IPSEC VPN 点到多点配置

《IPSEC VPN 点到多点配置》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、总部为静态IP地址，分支为动态拨号获得IP地址不稳定。搭建IPSECVPN总部USG-1配置[USG-1]firewallzonetrust[USG-1-zone-trust]addintg0/0/0[USG-1-zone-trust]quit[USG-1]firewallzonuntrust[USG-1-zone-untrust]addintg0/0/1[USG-1-zone-untrust]quit[USG-1]iproute-static0.0.0.00.0.0.011.0.0.1[USG-1]intg0/0/1[USG-1-GigabitEthernet

2、0/0/1]ipadd11.0.0.224[USG-1-GigabitEthernet0/0/1]intg0/0/0[USG-1-GigabitEthernet0/0/0]ipadd192.168.10.124[USG-1-GigabitEthernet0/0/0]quit------------------------阶段一----------------------------[USG-1]ikeproposal1//配置一个安全提议[USG-1-ike-proposal-1]authentication-methodpre-share//配置IKE认证方式

3、为预共享密钥[USG-1-ike-proposal-1]authentication-algorithmsha1//配置IKE认证算法为sha1[USG-1-ike-proposal-1]integrity-algorithmaes-xcbc-96//配置IKE完整性算法[USG-1-ike-proposal-1]dhgroup2//配置IKE密钥协商DH组[USG-1-ike-proposal-1]quit[USG-1]ikepeerusg-n//创建一个IKE对等体名字为usg-n[USG-1-ike-peer-usg-n]ike-proposal1//调用

4、ike安全提议[USG-1-ike-peer-usg-n]pre-shared-keyabc123//配置预共享密钥[USG-1-ike-peer-usg-n]quit注意：由于对端地址不是固定的所以不需要指定对端地址------------------------阶段二-----------------------------[USG-1]ipsecproposaltest //配置一个ipsec安全提议[USG-1-ipsec-proposal-test]encapsulation-modetunnel//封装方式采用隧道[USG-1-ipsec-propo

5、sal-test]transformesp//配置IPSEC安全协议为ESP[USG-1-ipsec-proposal-test]espauthentication-algorithmsha1//配置ESP协议认证算法[USG-1-ipsec-proposal-test]espencryption-algorithmaes//配置ESP协议加密算法为aes[USG-1-ipsec-proposal-test]quit[USG-1]acl3000//创建一个ACL定义感兴趣流[USG-1-acl-adv-3000]rulepermitipsource192.168

6、.10.00.0.0.255destination192.168.20.00.0.0.255[USG-1-acl-adv-3000]quit-------------------------配置策略模板-----------------------------[USG-1]ipsecpolicy-templatetem1//创建一个策略模板[USG-1-ipsec-policy-template-tem-1]ike-peerusg-n//调用ike对等体[USG-1-ipsec-policy-template-tem-1]proposaltest//调用IPse

7、c安全提议[USG-1-ipsec-policy-template-tem-1]securityacl3000//配置感兴趣流[USG-1-ipsec-policy-template-tem-1]quit[USG-1]ipsecpolicymap1isakmptemplatetem//创建一个策略叫map然后和配置模板关联起来[USG-1]intg0/0/1[USG-1-GigabitEthernet0/0/1]ipsecpolicymap//接口下调用策略[USG-1-GigabitEthernet0/0/1]quit区域间策略配置[USG-1]policyi

8、nterzonetrus