F1060 IPSEC典型组网配置案例（NAT穿越）

2020 年 3 月 12 日
筆記

组网及说明

组网说明：

本案例采用H3C HCL模拟器的F1060防火墙来模拟IPSEC NAT穿越的典型组网配置。在网络拓扑图中存在子网1和子网2.为了保障子网1和子网2相互传输数据的安全性，因此需要在FW1与FW2采用建立IPSEC VPN隧道，由于FW1的出接口地址不固定且ISP为子网1的NAT设备，因此采用IKE野蛮模式。

配置步骤

1、按照网络拓扑图正确配置IP地址

2、ISP配置NAT

3、FW1与FW2的互联接口加入安全域，并放通域间策略

4、FW1与FW2建立IPSEC VPN隧道，采用IKE野蛮模式

配置关键点

ISP：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname ISP    [ISP]int gi 0/0    [ISP-GigabitEthernet0/0]des    [ISP-GigabitEthernet0/0]ip address 202.1.100.1 24    [ISP-GigabitEthernet0/0]dhcp server apply ip-pool 1    [ISP-GigabitEthernet0/0]quit    [ISP]acl basic 2000    [ISP-acl-ipv4-basic-2000]rule 0 permit source any    [ISP-acl-ipv4-basic-2000]quit    [ISP]int gi 0/1    [ISP-GigabitEthernet0/1]des    [ISP-GigabitEthernet0/1]ip address 202.2.100.1 30    [ISP-GigabitEthernet0/1]nat outbound 2000    [ISP-GigabitEthernet0/1]quit    [ISP]ip route-static 192.168.1.0 255.255.255.0 202.1.100.2    [ISP]ip route-static 172.16.1.0 255.255.255.0 202.2.100.2    [ISP]dhcp enable    [ISP]dhcp server ip-pool 1    [ISP-dhcp-pool-1]network 202.1.100.0 mask 255.255.255.0    [ISP-dhcp-pool-1]gateway-list 202.1.100.1    [ISP-dhcp-pool-1]quit

FW1：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname FW1    [FW1]int gi 1/0/3    [FW1-GigabitEthernet1/0/3]ip address 192.168.1.1 24    [FW1-GigabitEthernet1/0/3]quit    [FW1]int gi 1/0/2    [FW1-GigabitEthernet1/0/2]des    [FW1-GigabitEthernet1/0/2]ip address dhcp-alloc    [FW1-GigabitEthernet1/0/2]quit    [FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1    [FW1]security-zone name Trust    [FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3    [FW1-security-zone-Trust]quit    [FW1]security-zone name Untrust    [FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2    [FW1-security-zone-Untrust]quit    [FW1]acl basic 2001    [FW1-acl-ipv4-basic-2001]rule 0 permit source any    [FW1-acl-ipv4-basic-2001]quit    [FW1]    [FW1]zone-pair security source trust destination untrust    [FW1-zone-pair-security-Trust-Untrust]packet-filter 2001    [FW1-zone-pair-security-Trust-Untrust]quit    [FW1]    [FW1]zone-pair security source untrust destination trust    [FW1-zone-pair-security-Untrust-Trust]packet-filter 2001    [FW1-zone-pair-security-Untrust-Trust]quit    [FW1]    [FW1]zone-pair security source trust destination local    [FW1-zone-pair-security-Trust-Local]packet-filter 2001    [FW1-zone-pair-security-Trust-Local]quit    [FW1]    [FW1]zone-pair security source local destination trust    [FW1-zone-pair-security-Local-Trust]packet-filter 2001    [FW1-zone-pair-security-Local-Trust]quit    [FW1]    [FW1]zone-pair security source untrust destination local    [FW1-zone-pair-security-Untrust-Local]packet-filter 2001    [FW1-zone-pair-security-Untrust-Local]quit    [FW1]    [FW1]zone-pair security source local destination untrust    [FW1-zone-pair-security-Local-Untrust]packet-filter 2001    [FW1-zone-pair-security-Local-Untrust]quit

FW1 IPSEC+IKE野蛮模式关键配置点：

[FW1]acl advanced 3000    [FW1-acl-ipv4-adv-3000]rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255    [FW1-acl-ipv4-adv-3000]quit    [FW1]ike identity fqdn fw1    [FW1]ike keychain james    [FW1-ike-keychain-james]pre-shared-key address 202.2.100.2 255.255.255.252 key simple james    [FW1-ike-keychain-james]quit    [FW1]ike proposal 1    [FW1-ike-proposal-1]quit    [FW1]ike profile james    [FW1-ike-profile-james]keychain james    [FW1-ike-profile-james]proposal 1    [FW1-ike-profile-james]match remote identity address 202.2.100.2 255.255.255.252    [FW1-ike-profile-james]exchange-mode aggressive    [FW1-ike-profile-james]quit    [FW1]ipsec transform-set james    [FW1-ipsec-transform-set-james]protocol esp    [FW1-ipsec-transform-set-james]encapsulation-mode tunnel    [FW1-ipsec-transform-set-james]esp authentication-algorithm md5    [FW1-ipsec-transform-set-james]esp encryption-algorithm des-cbc    [FW1-ipsec-transform-set-james]quit    [FW1]ipsec policy james 1 isakmp    [FW1-ipsec-policy-isakmp-james-1]security acl 3000    [FW1-ipsec-policy-isakmp-james-1]transform-set james    [FW1-ipsec-policy-isakmp-james-1]ike-profile james    [FW1-ipsec-policy-isakmp-james-1]remote-address 202.2.100.2    [FW1-ipsec-policy-isakmp-james-1]quit    [FW1]int gi 1/0/2    [FW1-GigabitEthernet1/0/2]ipsec apply policy james    [FW1-GigabitEthernet1/0/2]quit

FW2：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname FW2    [FW2]int gi 1/0/3    [FW2-GigabitEthernet1/0/3]ip address 172.16.1.1 24    [FW2-GigabitEthernet1/0/3]quit    [FW2]int gi 1/0/2    [FW2-GigabitEthernet1/0/2]des    [FW2-GigabitEthernet1/0/2]ip address 202.2.100.2 30    [FW2-GigabitEthernet1/0/2]quit    [FW2]ip route-static 0.0.0.0 0.0.0.0 202.2.100.1    [FW2]security-zone name Untrust    [FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/2    [FW2-security-zone-Untrust]quit    [FW2]security-zone name Trust    [FW2-security-zone-Trust]import interface GigabitEthernet 1/0/3    [FW2-security-zone-Trust]quit    [FW2]zone-pair security source trust destination untrust    [FW2-zone-pair-security-Trust-Untrust]packet-filter 2001    [FW2-zone-pair-security-Trust-Untrust]quit    [FW2]    [FW2]zone-pair security source untrust destination trust    [FW2-zone-pair-security-Untrust-Trust]packet-filter 2001    [FW2-zone-pair-security-Untrust-Trust]quit    [FW2]    [FW2]zone-pair security source trust destination local    [FW2-zone-pair-security-Trust-Local]packet-filter 2001    [FW2-zone-pair-security-Trust-Local]quit    [FW2]    [FW2]zone-pair security source local destination trust    [FW2-zone-pair-security-Local-Trust]packet-filter 2001    [FW2-zone-pair-security-Local-Trust]quit    [FW2]    [FW2]zone-pair security source untrust destination local    [FW2-zone-pair-security-Untrust-Local]packet-filter 2001    [FW2-zone-pair-security-Untrust-Local]quit    [FW2]    [FW2]zone-pair security source local destination untrust    [FW2-zone-pair-security-Local-Untrust]packet-filter 2001    [FW2-zone-pair-security-Local-Untrust]quit

FW2 IPSEC+IKE野蛮模式关键配置点：

[FW2]acl advanced 3000    [FW2-acl-ipv4-adv-3000]rule 0 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255    [FW2-acl-ipv4-adv-3000]quit    [FW2]ike identity fqdn fw2    [FW2]ike proposal 1    [FW2-ike-proposal-1]quit    [FW2]ike keychain james    [FW2-ike-keychain-james]pre-shared-key hostname fw1 key simple james    [FW2-ike-keychain-james]quit    [FW2]ike profile james    [FW2-ike-profile-james]keychain james    [FW2-ike-profile-james]proposal 1    [FW2-ike-profile-james]match remote identity fqdn fw1    [FW2-ike-profile-james]exchange-mode aggressive    [FW2-ike-profile-james]quit    [FW2]ipsec transform-set james    [FW2-ipsec-transform-set-james]protocol esp    [FW2-ipsec-transform-set-james]encapsulation-mode tunnel    [FW2-ipsec-transform-set-james]esp authentication-algorithm md5    [FW2-ipsec-transform-set-james]esp encryption-algorithm des-cbc    [FW2-ipsec-transform-set-james]quit    [FW2]ipsec policy-template james 1    [FW2-ipsec-policy-template-james-1]security acl 3000    [FW2-ipsec-policy-template-james-1]transform-set james    [FW2-ipsec-policy-template-james-1]ike-profile james    [FW2-ipsec-policy-template-james-1]quit    [FW2]ipsec policy james 1 isakmp template james    [FW2]int gi 1/0/2    [FW2-GigabitEthernet1/0/2]ipsec apply policy james    [FW2-GigabitEthernet1/0/2]quit