H3C-×××的配置

  • 2020 年 1 月 10 日
  • 筆記

H3C-×××的配置

拓撲圖

  1. 配置IP地址 <R1>system-view [R1]interface e0/1 [R1-Ethernet0/1]ip address 192.168.100.254 255.255.255.0 [R1]interface e0/0 [R1-Ethernet0/0]ip address 192.168.13.1 255.255.255.0 <R2>system-view [R2]interface e0/1 [R2-Ethernet0/1]ip address 192.168.200.254 255.255.255.0 [R2]interface e0/0 [R2-Ethernet0/0]ip address 192.168.23.2 255.255.255.0 <R3>system-view [R3]interface e0/0 [R3-Ethernet0/0]ip address 192.168.13.3 255.255.255.0 [R3]interface e0/1 [R3-Ethernet0/1]ip address 192.168.23.3 255.255.255.0 PC1的設置

PC2的設置

  1. 配置手工方式的Tunnel [R1]acl 3000 [R1-acl-3000]rule permit ip source 192.168.100.1 0.0.0.255 destination 192.168.200.2 0.0.0.255 [R1-acl-3000]rule deny ip source any destination any [R1-acl-3000]quit //創建訪問規則 [R1]ipsec proposal trans1 [R1-ipsec-proposal-trans1]encapsulation-mode tunnel [R1-ipsec-proposal-trans1]transform esp-new [R1-ipsec-proposal-trans1]esp-new authentication md5-hmac-96 [R1-ipsec-proposal-trans1]esp-new encryption-algorithm des [R1-ipsec-proposal-trans1]quit //創建提議，以及對提議的加密、認證方式 [R1]ipsec policy p1 100 manual [R1-ipsec-policy-p1-100]security acl 3000 [R1-ipsec-policy-p1-100]proposal trans1 [R1-ipsec-policy-p1-100]tunnel local 192.168.13.1 [R1-ipsec-policy-p1-100]tunnel remote 192.168.23.2 [R1-ipsec-policy-p1-100]sa inbound esp spi 123456 [R1-ipsec-policy-p1-100]sa inbound esp string-key asdf [R1-ipsec-policy-p1-100]sa outbound esp spi 654321 [R1-ipsec-policy-p1-100]sa outbound esp string-key fdsa [R1-ipsec-policy-pl -100]quit //創建策略，包含上述提議，該策略將應用於Tunnel中，需要注意的是Tunnel兩端的路由器策略配置，R1中的tunnel local地址是R2的tunnel remote， inbound是R2的outbound。 [R1]interface e0/0 [R1-Ethernet0/0]ipsec policy p1 //在出口上應用策略 [R2]acl 3001 [R2-acl-3001]rule permit ip source 192.168.200.2 0.0.0.255 destination 192.168.100.1 0.0.0.255 [R2-acl-3001]rule deny ip source any destination any [R2-acl-3001]quit //創建訪問規則 [R2]ipsec proposal trans2 [R2-ipsec-proposal-trans2]encapsulation-mode tunnel [R2-ipsec-proposal-trans2]transform esp-new [R2-ipsec-proposal-trans2]esp-new authentication md5-hmac-96 [R2-ipsec-proposal-trans2]esp-new encryption-algorithm des [R2-ipsec-proposal-trans2]quit //創建提議，以及對提議的加密、認證方式 [R2]ipsec policy p2 200 manual [R2-ipsec-policy-p2-200]security acl 3001 [R2-ipsec-policy-p2-200]proposal trans2 [R2-ipsec-policy-p2-200]tunnel local 192.168.23.2 [R2-ipsec-policy-p2-200]tunnel remote 192.168.13.1 [R2-ipsec-policy-p2-200]sa inbound esp spi 654321 [R2-ipsec-policy-p2-200]sa inbound esp string-key fdsa [R2-ipsec-policy-p2-200]sa outbound esp spi 123456 [R2-ipsec-policy-p2-200]sa outbound esp string-key asdf [R2-ipsec-policy-p2-200]quit [R2]interface e0/0 [R2-Ethernet0/0]ipsec policy p2
  2. 在Tunnel兩端的路由器上各添加一條默認路由，是內網地址能夠和外部連接。 ip route-static 0.0.0.0 0.0.0.0 192.168.13.3 preference 60   //R1上的默認路由 ip route-static 0.0.0.0 0.0.0.0 192.168.23.3 preference 60   //R2上的默認路由
  3. 查看Tunnel狀態，以及PC1和PC2之間的連通性。 ipsec policy name: p1  ipsec policy sequence: 100  negotiation mode: manual  security acl: 3000  local address: 192.168.13.1  remote address: 192.168.23.2  proposal name: trans1  esp(inbound) setting:    esp spi: 654321 (0x9fbf1)    esp string-key: fdsa    esp encryption-hex:    esp authen-hex:  esp(outbound) setting:    esp spi: 123456 (0x1e240)    esp string-key: asdf    esp encryption-hex:    esp authen-hex:  OutBound SA has been established.  InBound SA has been established. //路由器R1端的Tunnel狀態 ipsec policy name: p2 ipsec policy sequence: 200 negotiation mode: manual security acl: 3001 local address: 192.168.23.2 remote address: 192.168.13.1 proposal name: trans2 esp(inbound) setting:  esp spi: 123456 (0x1e240)  esp string-key: asdf  esp encryption-hex:  esp authen-hex: esp(outbound) setting:  esp spi: 654321 (0x9fbf1)  esp string-key: fdsa  esp encryption-hex:  esp authen-hex: OutBound SA has been established. InBound SA has been established. //路由器R2端的Tunnel狀態 //在PC1上pingPC2 正在 Ping 192.168.200.2 具有 32 位元組的數據: 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=9ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=9ms TTL=254
  4. 配置自動方式的Tunnel。 [R1]ipsec policy p3 300 isakmp [R1-ipsec-policy-p3-300]security acl 3000 [R1-ipsec-policy-p3-300]proposal trans1 [R1-ipsec-policy-p3-300]tunnel local 192.168.13.1 [R1-ipsec-policy-p3-300]tunnel remote 192.168.23.2 [R1-ipsec-policy-p3-300]quit [R1]ike pre-shared-key 12345 remote 192.168.23.2 [R1]interface e0/0 [R1-Ethernet0/0]ipsec policy p3 //提議和手工方式一樣，策略修改為自動方式的，而且共享密鑰的設置，Tunnel兩端要一致。 [R2]ipsec policy p4 400 isakmp [R2-ipsec-policy-p4-400]security acl 3001 [R2-ipsec-policy-p4-400]proposal trans2 [R2-ipsec-policy-p4-400]tunnel local 192.168.23.2 [R2-ipsec-policy-p4-400]tunnel remote 192.168.13.1 [R2-ipsec-policy-p4-400]quit [R2]ike pre-shared-key 12345 remote 192.168.13.1 [R2]interface e0/0 [R2-Ethernet0/0]ipsec policy p4
  5. Tunnel狀態以及PC1和PC2之間的連通性。 ipsec policy name: p3 ipsec policy sequence: 300 negotiation mode: isakmp security acl: 3000 remote address 0: 192.168.23.2 Proposal name: trans1 ipsec sa duration: 3600 seconds ipsec sa duration: 1843200 kilobytes OutBound SA has been established. InBound SA has been established. //路由器R1端的Tunnel狀態 ipsec policy name: p4 ipsec policy sequence: 400 negotiation mode: isakmp security acl: 3001 remote address 0:192.168.13.1 Proposal name: trans2 ipsec sa duration: 3600 seconds ipsec sa duration: 1843200 kilobytes OutBound SA has been established. InBound SA has been established. //路由器R2端的Tunnel狀態 正在 Ping 192.168.200.2 具有 32 位元組的數據: 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=9ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 來自 192.168.200.2 的回復: 位元組=32 時間=3ms TTL=254 //從PC1 ping PC2的情況

VirMach 便宜 VPS

QNews

QNews