公司本来用两台H3C防火墙做ipsec-vpn 但是有一台坏了,然后那一台csico的ASA代替,但是对接过程中vpn建立不成功
想问问:
ike peer branch1
exchange-mode aggressive
pre-shared-key simple 12348765abc
id-type name
remote-name branch1
nat traversal
这里的指向关系是不是要指定ASA的地址的 啊
一下为H3C防火墙上的配置
#
ike local-name center
#
acl number 3000
rule 0 deny ip destination 192.168.47.0 0.0.0.255
rule 15 permit ip destination 172.16.106.73 0
rule 20 permit ip destination 172.16.114.15 0
acl number 3100
rule 0 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.47.224 0.0.0.31
rule 5 permit ip source 172.0.0.0 0.255.255.255 destination 192.168.47.224 0.0.0.31
rule 10 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.47.224 0.0.0.31
acl number 3200
rule 0 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.47.0 0.0.0.31
rule 5 permit ip source 172.0.0.0 0.255.255.255 destination 192.168.47.0 0.0.0.31
rule 10 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.47.0 0.0.0.31
#
ike peer branch1
exchange-mode aggressive
pre-shared-key simple 12348765abc
id-type name
remote-name branch1
nat traversal
#
ike peer branch2
exchange-mode aggressive
pre-shared-key simple 12348765abc
id-type name
remote-name branch2
nat traversal
#
ipsec proposal 1
#
ipsec policy center 2 isakmp
security acl 3200
ike-peer branch2
proposal 1
#
user-group system
#
#
interface NULL0
#
interface GigabitEthernet0/0
port link-mode route
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet0/1
port link-mode route
ip address 192.168.14.252 255.255.255.0
#
interface GigabitEthernet0/2
port link-mode route
nat outbound 3000
ip address 10.154.81.1 255.255.255.0
ipsec policy center
#
interface GigabitEthernet0/3
port link-mode route
#
interface GigabitEthernet0/4
port link-mode route
#
interface Tunnel0
ip address 10.1.2.1 255.255.255.0
source 10.154.81.1
destination 172.16.106.73
#
ip route-static 0.0.0.0 0.0.0.0 10.154.81.254
ip route-static 10.0.0.0 255.255.255.0 192.168.14.254
ip route-static 172.0.0.0 255.0.0.0 192.168.14.254
ip route-static 172.16.106.0 255.255.255.0 10.154.81.254
ip route-static 172.16.114.0 255.255.255.0 10.154.81.254
ip route-static 192.168.0.0 255.255.0.0 192.168.14.254
ip route-static 192.168.47.0 255.255.255.224 10.154.81.254
ip route-static 192.168.47.224 255.255.255.224 Tunnel0
#
load xml-configuration
#
load tr069-configuration
(0)
看你配置,H3C设备是总部,用的野蛮模式,思科也要配置野蛮模式,并且id-type要是name,思科的name要和H3C上配置的remote-name一致才行,还有ike proposal、ipsec proposal参数也要一致,安全acl要配置成镜像。
(0)
这个是可以的,但是cisco的野蛮模式不会配啊,然后H3C的设备制定对象可以不
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
这个是可以的,但是cisco的野蛮模式不会配啊,然后H3C的设备制定对象可以不