1.组网

2.需求

客户两端的内网网段一样，并且由于某些原因无法更改内网网段，现在需要通过ipsec VPN实现A端设备10.1.1.2要能访问对端内网的10.1.1.3，并不要求对端能访问自己。

配置思路：

由于两端内网一样，互访的流量根本不会到达防火墙上面，从而无法触发ipsec隧道建立，所以需要在A端防火墙的入接口上面配置源和目的地址转换，将本端的内网转换成别的网段，同时为了使ping对端内网的流量到达防火墙，需要在入接口上做一个目的地址转换,先用别的IP来代替对端的ip，在防火墙上为了让流量从出接口出去，入接口上还需要配置PBR。

3.关键配置

FWA

#

nat address-group 0

 address 10.1.2.1 10.1.2.1

#

policy-based-route huqi permit node 0

 if-match acl 3003

 apply next-hop 2.2.2.2

#

interface GigabitEthernet1/0/1

 description LAN

 port link-mode route

 combo enable copper

 ip address 10.1.1.1 255.255.255.0

 nat inbound 3002 address-group 0

 nat server global 10.1.3.1 inside 10.1.1.3

//将流量从外网口扔出去，不然做完转换后会发到内网，无法触发隧道建立

 ip policy-based-route huqi

#

interface GigabitEthernet1/0/2

 description WAN

 port link-mode route

 combo enable copper

 ip address 2.2.2.1 255.255.255.0

 nat outbound 3001

 ipsec apply policy map1

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name Untrust

 import interface GigabitEthernet1/0/2

#

 ip route-static 0.0.0.0 0 2.2.2.2

//将返回的流量扔到内网，用来触发在内网接口进行源和目的地址转换

 ip route-static 10.1.2.0 24 10.1.1.2

#             

acl advanced 3000

 rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

#

acl advanced 3001

 rule 0 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

 rule 5 permit ip

#

acl advanced 3002

 rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255

#

acl advanced 3003

 rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

#

ipsec transform-set tran1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy map1 10 isakmp

 transform-set tran1

 security acl 3000

 remote-address 2.2.3.1

 ike-profile profile1

#

 ike logging negotiation enable

#

ike profile profile1

 keychain keychain1

 local-identity address 2.2.2.1

 match remote identity address 2.2.3.1 255.255.255.255

 proposal 1

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain keychain1

 pre-shared-key address 2.2.3.1 255.255.255.0 key cipher $c$3$LXO7Pf3k1FxL1jfkO3moC7K747FDXR8fSg==

#

security-policy ip

 rule 0 name AllPass

  action pass

#

Return

FWB

#

interface GigabitEthernet1/0/1

 description LAN

 port link-mode route

 combo enable copper

 ip address 10.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/2

 description WAN

 port link-mode route

 combo enable copper

 ip address 2.2.3.1 255.255.255.0

 nat outbound 3001

 ipsec apply policy use1

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name Untrust

 import interface GigabitEthernet1/0/2

#           

 ip route-static 0.0.0.0 0 2.2.3.2

#

acl advanced 3000

 rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255

#

acl advanced 3001

 rule 0 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255

 rule 5 permit

#

ipsec transform-set tran1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy use1 10 isakmp

 transform-set tran1

 security acl 3000

 local-address 2.2.3.1

 remote-address 2.2.2.1

 ike-profile profile1

#

ike profile profile1

 keychain keychain1

 local-identity address 2.2.3.1

 match remote identity address 2.2.2.1 255.255.255.255

 proposal 1

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain keychain1

 pre-shared-key address 2.2.2.1 255.255.255.0 key cipher $c$3$ENS6gWDmdnktKQfRKaaMhCy7tBTExUQLzA==

#

security-policy ip

 rule 0 name allpass

  action pass

#

return

4.测试

A端可以访问B端

在A端查看：

[H3C]dis ike sa

    Connection-ID   Remote                Flag         DOI   

------------------------------------------------------------------

    1               2.2.3.1               RD           IPsec 

Flags:

RD--READY RL--REPLACED FD-FADING RK-REKEY

[H3C]dis ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/2

-------------------------------

  -----------------------------

  IPsec policy: map1

  Sequence number: 10

  Mode: ISAKMP

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1444

    Tunnel:

        local  address: 2.2.2.1

        remote address: 2.2.3.1

    Flow:

        sour addr: 10.1.2.0/255.255.255.0  port: 0  protocol: ip

        dest addr: 10.1.1.0/255.255.255.0  port: 0  protocol: ip

    [Inbound ESP SAs]

      SPI: 906099782 (0x3601fc46)

      Connection ID: 4294967296

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843196/1681

      Max received sequence-number: 37

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for NAT traversal: N

      Status: Active

    [Outbound ESP SAs]

      SPI: 446997740 (0x1aa4a4ec)

      Connection ID: 4294967297

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843197/1681

      Max sent sequence-number: 24

      UDP encapsulation used for NAT traversal: N

      Status: Active

Ipsec建立过程中防火墙的debug信息：

<H3C>*Dec 24 19:34:31:636 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;

Receiving, interface = GigabitEthernet1/0/1

version = 4, headlen = 20, tos = 0

pktlen = 84, pktid = 48, offset = 0, ttl = 255, protocol = 1

checksum = 41844, s = 10.1.1.2, d = 10.1.3.1

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

prompt: Receiving IP packet from interface GigabitEthernet1/0/1.

Payload: ICMP

  type = 8, code = 0, checksum = 0x151c.

//先在内网接口进行源地址和目的地址的转换

*Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP

        10.1.1.2:  176 -        10.1.3.1: 2048(VPN:    0) ------>

        10.1.2.1:   23 -        10.1.3.1: 2048(VPN:    0)

*Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP

        10.1.2.1:   23 -        10.1.3.1: 2048(VPN:    0) ------>

        10.1.2.1:   23 -        10.1.1.3: 2048(VPN:    0)

//转换完成匹配PBR，将流量扔到公网

*Dec 24 19:34:31:636 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; Policy: huqi, Node: 0, match succeeded.

*Dec 24 19:34:31:637 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; apply next-hop 2.2.2.2.

*Dec 24 19:34:31:637 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;

Sending, interface = GigabitEthernet1/0/2

version = 4, headlen = 20, tos = 252

pktlen = 224, pktid = 52, offset = 0, ttl = 255, protocol = 17

checksum = 45271, s = 2.2.2.1, d = 2.2.3.1

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

//触发ipsec协商

prompt: Sending IP packet from local at interface GigabitEthernet1/0/2.

Payload: UDP

  source port = 500, destination port = 500

  checksum = 0x0f40, length = 204.

//收到对端的回包

*Dec 24 19:34:31:639 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;

Receiving, interface = GigabitEthernet1/0/2

version = 4, headlen = 20, tos = 252

pktlen = 164, pktid = 64, offset = 0, ttl = 254, protocol = 17

checksum = 45575, s = 2.2.3.1, d = 2.2.2.1

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

prompt: Receiving IP packet from interface GigabitEthernet1/0/2.

Payload: UDP

  source port = 500, destination port = 500

  checksum = 0xf4cb, length = 144.

…(后面的协商过程的debug信息省略)

隧道建立后ping对端内网的NAT转换信息：

[H3C]*Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP

        10.1.1.2:  173 -        10.1.3.1: 2048(VPN:    0) ------>

        10.1.2.1:   20 -        10.1.3.1: 2048(VPN:    0)

*Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP

        10.1.2.1:   20 -        10.1.3.1: 2048(VPN:    0) ------>

        10.1.2.1:   20 -        10.1.1.3: 2048(VPN:    0)

//要写这条路由ip route-static 10.1.2.0 24 10.1.1.2，才会进行下面的转换

*Dec 24 19:21:12:934 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP

        10.1.1.3:   20 -        10.1.2.1:    0(VPN:    0) ------>

        10.1.3.1:  173 -        10.1.2.1:    0(VPN:    0)

*Dec 24 19:21:12:935 2019 H3C NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP

        10.1.3.1:  173 -        10.1.2.1:    0(VPN:    0) ------>

        10.1.3.1:  173 -        10.1.1.2:    0(VPN:    0)

5.总结 

1实际测试对端无法通过10.1.2.1这个地址访问过来。

2. ip route-static 10.1.2.0 24 10.1.1.2 这条路由一定要写，目的是为了让返回的流量在内网接口上面匹配会话做源和目的转换。