ipsecvpn站点到站点配置

《ipsecvpn站点到站点配置》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、11.0.0.2/2411.0.0.1/2412.0.0.2/24USG-1GE0/0/0USG-2192.168.10•1/24JGECVOA)AR112.0.0.1/24192.168.20.1/24E0/0/0Ethernet0/0/1CLIENT1ernet0/0/1CLIENT2192.168.20.10/24192.168.10.10/24实验需求USG-1和USG-2模拟企业边缘设备，分别在2台设备上配置NAT和IPsecVPN实现2边私网可以通过VPN互相通信实验配置R1IP地址配置省略USG-1配置[USG-1]firewallzonetrust〃配置trust区

2、域[USG-l-zone-trust]addinterfaceg0/0/0//将接口加入trust区域[USG-1-zone-trust]quit[USG-l-zone-untrust]addintgO/O/1//将接口加入untrust区域[USGT-zone-untrust]quit[USG-l]intg0/0/0[USG-l-GigabitEthernetO/O/O]ipadd192.168.10.124[USG-l-GigabitEthernetO/O/O]intg0/0/l[USG-l-GigabitEthernetO/O/1]ipadd11.0.0.224[USG-1-

3、GigabitEthernet0/0/1]quit[USG-l]iproute-static0.0.0.00.0.0.011.0.0.1//配置默认路由上公网[USG-l]nat-policyinterzonetrustuntrustoutbound//进入trust到untrust区域out方向的策略视图[USG-l-nat-policy-interzone-trust-untrust-outbound]policy1//创建一个策略[USGT-nat-policy-interzone-tmst-untrust-outbound-1]policysource192.168.10.

4、00.0.0.255[USGT-nat-policy-interzone-trust-untrust-outbound-1]policydestination192.168.20.00.0.0.255[USG-l-nat-policy-interzone-trust-untrust-outbound-1]actionno-nat//以上三条命令意思是不允许将源为192.16&10.0/24网段目标为192.16&20.0/24网段的数据包进行NAT[USG-l-nat-policy-interzone-trust-untrust-outbound-l]quit[USGT-nat-p

5、olicy-interzone-trust-untrust-outbound]policy2〃创建策略2[USG-l-nat-policy-interzone-trust-untrust-outbound-2]actionsource-nat〃允许对源IP进行NAT[USGT-nat-policy-interzone-trust-untrust-outbound-2]easy-ipg0/0/l//对接口G0/0/1地址复用[USGT-nat-policy-interzone-trust-untrust-outbound-2]quit[USG-l-nat-policy-interzo

6、ne-trust-untrust-outbound]quit阶段一[USG-1]ikeproposal1〃配置一个安全提议[liSG-l-ike-proposal-1]authentication-methodpre-share//配置IKE认证方式为预共享密钥[USG-l-ike-proposal-1]authentication-algorithmshal〃配置IKE认证算法为shal[USG-l-ike-proposal-1]integrity-algorithmaes-xcbc-96//配置IKE完整性算法[USG1ike-proposall]dhgroup2//配置IKE

7、密钥协商DH组[USG-l-ike-proposal-l]quit[USG-l]ikepeerUSG-2〃创建一个IKE对等体名字为USG-2[USG-l-ike-peer-usg-2]pre-shared-keyabcl23//配置预共享密钥[LSG-l-ike-peer-usg-2]remote-address12.0.0.2〃配置对等体IP地址[l'SG-1-ike-peer-usg-2]ike-proposal1〃调用ike安全提议[USG-l-ike-pee