F1060 IPSEC+IKE野蠻模式典型組網配置案例

2020 年 3 月 13 日
筆記

組網及說明

組網說明：

本案例採用H3C HCL模擬器的F1060防火牆來模擬IPSEC+IKE野蠻模式的典型組網配置。在網路拓撲圖中存在子網1和子網2.為了保障子網1和子網2相互傳輸數據的安全性，因此需要在FW1與FW2採用建立IPSEC VPN隧道，由於FW1的出介面地址不固定，因此採用IKE野蠻模式。

配置步驟

按照網路拓撲圖正確配置IP地址
FW1與FW2的互聯介面加入安全域，並放通域間策略
FW1與FW2建立IPSEC VPN隧道，採用IKE野蠻模式

配置關鍵點

ISP：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname ISP    [ISP]int gi 0/0    [ISP-GigabitEthernet0/0]des    [ISP-GigabitEthernet0/0]ip address 202.1.100.1 24    [ISP-GigabitEthernet0/0]dhcp server apply ip-pool 1    [ISP-GigabitEthernet0/0]quit    [ISP]int gi 0/1    [ISP-GigabitEthernet0/1]des    [ISP-GigabitEthernet0/1]ip address 202.2.100.1 30    [ISP-GigabitEthernet0/1]quit    [ISP]ip route-static 192.168.1.0 255.255.255.0 202.1.100.2    [ISP]ip route-static 172.16.1.0 255.255.255.0 202.2.100.2    [ISP]dhcp enable    [ISP]dhcp server ip-pool 1    [ISP-dhcp-pool-1]network 202.1.100.0 mask 255.255.255.0    [ISP-dhcp-pool-1]gateway-list 202.1.100.1    [ISP-dhcp-pool-1]quit

FW1：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname FW1    [FW1]int gi 1/0/3    [FW1-GigabitEthernet1/0/3]ip address 192.168.1.1 24    [FW1-GigabitEthernet1/0/3]quit    [FW1]int gi 1/0/2    [FW1-GigabitEthernet1/0/2]des    [FW1-GigabitEthernet1/0/2]ip address dhcp-alloc    [FW1-GigabitEthernet1/0/2]quit    [FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1    [FW1]security-zone name Trust    [FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3    [FW1-security-zone-Trust]quit    [FW1]security-zone name Untrust    [FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2    [FW1-security-zone-Untrust]quit    [FW1]acl basic 2001    [FW1-acl-ipv4-basic-2001]rule 0 permit source any    [FW1-acl-ipv4-basic-2001]quit    [FW1]    [FW1]zone-pair security source trust destination untrust    [FW1-zone-pair-security-Trust-Untrust]packet-filter 2001    [FW1-zone-pair-security-Trust-Untrust]quit    [FW1]    [FW1]zone-pair security source untrust destination trust    [FW1-zone-pair-security-Untrust-Trust]packet-filter 2001    [FW1-zone-pair-security-Untrust-Trust]quit    [FW1]    [FW1]zone-pair security source trust destination local    [FW1-zone-pair-security-Trust-Local]packet-filter 2001    [FW1-zone-pair-security-Trust-Local]quit    [FW1]    [FW1]zone-pair security source local destination trust    [FW1-zone-pair-security-Local-Trust]packet-filter 2001    [FW1-zone-pair-security-Local-Trust]quit    [FW1]    [FW1]zone-pair security source untrust destination local    [FW1-zone-pair-security-Untrust-Local]packet-filter 2001    [FW1-zone-pair-security-Untrust-Local]quit    [FW1]    [FW1]zone-pair security source local destination untrust    [FW1-zone-pair-security-Local-Untrust]packet-filter 2001    [FW1-zone-pair-security-Local-Untrust]quit

FW1 IPSEC+IKE野蠻模式關鍵配置點：

[FW1]acl advanced 3000    [FW1-acl-ipv4-adv-3000]rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255    [FW1-acl-ipv4-adv-3000]quit    [FW1]ike identity fqdn fw1    [FW1]ike keychain james    [FW1-ike-keychain-james]pre-shared-key address 202.2.100.2 255.255.255.252 key simple james    [FW1-ike-keychain-james]quit    [FW1]ike proposal 1    [FW1-ike-proposal-1]quit    [FW1]ike profile james    [FW1-ike-profile-james]keychain james    [FW1-ike-profile-james]proposal 1    [FW1-ike-profile-james]match remote identity address 202.2.100.2 255.255.255.252    [FW1-ike-profile-james]exchange-mode aggressive    [FW1-ike-profile-james]quit    [FW1]ipsec transform-set james    [FW1-ipsec-transform-set-james]protocol esp    [FW1-ipsec-transform-set-james]encapsulation-mode tunnel    [FW1-ipsec-transform-set-james]esp authentication-algorithm md5    [FW1-ipsec-transform-set-james]esp encryption-algorithm des-cbc    [FW1-ipsec-transform-set-james]quit    [FW1]ipsec policy james 1 isakmp    [FW1-ipsec-policy-isakmp-james-1]security acl 3000    [FW1-ipsec-policy-isakmp-james-1]transform-set james    [FW1-ipsec-policy-isakmp-james-1]ike-profile james    [FW1-ipsec-policy-isakmp-james-1]remote-address 202.2.100.2    [FW1-ipsec-policy-isakmp-james-1]quit    [FW1]int gi 1/0/2    [FW1-GigabitEthernet1/0/2]ipsec apply policy james    [FW1-GigabitEthernet1/0/2]quit

FW2：

sys    System View: return to User View with Ctrl+Z.    [H3C]sysname FW2    [FW2]int gi 1/0/3    [FW2-GigabitEthernet1/0/3]ip address 172.16.1.1 24    [FW2-GigabitEthernet1/0/3]quit    [FW2]int gi 1/0/2    [FW2-GigabitEthernet1/0/2]des    [FW2-GigabitEthernet1/0/2]ip address 202.2.100.2 30    [FW2-GigabitEthernet1/0/2]quit    [FW2]ip route-static 0.0.0.0 0.0.0.0 202.2.100.1    [FW2]security-zone name Untrust    [FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/2    [FW2-security-zone-Untrust]quit    [FW2]security-zone name Trust    [FW2-security-zone-Trust]import interface GigabitEthernet 1/0/3    [FW2-security-zone-Trust]quit    [FW2]zone-pair security source trust destination untrust    [FW2-zone-pair-security-Trust-Untrust]packet-filter 2001    [FW2-zone-pair-security-Trust-Untrust]quit    [FW2]    [FW2]zone-pair security source untrust destination trust    [FW2-zone-pair-security-Untrust-Trust]packet-filter 2001    [FW2-zone-pair-security-Untrust-Trust]quit    [FW2]    [FW2]zone-pair security source trust destination local    [FW2-zone-pair-security-Trust-Local]packet-filter 2001    [FW2-zone-pair-security-Trust-Local]quit    [FW2]    [FW2]zone-pair security source local destination trust    [FW2-zone-pair-security-Local-Trust]packet-filter 2001    [FW2-zone-pair-security-Local-Trust]quit    [FW2]    [FW2]zone-pair security source untrust destination local    [FW2-zone-pair-security-Untrust-Local]packet-filter 2001    [FW2-zone-pair-security-Untrust-Local]quit    [FW2]    [FW2]zone-pair security source local destination untrust    [FW2-zone-pair-security-Local-Untrust]packet-filter 2001    [FW2-zone-pair-security-Local-Untrust]quit

FW2 IPSEC+IKE野蠻模式關鍵配置點：

[FW2]acl advanced 3000    [FW2-acl-ipv4-adv-3000]rule 0 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255    [FW2-acl-ipv4-adv-3000]quit    [FW2]ike identity fqdn fw2    [FW2]ike proposal 1    [FW2-ike-proposal-1]quit    [FW2]ike keychain james    [FW2-ike-keychain-james]pre-shared-key hostname fw1 key simple james    [FW2-ike-keychain-james]quit    [FW2]ike profile james    [FW2-ike-profile-james]keychain james    [FW2-ike-profile-james]proposal 1    [FW2-ike-profile-james]match remote identity fqdn fw1    [FW2-ike-profile-james]exchange-mode aggressive    [FW2-ike-profile-james]quit    [FW2]ipsec transform-set james    [FW2-ipsec-transform-set-james]protocol esp    [FW2-ipsec-transform-set-james]encapsulation-mode tunnel    [FW2-ipsec-transform-set-james]esp authentication-algorithm md5    [FW2-ipsec-transform-set-james]esp encryption-algorithm des-cbc    [FW2-ipsec-transform-set-james]quit    [FW2]ipsec policy-template james 1    [FW2-ipsec-policy-template-james-1]security acl 3000    [FW2-ipsec-policy-template-james-1]transform-set james    [FW2-ipsec-policy-template-james-1]ike-profile james    [FW2-ipsec-policy-template-james-1]quit    [FW2]ipsec policy james 1 isakmp template james    [FW2]int gi 1/0/2    [FW2-GigabitEthernet1/0/2]ipsec apply policy james    [FW2-GigabitEthernet1/0/2]quit