/post/4683.html 非本站原创文章欢迎转载，原创文章需保留本站地址！
微信支付宝扫一扫，打赏作者吧～休息一下~~
官码2024000195号
萌ICP备20248119号
