SecPath防火墙在混合组网中IPSec的应用

SecPath防火墙在混合组网中IPSec的应用

 

一、 组网需求：

某局点总部采用我司SecPath1000F防火墙，分支既有我司SecPath防火墙，又有其它厂家的防火墙。因为我司SecPath防火墙与其它厂商防火墙做IPSEC互通的时候，配置时需要注意的地方比较多。实验目的说明我司SecPath防火墙支持配置多个ike proposal和多种dh group密钥交换。

二、 组网图

  

   SecPath1000F：Version 3.40, Release 1606。

三、 配置信息

1. 总部的主要配置

#                                                                              

 sysname zongbu                                                                

#                                                                              

 firewall packet-filter enable                                                 

 firewall packet-filter default permit                                         

#                                                                              

 undo connection-limit enable                                                  

 connection-limit default deny                                                 

 connection-limit default amount upper-limit 50 lower-limit 20                 

#                                                                               

 firewall statistic system enable                                              

#                                                                              

radius scheme system                                                            

#                                                                              

domain system                                                                  

#                                                                               

ike proposal 1                                    //定义第一个ike proposal    

#                                                                               

ike proposal 2                                    //定义第二个ike proposal     

 encryption-algorithm 3des-cbc                        //定义加密算法为3des    

 dh group5                                          //定义密钥交换为group5    

#                                                                              

ike dpd 1                                                    //配置ike dpd    

#                                                                              

ike peer fenzhi1                                            //配置ike peer    

 pre-shared-key 123456                                                          

 remote-address 202.38.2.1                                                     

 local-address 202.38.1.1                                                      

 dpd 1                                                                          

#                                                                              

ike peer fenzhi2                                            //配置ike peer    

 pre-shared-key 123456                                                         

 remote-address 202.38.3.1                                                     

 local-address 202.38.1.1                                                       

 dpd 1                                                                         

#                                                                              

ipsec card-proposal 1                                 //配置ipsec proposal     

 use encrypt-card 2/0                                                          

#                                                                              

ipsec card-proposal 2                                 //配置ipsec proposal    

 use encrypt-card 2/0                                                           

 esp authentication-algorithm sha1                                             

 esp encryption-algorithm 3des                                                 

ipsec policy pol1 1 isakmp                              //配置ipsec policy    

 security acl 3000                                                             

 ike-peer fenzhi1                                                              

 proposal 1                                                                     

#                                                                              

ipsec policy pol1 2 isakmp                              //配置ipsec policy     

 security acl 3001                                                             

 pfs dh-group2                                       //配置pfs为dh-group2    

 ike-peer fenzhi2                                                              

 proposal 2                                                                    

#                                                                               

acl number 3000                                                                

 description ipsec_fenzhi1                                                     

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 1 deny ip                                                                

acl number 3001                                                                

 description ipsec_fenzhi2                                                      

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

 rule 1 deny ip                                                                

#                                                                               

interface Aux0                                                                 

 async mode flow                                                               

#                                                                               

interface Ethernet1/0                                                          

#                                                                              

interface GigabitEthernet0/0                                                   

 ip address 202.38.1.1 255.255.255.0                                           

 ipsec policy pol1                                //接口下应用ipsec policy    

#                                                                              

interface GigabitEthernet0/1                                                   

#                                                                               

interface Encrypt2/0                                                           

#                                                                              

interface NULL0                                                                

#                                                                               

interface LoopBack0                                                            

 ip address 192.168.1.1 255.255.255.0                                          

#                                                                               

firewall zone local                                                            

 set priority 100                                                              

#                                                                               

firewall zone trust                                                            

 set priority 85                                                               

#                                                                               

firewall zone untrust                                                          

 add interface GigabitEthernet0/0                                              

 set priority 5                                                                 

#                                                                              

firewall zone DMZ                                                              

 set priority 50                                                                

#                                                                              

firewall interzone local trust                                                 

#                                                                              

firewall interzone local untrust                                               

#                                                                              

firewall interzone local DMZ                                                   

#                                                                               

firewall interzone trust untrust                                               

#                                                                              

firewall interzone trust DMZ                                                   

#                                                                              

firewall interzone DMZ untrust                                                 

#                                                                               

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.2 preference 60                      

#

 

2. 分支1的主要配置

#                                                                              

 sysname fenzhi1                                                                

#                                                                              

 firewall packet-filter enable                                                 

 firewall packet-filter default permit                                          

#                                                                              

 undo connection-limit enable                                                  

 connection-limit default deny                                                  

 connection-limit default amount upper-limit 50 lower-limit 20                 

#                                                                              

 firewall statistic system enable                                               

#                                                                              

radius scheme system                                                           

#                                                                              

domain system                                                                  

#                                                                              

ike dpd 1                                                    //定义ike dpd    

#                                                                               

ike peer zongbu                                             //定义ike peer     

 pre-shared-key 123456                                                         

 remote-address 202.38.1.1                                                      

 local-address 202.38.2.1                                                      

 dpd 1                                                                         

#                                                                               

ipsec card-proposal 1                                 //定义ipsec proposal    

 use encrypt-card 2/0                                                          

#                                                                              

ipsec policy pol1 1 isakmp                              //配置ipsec policy    

 security acl 3000                                                             

 ike-peer zongbu                                                               

 proposal 1                                                                    

#                                                                               

acl number 3000                                                                

 description ipsec_zongbu                                                      

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 1 deny ip                                                                

#                                                                              

interface Aux0                                                                  

 async mode flow                                                               

#                                                                              

interface GigabitEthernet0/0                                                    

 ip address 202.38.2.1 255.255.255.0              //接口下应用ipsec policy    

 ipsec policy pol1                                                             

#                                                                               

interface GigabitEthernet0/1                                                   

#                                                                              

interface GigabitEthernet1/0                                                    

#                                                                              

interface GigabitEthernet1/1                                                   

#                                                                              

interface Encrypt2/0                                                           

#                                                                              

interface NULL0                                                                

#                                                                               

interface LoopBackddress 192.168.2.1 255.255.255.0                             

#                                                                              

firewall zone local                                                             

 set priority 100                                                              

#                                                                              

firewall zone trust                                                             

 set priority 85                                                               

#                                                                              

firewall zone untrust                                                           

 add interface GigabitEthernet0/0                                              

 set priority 5                                                                

#                                                                               

firewall zone DMZ                                                              

 set priority 50                                                               

#                                                                              

firewall interzone local trust                                                 

#                                                                              

firewall interzone local untrust                                               

#                                                                               

firewall interzone local DMZ                                                   

#                                                                              

firewall interzone trust untrust                                                

#                                                                              

firewall interzone trust DMZ                                                   

#                                                                               

firewall interzone DMZ untrust                                                 

#                                                                              

 ip route-static 0.0.0.0 0.0.0.0 202.38.2.2 preference 60                       

#

 

3. 分支2的主要配置

 #                                                                              

 sysname fenzhi2                                                               

#                                                                               

 firewall packet-filter enable                                                 

 firewall packet-filter default permit                                         

#                                                                               

 firewall statistic system enable                                              

#                                                                              

radius scheme system                                                           

#                                                                               

domain system                                                                  

#                                                                              

ike proposal 1                                          //定义ike proposal    

 encryption-algorithm 3des-cbc                        //定义加密算法为3des     

 dh group5                                          //定义密钥交换为group5     

#                                                                              

ike dpd 1                                                    //配置ike dpd     

#                                                                              

ike peer zongbu                                             //配置ike peer    

 pre-shared-key 123456                                                          

 remote-address 202.38.1.1                                                     

 local-address 202.38.3.1                                                      

 dpd 1                                                                          

#                                                                              

ipsec card-proposal 1                                 //配置ipsec proposal    

 use encrypt-card 2/0                                                          

 esp authentication-algorithm sha1                                             

 esp encryption-algorithm 3des                                                  

#                                                                              

ipsec policy pol1 1 isakmp                              //配置ipsec policy    

 security acl 3000                                                             

 pfs dh-group2                                       //配置pfs为dh-group2    

 ike-peer zongbu                                                               

 proposal 1                                                                    

#                                                                               

acl number 3000                                                                

 description ipsec_zongbu                                                      

 rule 0 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 1 deny ip                                                                

#                                                                              

interface Aux0                                                                  

 async mode flow                                                               

#                                                                              

interface GigabitEthernet0/0                                                    

 ip address 202.38.3.1 255.255.255.0                                           

 ipsec policy pol1                                //接口下应用ipsec policy    

#                                                                              

interface GigabitEthernet0/1                                                   

#                                                                               

interface Encrypt2/0                                                           

#                                                                              

interface NULL0                                                                

#                                                                               

interface LoopBack0                                                            

 ip address 192.168.3.1 255.255.255.0                                          

#                                                                               

firewall zone local                                                            

 set priority 100                                                              

#                                                                               

firewall zone trust                                                            

 set priority 85                                                               

#                                                                               

firewall zone untrust                                                          

 add interface GigabitEthernet0/0                                              

 set priority 5                                                                 

#                                                                              

firewall zone DMZ                                                              

 set priority 50                                                               

#                                                                              

firewall interzone local trust                                                 

#                                                                               

firewall interzone local untrust                                               

#                                                                              

firewall intecal DMZ                                                            

#                                                                              

firewall interzone trust untrust                                               

#                                                                               

firewall interzone trust DMZ                                                   

#                                                                              

firewall interzone DMZ untrust                                                  

#                                                                              

 ip route-static 0.0.0.0 0.0.0.0 202.38.3.2 preference 60                      

#

    

四、 配置关键点

见注释！