拿F5虚拟机做了一个ipsec nat穿越对接h3c模拟器

F5-LTM设备连接外网联通专线，公网ip：112.1.1.1/24，内部的路由器VPN1设备与公网ip的14.1.1.4/24的VPN2设备建立ipsec vpn，使得私网的10.1.1.0/24与对端的20.1.1.0/24互通。

F5-LTM设备连接外网联通专线，公网ip：112.1.1.1/24，内部的路由器VPN1设备与公网ip的14.1.1.4/24的VPN2设备建立ipsec vpn，使得私网的10.1.1.0/24与对端的20.1.1.0/24互通。

先建立一个名字为class_cnc的联通data group地址库，类型为address或者string，把公网的测试ip:1.1.1.1，114.114.114.114，14.1.1.0/24加进去。

F5上面的ipsec配置步骤参考F5红宝书就行了，注意如下的irules：

内网的VPN1设备作snat的irules，其中[IP::client_addr] equals "11.1.1.254"，也就是为内网VPN1设备的接口地址。

when CLIENT_ACCEPTED priority 400 { 

    if { [IP::addr [IP::client_addr] equals "11.1.1.254"] }  {

        pool pool_cnc 

        snatpool ipsec 

    } 

}

下面是私网10.1.1.0/24访问外网ip诸如114.114.114.114和1.1.1.1等的出方向的vs_outbound的irules：

when CLIENT_ACCEPTED {

     if { [class match [IP::local_addr] equals class_cnc] } {

         if { [IP::addr [IP::client_addr] equals "10.1.1.0/24"] } {

            pool pool_cnc 

            } 

        }

 } 

when LB_SELECTED { 

    if { [IP::addr [LB::server addr] equals "112.1.1.2"] } { 

        snatpool ipsec 

       } 

}

实现效果：

<PC1>ping -a 10.1.1.1 20.1.1.1

Ping 20.1.1.1 (20.1.1.1) from 10.1.1.1: 56 data bytes, press CTRL_C to break

Request time out

56 bytes from 20.1.1.1: icmp_seq=1 ttl=253 time=4.000 ms

56 bytes from 20.1.1.1: icmp_seq=2 ttl=253 time=3.000 ms

56 bytes from 20.1.1.1: icmp_seq=3 ttl=253 time=4.000 ms

56 bytes from 20.1.1.1: icmp_seq=4 ttl=253 time=3.000 ms

--- Ping statistics for 20.1.1.1 ---

5 packet(s) transmitted, 4 packet(s) received, 20.0% packet loss

round-trip min/avg/max/std-dev = 3.000/3.500/4.000/0.500 ms

<PC1>%Aug 26 00:58:04:013 2020 PC1 PING/6/PING_STATISTICS: Ping statistics for 20.1.1.1: 5 packet(s) transmitted, 4 packet(s) received, 20.0% packet loss, round-trip min/avg/max/std-dev = 3.000/3.500/4.000/0.500 ms.

<PC1>ping -a 10.1.1.1 114.114.114.114

Ping 114.114.114.114 (114.114.114.114) from 10.1.1.1: 56 data bytes, press CTRL_C to break

56 bytes from 114.114.114.114: icmp_seq=0 ttl=253 time=2.000 ms

56 bytes from 114.114.114.114: icmp_seq=1 ttl=253 time=3.000 ms

56 bytes from 114.114.114.114: icmp_seq=2 ttl=253 time=3.000 ms

56 bytes from 114.114.114.114: icmp_seq=3 ttl=253 time=2.000 ms

56 bytes from 114.114.114.114: icmp_seq=4 ttl=253 time=3.000 ms

--- Ping statistics for 114.114.114.114 ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 2.000/2.600/3.000/0.490 ms