{"id":824,"date":"2019-09-19T04:02:15","date_gmt":"2019-09-19T04:02:15","guid":{"rendered":"https:\/\/www.jayjaydream.com\/?p=824"},"modified":"2019-09-19T09:47:04","modified_gmt":"2019-09-19T09:47:04","slug":"%e5%8d%8e%e4%b8%ba%e9%98%b2%e7%81%ab%e5%a2%99%e9%85%8d%e7%bd%ae%e7%82%b9%e5%88%b0%e5%a4%9a%e7%82%b9ipsec%e9%9a%a7%e9%81%93","status":"publish","type":"post","link":"https:\/\/www.jayjaydream.com\/?p=824","title":{"rendered":"\u534e\u4e3a\u9632\u706b\u5899\u914d\u7f6e\u70b9\u5230\u591a\u70b9IPSec\u96a7\u9053"},"content":{"rendered":"

\u5206\u652f\u673a\u6784\u901a\u8fc7IPSec\u53ccVPN\u96a7\u9053\u8fde\u63a5\u5230\u603b\u516c\u53f8\u548c\u4e0a\u7ea7\u5206\u652f\u673a\u6784<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u901a\u8fc7PPPoE\u63a5\u5165\u94fe\u8def\uff0c\u5206\u522b\u5411\u4e24\u4e2a\u7701\u7ea7\u5206\u652f\u673a\u6784\u5efa\u7acbIPSec VPN\u96a7\u9053\u3002\u4e14\u5e02\u7ea7\u5206\u652f\u673a\u6784\u4e2d\u4e0d\u540c\u7684VLAN\u8bbe\u5907\u5206\u522b\u56fa\u5b9a\u5730\u8bbf\u95ee\u4e0d\u540c\u7684\u7701\u7ea7\u5206\u652f\u673a\u6784\u670d\u52a1\u5668\u3002\u53ef\u4ee5\u5206\u522b\u5728\u4e24\u4e2a\u7701\u7ea7\u5206\u652f\u673a\u6784\u5efa\u7acb\u7b56\u7565\u6a21\u677f\u65b9\u5f0f\u7684IPSec\u96a7\u9053\u3002<\/p>\n

\u7ec4\u7f51\u9700\u6c42<\/h2>\n

\u7ec4\u7f51\u60c5\u51b5\u5982\u4e0b\uff1a<\/p>\n

\u67d0\u4f01\u4e1a\u6309\u5730\u57df\u5206\u4e3a\u5e02\u7ea7\u5206\u652f\u673a\u6784\u3001\u7701\u7ea7\u5206\u652f\u673a\u6784\u3001\u603b\u90e8\u4e09\u4e2a\u90e8\u5206\u3002USG_A\u3001USG_B\u3001USG_C\u5206\u522b\u4f5c\u4e3a\u5bf9\u5e94\u533a\u57df\u7684VPN\u7f51\u5173\u8bbe\u5907\u3002<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u7531\u4ea4\u6362\u673a\u8fde\u63a5\u4e09\u4e2a\u7cfb\u7edf\uff0c\u5373ERP\u7cfb\u7edf\u3001OA\u7cfb\u7edf\u548c\u8d22\u52a1\u7cfb\u7edf\u3002\u4e3a\u8282\u7ea6IP\u8d44\u6e90\uff0c\u5e02\u7ea7\u5206\u652f\u673a\u6784\u901a\u8fc7PPPoE\u62e8\u53f7\u63a5\u5165Internet\u7f51\u7edc\u3002<\/p>\n

\u8be5\u4f01\u4e1a\u7f51\u7edc\u9700\u5b9e\u73b0\u4ee5\u4e0b\u9700\u6c42\uff1a<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u4e2dOA\u7cfb\u7edf\u548cERP\u7cfb\u7edf\u7684\u6570\u636e\u9700\u8981\u53d1\u9001\u7ed9\u7701\u7ea7\u5206\u652f\u673a\u6784\u76f8\u5e94\u7684\u670d\u52a1\u5668\u8fdb\u884c\u65e5\u5e38\u529e\u516c\uff0c\u8d22\u52a1\u7cfb\u7edf\u7684\u6570\u636e\u9700\u8981\u4e0a\u62a5\u7ed9\u603b\u90e8\u7684\u8d22\u52a1\u7ba1\u7406\u670d\u52a1\u5668\u8fdb\u884c\u5206\u6790\u3002\u8fd9\u4e24\u79cd\u901a\u4fe1\u4e2d\uff0c\u4f20\u8f93\u7684\u6570\u636e\u90fd\u9700\u8981\u52a0\u5bc6\u3002<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u4e09\u4e2a\u7cfb\u7edf\u4e4b\u95f4\u5141\u8bb8\u8fdb\u884c\u901a\u4fe1\uff0c\u4e09\u4e2a\u7cfb\u7edf\u4e2d\u8bbe\u5907\u7684IP\u5730\u5740\u90fd\u8981\u7531USG_A\u7edf\u4e00\u5206\u914d\u3002<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u4e09\u4e2a\u7cfb\u7edf\u4e0d\u5141\u8bb8\u4ee5\u4efb\u4f55\u5f62\u5f0f\u8bbf\u95eeInternet\u3002<\/p>\n

\u914d\u7f6e\u5e02\u7ea7\u5206\u652f\u673a\u6784\u901a\u8fc7\u53ccVPN\u96a7\u9053\u8fde\u63a5\u5230\u603b\u90e8\u548c\u7701\u7ea7\u5206\u652f\u673a\u6784<\/p>\n

\"\u534e\u4e3a\u9632\u706b\u5899\u914d\u7f6e\u70b9\u5230\u591a\u70b9IPSec\u96a7\u9053<\/p>\n

\u7f51\u7edc\u89c4\u5212<\/h2>\n

\u7531\u4e8e\u4e0d\u540c\u7684\u7cfb\u7edf\u9700\u8981\u5b9e\u73b0\u4e0d\u540c\u7684\u4e1a\u52a1\uff0c\u4e3a\u4fdd\u8bc1\u4e1a\u52a1\u72ec\u7acb\uff0c\u6545\u5c06\u4e09\u4e2a\u7cfb\u7edf\u5206\u522b\u5212\u5206\u57283\u4e2aVLAN\u4e2d\uff0c\u5373VLAN10\u3001VLAN20\u548cVLAN30\u3002VLAN10\u4e3aOA\u7cfb\u7edf\u4f7f\u7528\uff1bVLAN20\u4e3aERP\u7cfb\u7edf\u4f7f\u7528\uff1bVLAN30\u4e3a\u8d22\u52a1\u7cfb\u7edf\u4f7f\u7528\u3002<\/p>\n

\u4e3a\u65b9\u4fbf\u7ba1\u7406\uff0cVLAN10\u3001VLAN20\u548cVLAN30\u4e2d\u7684\u8bbe\u5907\u8bbe\u7f6e\u4e3a\u81ea\u52a8\u83b7\u53d6IP\u5730\u5740\uff0c\u7531USG_A\u901a\u8fc7DHCP\u6765\u5206\u914d\u5730\u5740\u3002<\/p>\n

USG_A\u8fde\u63a5\u4ea4\u6362\u673a\u7684\u63a5\u53e3\u914d\u7f6e\u4e09\u4e2a\u5b50\u63a5\u53e3\uff0c\u5206\u522b\u5bf9\u5e94VLAN10\u3001VLAN20\u548cVLAN30\u3002<\/p>\n

\u5e02\u7ea7\u5206\u652f\u673a\u6784\u548c\u603b\u90e8\u3001\u5e02\u7ea7\u5206\u652f\u673a\u6784\u548c\u7701\u7ea7\u5206\u652f\u673a\u6784\u4e4b\u95f4\u7684\u901a\u4fe1\u6570\u636e\u90fd\u8981\u7ecf\u8fc7IPSec\u52a0\u5bc6\uff0c\u6545\u9700\u8981\u5728USG_A\u4e0eUSG_B\u4e4b\u95f4\u4ee5\u53caUSG_A\u548cUSG_C\u5206\u522b\u5efa\u7acb\u4e00\u6761IPSec\u96a7\u9053\u3002<\/p>\n

\u914d\u7f6eIPSec\u96a7\u9053\u65f6\uff0c\u7531\u5e02\u7ea7\u5206\u652f\u673a\u6784\u7cfb\u7edf\u4e3b\u52a8\u53d1\u8d77\u8fde\u63a5\uff0c\u6545\u603b\u90e8\u548c\u7701\u7ea7\u5206\u652f\u673a\u6784\u7684VPN\u914d\u7f6e\u91c7\u7528\u7b56\u7565\u6a21\u677f\u65b9\u5f0f\u5efa\u7acbIPSec\u7b56\u7565\uff0c\u63a5\u53d7\u5e02\u7ea7\u5206\u652f\u673a\u6784\u53d1\u8d77\u7684\u8bbf\u95ee\u3002<\/p>\n

\u7531\u4e8eUSG_A\u901a\u8fc7PPPoE\u62e8\u53f7\u4e0a\u7f51\uff0c\u6ca1\u6709\u56fa\u5b9aIP\u5730\u5740\uff0c\u5176IPSec\u7b56\u7565\u8981\u5e94\u7528\u5728Dialer\u63a5\u53e3\u4e0a\u3002<\/p>\n

\u64cd\u4f5c\u6b65\u9aa4<\/h2>\n

\u914d\u7f6eUSG_A\u3002<\/p>\n

1.\u914d\u7f6ePPPoE\u62e8\u53f7\u3002<\/p>\n

# \u5047\u8bbe\u5728PPPoE Server\u7aef\u7684\u672c\u5730\u7528\u6237\u540d\u8bbe\u7f6e\u4e3aeee\uff0c\u5bc6\u7801\u8bbe\u7f6e\u4e3aAdmin@123\uff0c\u8ba4\u8bc1\u65b9\u5f0f\u4e3aPAP\u3002<\/p>\n

[USG_A] dialer-rule 9 ip permit<\/p>\n

[USG_A] interface dialer 9<\/p>\n

[USG_A-Dialer9] dialer user eee<\/p>\n

[USG_A-Dialer9] dialer-group 9<\/p>\n

[USG_A-Dialer9] dialer bundle 9<\/p>\n

[USG_A-Dialer9] ip address ppp-negotiate<\/p>\n

[USG_A-Dialer9] ppp pap local-user eee password cipher Admin@123<\/p>\n

[USG_A-Dialer9] quit<\/p>\n

[USG_A] interface GigabitEthernet 0\/0\/2<\/p>\n

[USG_A-GigabitEthernet0\/0\/2] pppoe-client dial-bundle-number 9<\/p>\n

[USG_A-GigabitEthernet0\/0\/2] quit<\/p>\n

\u914d\u7f6eDialer\u53e3\u540e\uff0c\u53ef\u6267\u884cdisplay pppoe-client session summary\u547d\u4ee4\u6765\u67e5\u770bPPPoE\u4f1a\u8bdd\u62a5\u6587\u6982\u8981\u4fe1\u606f\u3002\u51fa\u73b0\u4ee5\u4e0b\u7ed3\u679c\u540e\uff0c\u8bf4\u660e\u62e8\u53f7\u914d\u7f6e\u6210\u529f\uff0c\u5e76\u4e14\u5df2\u7ecf\u5206\u914d\u4e86IP\u5730\u5740\u3002<\/p>\n

[USG_A] display pppoe-client session summary<\/p>\n

PPPoE Client Session:<\/p>\n

ID\u00a0 \u00a0Bundle\u00a0\u00a0Dialer\u00a0\u00a0Intf\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0 Client-MAC\u00a0 \u00a0 Server-MAC\u00a0 \u00a0 State<\/p>\n

1\u00a0 \u00a0 9\u00a0 \u00a0\u00a0 \u00a0 9\u00a0 \u00a0\u00a0 \u00a0 GE0\/0\/2\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0 0022a1002259\u00a0\u00a00022a10011aa\u00a0\u00a0PPPUP\u00a0\u00a0[USG_A] disply ip interface brief<\/p>\n

*down: administratively down<\/p>\n

(s): spoofing<\/p>\n

Interface\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0 IP Address\u00a0 \u00a0\u00a0 \u00a0Physical Protocol Description<\/p>\n

Dialer9\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0 \u00a0110.1.1.2\u00a0 \u00a0\u00a0 \u00a0\u00a0\u00a0up\u00a0 \u00a0\u00a0 \u00a0 up(s)<\/p>\n

# \u5c06\u63a5\u53e3\u52a0\u5165\u5230\u5b89\u5168\u533a\u57df\u3002<\/p>\n

[USG_A] firewall zone untrust<\/p>\n

[USG_A-zone-untrust] add interface GigabitEthernet 0\/0\/2<\/p>\n

[USG_A-zone-untrust] add interface dialer 9<\/p>\n

[USG_A-zone-untrust] quit<\/p>\n

# \u57df\u95f4\u914d\u7f6e\u5305\u8fc7\u6ee4\u3002<\/p>\n

[USG_A] firewall packet-filter default permit all<\/p>\n

\u7a8d\u95e8\uff1a<\/p>\n

firewall packet-filter default permit all\u547d\u4ee4\u4e2d\uff0c\u6253\u5f00\u4e86\u6240\u6709\u5b89\u5168\u533a\u57df\u95f4\u7684\u5305\u8fc7\u6ee4\u3002\u8bf7\u6839\u636e\u7f51\u7edc\u60c5\u51b5\u5173\u95ed\u4e0d\u9700\u8981\u5f00\u653e\u7684\u57df\u95f4\u7f3a\u7701\u5305\u8fc7\u6ee4\u3002<\/p>\n

2.\u914d\u7f6e\u5e02\u7ea7\u5206\u652f\u673a\u6784\u5185\u7f51IP\u5730\u5740\u3002<\/p>\n

# \u914d\u7f6e\u5b50\u63a5\u53e3\uff0c\u5e76\u5212\u5206VLAN\u3002\u5728\u5b50\u63a5\u53e3\u4e0a\u914d\u7f6eDHCP\uff0c\u4e3a\u5185\u7f51\u8bbe\u5907\u5206\u914dIP\u5730\u5740\u3002<\/p>\n

[USG_A] interface GigabitEthernet 0\/0\/1.1<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.1] vlan-type dot1q 10<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.1] ip address 10.10.10.1 255.255.255.0<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.1] dhcp select interface<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.1] quit[USG_A] interface GigabitEthernet 0\/0\/1.2<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.2] vlan-type dot1q 20<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.2] ip address 10.10.20.1 255.255.255.0<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.2] dhcp select interface<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.2] quit[USG_A] interface GigabitEthernet 0\/0\/1.3<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.3] vlan-type dot1q 30<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.3] ip address 192.168.1.1 255.255.255.0<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.3] dhcp select interface<\/p>\n

[USG_A-GigabitEthernet0\/0\/1.3] quit<\/p>\n

# \u5c06\u63a5\u53e3\u52a0\u5165\u5230\u5b89\u5168\u533a\u57df\u3002<\/p>\n

[USG_A] firewall zone trust<\/p>\n

[USG_A-zone-trust] add interface GigabitEthernet 0\/0\/1.1<\/p>\n

[USG_A-zone-trust] add interface GigabitEthernet 0\/0\/1.2<\/p>\n

[USG_A-zone-trust] add interface GigabitEthernet 0\/0\/1.3<\/p>\n

[USG_A-zone-trust] quit<\/p>\n

\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u5728VLAN10\u3001VLAN20\u548cVLAN30\u7684\u8bbe\u5907\u4e0a\u90fd\u8bbe\u7f6e\u4e3a\u81ea\u52a8\u83b7\u53d6IP\u5730\u5740\uff0c\u5219\u53ef\u4ee5\u770b\u5230\u88ab\u5206\u914d\u4e86\u4e0e\u76f8\u5e94\u5b50\u63a5\u53e3\u5728\u540c\u4e00\u7f51\u6bb5\u7684IP\u5730\u5740\u3002\u5982\uff0c\u5728VLAN10\u5185\u7684\u8bbe\u5907\u4e0a\u53ef\u67e5\u770b\u5230\u81ea\u52a8\u83b7\u53d6\u4e8610.10.10.0\/24\u7f51\u6bb5\u7684IP\u5730\u5740\u3002<\/p>\n

3.\u914d\u7f6eIPSec\u529f\u80fd\u3002<\/p>\n

a\u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff0c\u5b9a\u4e49\u8981\u4fdd\u62a4\u7684\u6570\u636e\u6d41\u3002<\/p>\n

# \u914d\u7f6e\u6e90IP\u5730\u5740\u4e3a10.10.0.0\/16\u3001\u76ee\u7684IP\u5730\u5740\u4e3a10.10.1.0\/24\u7684\u89c4\u5219\u3002<\/p>\n

[USG_A] acl 3000<\/p>\n

[USG_A-acl-adv-3000] rule permit ip source 10.10.0.0 0.0.255.255 destination 10.10.1.0 0.0.0.255<\/p>\n

[USG_A-acl-adv-3000] quit<\/p>\n

# \u914d\u7f6e\u6e90IP\u5730\u5740\u4e3a192.168.1.0\/24\u3001\u76ee\u7684IP\u5730\u5740\u4e3a10.10.2.0\/24\u7684\u89c4\u5219\u3002<\/p>\n

[USG_A] acl 3001<\/p>\n

[USG_A-acl-adv-3001] rule permit ip source 192.168.1.0 0.0.0.255 destination 10.10.2.0 0.0.0.255<\/p>\n

[USG_A-acl-adv-3001] quit<\/p>\n

b\u914d\u7f6eUSG_A\u5230\u8fbeUSG_B\u548cUSG_C\u7684\u9759\u6001\u8def\u7531\u3002<\/p>\n

[USG_A] ip route-static 0.0.0.0 0.0.0.0 Dialer 9<\/p>\n

c\u521b\u5efaIPSec\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_A] ipsec proposal tran1<\/p>\n

[USG_A-ipsec-proposal-tran1] encapsulation-mode tunnel<\/p>\n

[USG_A-ipsec-proposal-tran1] transform esp<\/p>\n

[USG_A-ipsec-proposal-tran1] esp authentication-algorithm sha1<\/p>\n

[USG_A-ipsec-proposal-tran1] esp encryption-algorithm des<\/p>\n

[USG_A-ipsec-proposal-tran1] quit[USG_A] ipsec proposal tran2<\/p>\n

[USG_A-ipsec-proposal-tran2] encapsulation-mode tunnel<\/p>\n

[USG_A-ipsec-proposal-tran2] transform esp<\/p>\n

[USG_A-ipsec-proposal-tran2] esp authentication-algorithm sha1<\/p>\n

[USG_A-ipsec-proposal-tran2] esp encryption-algorithm des<\/p>\n

[USG_A-ipsec-proposal-tran2] quit<\/p>\n

d\u521b\u5efaIKE\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_A] ike proposal 10<\/p>\n

[USG_A-ike-proposal-10] authentication-method pre-share<\/p>\n

[USG_A-ike-proposal-10] authentication-algorithm md5<\/p>\n

[USG_A-ike-proposal-10] quit<\/p>\n

[USG_A] ike proposal 11<\/p>\n

[USG_A-ike-proposal-11] authentication-method pre-share<\/p>\n

[USG_A-ike-proposal-11] authentication-algorithm md5<\/p>\n

[USG_A-ike-proposal-11] quit<\/p>\n

e \u914d\u7f6eIKE\u672c\u5730\u7528\u6237\u540d\u3002<\/p>\n

[USG_A] ike local-name USG_A<\/p>\n

f \u914d\u7f6eIKE peer\u3002<\/p>\n

[USG_A] ike peer a1<\/p>\n

[USG_A-ike-peer-a1] local-id-type fqdn<\/p>\n

[USG_A-ike-peer-a1] remote-id USG_B<\/p>\n

[USG_A-ike-peer-a1] remote-address 202.38.10.1<\/p>\n

[USG_A-ike-peer-a1] ike-proposal 10<\/p>\n

[USG_A-ike-peer-a1] pre-shared-key Key123<\/p>\n

[USG_A-ike-peer-a1] quit[USG_A] ike peer a2<\/p>\n

[USG_A-ike-peer-a2] local-id-type fqdn<\/p>\n

[USG_A-ike-peer-a2] remote-id USG_C<\/p>\n

[USG_A-ike-peer-a2] remote-address 202.38.20.1<\/p>\n

[USG_A-ike-peer-a2] ike-proposal 11<\/p>\n

[USG_A-ike-peer-a2] pre-shared-key Key456<\/p>\n

[USG_A-ike-peer-a2] quit<\/p>\n

g \u521b\u5efa\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_A] ipsec policy map1 10 isakmp<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-10] security acl 3000<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-10] proposal tran1<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-10] ike-peer a1<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-10] quit[USG_A] ipsec policy map1 11 isakmp<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-11] security acl 3001<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-11] proposal tran2<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-11] ike-peer a2<\/p>\n

[USG_A-ipsec-policy-isakmp-map1-11] quit<\/p>\n

h \u5728Dialer\u63a5\u53e3\u4e0a\u5f15\u7528\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_A] interface Dialer 9<\/p>\n

[USG_A-Dialer9] ipsec policy map1<\/p>\n

\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u53ef\u6267\u884cdisplay ipsec policy\u547d\u4ee4\u67e5\u770bIPSec\u7684\u914d\u7f6e\u60c5\u51b5\u3002\u51fa\u73b0\u4ee5\u4e0b\u663e\u793a\u4fe1\u606f\u8bf4\u660e\u914d\u7f6e\u6210\u529f\u3002<\/p>\n

[USG_A] display ipsec policy name map1<\/p>\n

===========================================<\/p>\n

IPsec Policy Group: “map1”<\/p>\n

Using interface: {Dialer9}<\/p>\n

===========================================<\/p>\n

—————————–<\/p>\n

IPsec policy name: “map1”<\/p>\n

sequence number: 10<\/p>\n

mode: isakmp<\/p>\n

state: active<\/p>\n

—————————–<\/p>\n

security data flow : 3000<\/p>\n

ike-peer name:\u00a0\u00a0a1<\/p>\n

perfect forward secrecy: None<\/p>\n

proposal name:\u00a0\u00a0tran1<\/p>\n

IPsec sa local duration(time based): 22222 seconds<\/p>\n

sa soft-duration time-based buffer: 22200 seconds<\/p>\n

sa soft-duration traffic-based buffer: 22200 kilobytes<\/p>\n

IPsec sa local duration(traffic based): 22222 kilobytes<\/p>\n

IPSec sa anti-replay: use global<\/p>\n

IPSec sa anti-replay window-size: use global<\/p>\n

—————————–<\/p>\n

IPsec policy name: “map1”<\/p>\n

sequence number: 11<\/p>\n

mode: isakmp<\/p>\n

state: active<\/p>\n

—————————–<\/p>\n

security data flow : 3001<\/p>\n

ike-peer name:\u00a0\u00a0a2<\/p>\n

perfect forward secrecy: None<\/p>\n

proposal name:\u00a0\u00a0tran2<\/p>\n

IPsec sa local duration(time based): 22222 seconds<\/p>\n

sa soft-duration time-based buffer: 22200 seconds<\/p>\n

sa soft-duration traffic-based buffer: 22200 kilobytes<\/p>\n

IPsec sa local duration(traffic based): 22222 kilobytes<\/p>\n

IPSec sa anti-replay: use global<\/p>\n

IPSec sa anti-replay window-size: use global<\/p>\n

\u914d\u7f6eUSG_B\u7684IPSec\u529f\u80fd<\/h2>\n

1.\u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff0c\u5b9a\u4e49\u8981\u4fdd\u62a4\u7684\u6570\u636e\u6d41\u3002<\/p>\n

# \u914d\u7f6e\u6e90IP\u5730\u5740\u4e3a10.10.1.0\/24\u3001\u76ee\u7684\u5730\u5740\u4e3a10.10.0.0\/16\u7684\u89c4\u5219\u3002<\/p>\n

[USG_B] acl 3000<\/p>\n

[USG_B-acl-adv-3000] rule permit ip source 10.10.1.0 0.0.0.255 destination 10.10.0.0 0.0.255.255<\/p>\n

[USG_B-acl-adv-3000] quit<\/p>\n

2.\u914d\u7f6eUSG_B\u5230\u8fbeUSG_A\u7684\u9759\u6001\u8def\u7531\uff0c\u5047\u8bbe\u4e0b\u4e00\u8df3\u5730\u5740\u4e3a202.38.10.2\u3002<\/p>\n

[USG_B] ip route-static 10.10.0.0 255.255.0.0 202.38.10.2<\/p>\n

3.\u521b\u5efaIPSec\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_B] ipsec proposal tran1<\/p>\n

[USG_B-ipsec-proposal-tran1] encapsulation-mode tunnel<\/p>\n

[USG_B-ipsec-proposal-tran1] transform esp<\/p>\n

[USG_B-ipsec-proposal-tran1] esp authentication-algorithm sha1<\/p>\n

[USG_B-ipsec-proposal-tran1] esp encryption-algorithm des<\/p>\n

[USG_B-ipsec-proposal-tran1] quit<\/p>\n

4.\u521b\u5efaIKE\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_B] ike proposal 10<\/p>\n

[USG_B-ike-proposal-10] authentication-method pre-share<\/p>\n

[USG_B-ike-proposal-10] authentication-algorithm md5<\/p>\n

[USG_B-ike-proposal-10] quit<\/p>\n

5.\u914d\u7f6eIKE\u672c\u5730\u7528\u6237\u540d\u3002<\/p>\n

[USG_B] ike local-name USG_B<\/p>\n

6.\u914d\u7f6eIKE peer\u3002<\/p>\n

[USG_B] ike peer b<\/p>\n

[USG_B-ike-peer-b] local-id-type fqdn<\/p>\n

[USG_B-ike-peer-b] remote-id USG_A<\/p>\n

[USG_B-ike-peer-b] ike-proposal 10<\/p>\n

[USG_B-ike-peer-b] pre-shared-key Key123<\/p>\n

[USG_B-ike-peer-b] quit<\/p>\n

7.\u521b\u5efa\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_B] ipsec policy-template map_temp 1<\/p>\n

[USG_B-ipsec-policy-templet-map_temp-1] security acl 3000<\/p>\n

[USG_B-ipsec-policy-templet-map_temp-1] proposal tran1<\/p>\n

[USG_B-ipsec-policy-templet-map_temp-1] ike-peer b<\/p>\n

[USG_B-ipsec-policy-templet-map_temp-1] quit<\/p>\n

[USG_B] ipsec policy map1 10 isakmp template map_temp<\/p>\n

8.\u5728\u7269\u7406\u63a5\u53e3\u4e0a\u5f15\u7528\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_B] interface GigabitEthernet 0\/0\/2<\/p>\n

[USG_B-GigabitEthernet0\/0\/2] ipsec policy map1<\/p>\n

\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u53ef\u6267\u884cdisplay ipsec policy\u547d\u4ee4\u67e5\u770bIPSec\u7684\u914d\u7f6e\u60c5\u51b5\u3002\u51fa\u73b0\u4ee5\u4e0b\u663e\u793a\u4fe1\u606f\u8bf4\u660e\u914d\u7f6e\u6210\u529f\u3002<\/p>\n

<USG_B> display ipsec policy name map1<\/p>\n

===========================================<\/p>\n

IPsec Policy Group: “map1”<\/p>\n

Using interface: {GigabitEthernet0\/0\/2}<\/p>\n

===========================================<\/p>\n

—————————–<\/p>\n

IPsec policy name: “map1”<\/p>\n

sequence number: 10<\/p>\n

mode: template<\/p>\n

state: active<\/p>\n

—————————–<\/p>\n

policy template name: map_temp<\/p>\n

\u914d\u7f6eUSG_C\u7684IPSec\u529f\u80fd<\/h2>\n

1.\u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff0c\u5b9a\u4e49\u8981\u4fdd\u62a4\u7684\u6570\u636e\u6d41\u3002<\/p>\n

# \u914d\u7f6e\u6e90IP\u5730\u5740\u4e3a10.10.2.0\/24\uff0c\u76ee\u7684\u5730\u5740\u4e3a192.168.1.0\/24\u7684\u89c4\u5219\u3002<\/p>\n

[USG_C] acl 3000<\/p>\n

[USG_C-acl-adv-3000] rule permit ip source 10.10.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255<\/p>\n

[USG_C-acl-adv-3000] quit<\/p>\n

2.\u914d\u7f6eUSG_C\u5230\u8fbeUSG_A\u7684\u9759\u6001\u8def\u7531\uff0c\u5047\u8bbe\u4e0b\u4e00\u8df3\u5730\u5740\u4e3a202.38.20.2\u3002<\/p>\n

[USG_C] ip route-static 192.168.1.0 255.255.255.0 202.38.20.2<\/p>\n

3.\u521b\u5efaIPSec\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_C] ipsec proposal tran1<\/p>\n

[USG_C-ipsec-proposal-tran1] encapsulation-mode tunnel<\/p>\n

[USG_C-ipsec-proposal-tran1] transform esp<\/p>\n

[USG_C-ipsec-proposal-tran1] esp authentication-algorithm sha1<\/p>\n

[USG_C-ipsec-proposal-tran1] esp encryption-algorithm des<\/p>\n

[USG_C-ipsec-proposal-tran1] quit<\/p>\n

4.\u521b\u5efaIKE\u5b89\u5168\u63d0\u8bae\u3002<\/p>\n

[USG_C] ike proposal 10<\/p>\n

[USG_C-ike-proposal-10] authentication-method pre-share<\/p>\n

[USG_C-ike-proposal-10] authentication-algorithm md5<\/p>\n

[USG_C-ike-proposal-10] quit<\/p>\n

5.\u914d\u7f6eIKE\u672c\u5730\u7528\u6237\u540d\u3002<\/p>\n

[USG_C] ike local-name USG_C<\/p>\n

6.\u914d\u7f6eIKE peer\u3002<\/p>\n

[USG_C] ike peer c<\/p>\n

[USG_C-ike-peer-c] local-id-type fqdn<\/p>\n

[USG_C-ike-peer-c] remote-id USG_A<\/p>\n

[USG_C-ike-peer-c] ike-proposal 10<\/p>\n

[USG_C-ike-peer-c] pre-shared-key Key456<\/p>\n

[USG_C-ike-peer-c] quit<\/p>\n

7.\u521b\u5efa\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_C] ipsec policy-template map_temp 1<\/p>\n

[USG_C-ipsec-policy-templet-map_temp-1] security acl 3000<\/p>\n

[USG_C-ipsec-policy-templet-map_temp-1] proposal tran1<\/p>\n

[USG_C-ipsec-policy-templet-map_temp-1] ike-peer c<\/p>\n

[USG_C-ipsec-policy-templet-map_temp-1] quit<\/p>\n

[USG_C] ipsec policy map1 10 isakmp template map_temp<\/p>\n

8.\u5728\u7269\u7406\u63a5\u53e3\u4e0a\u5f15\u7528\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

[USG_C] interface GigabitEthernet 0\/0\/2<\/p>\n

[USG_C-GigabitEthernet0\/0\/2] ipsec policy map1<\/p>\n

\u914d\u7f6e\u5b8c\u6210\u540e\uff0c\u53ef\u6267\u884cdisplay ipsec policy\u547d\u4ee4\u67e5\u770bIPSec\u7684\u914d\u7f6e\u60c5\u51b5\u3002\u51fa\u73b0\u4ee5\u4e0b\u663e\u793a\u4fe1\u606f\u8bf4\u660e\u914d\u7f6e\u6210\u529f\u3002<\/p>\n

<USG_C> display ipsec policy name map1<\/p>\n

===========================================<\/p>\n

IPsec Policy Group: “map1”<\/p>\n

Using interface: {GigabitEthernet0\/0\/2}<\/p>\n

===========================================<\/p>\n

—————————–<\/p>\n

IPsec policy name: “map1”<\/p>\n

sequence number: 10<\/p>\n

mode: template<\/p>\n

state: active<\/p>\n

—————————–<\/p>\n

policy template name: map_temp<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u5206\u652f\u673a\u6784\u901a\u8fc7IPSec\u53ccVPN\u96a7\u9053\u8fde\u63a5\u5230\u603b\u516c\u53f8\u548c\u4e0a\u7ea7\u5206\u652f\u673a\u6784 \u5e02\u7ea7\u5206\u652f\u673a\u6784\u901a\u8fc7P … \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[63],"class_list":["post-824","post","type-post","status-publish","format-standard","hentry","category-27","tag-63"],"_links":{"self":[{"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/posts\/824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=824"}],"version-history":[{"count":6,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/posts\/824\/revisions"}],"predecessor-version":[{"id":835,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=\/wp\/v2\/posts\/824\/revisions\/835"}],"wp:attachment":[{"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=824"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jayjaydream.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}