SecPath防火墙和Eudemon防火墙实现IPSEC互通的典型配置

SecPath防火墙和Eudemon防火墙实现IPSEC互通的

典型配置

 

一、 组网需求：

SecPath防火墙和Eudemon防火墙做IPSEC VPN互通。

二、 组网图

   

三、 配置信息

1.     SecPath F1000-A的主要配置

#

 sysname SecPath F1000-A

#

 ike local-name fenzhi

#

 firewall packet-filter enable

 firewall packet-filter default permit

#

ike peer 1

 exchange-mode aggressive

 pre-shared-key 123

 id-type name

 remote-name zhongxin

 remote-address 202.38.1.1

 nat traversal

#

ipsec proposal 1

#

ipsec policy pol1 1 isakmp

 security acl 3000

 ike-peer 1

 proposal 1

#

acl number 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

interface GigabitEthernet0/0

 ip address 202.38.1.2 255.255.255.0

 ipsec policy pol1

#

interface GigabitEthernet0/1

 ip address 192.168.2.1 255.255.255.0

#

firewall zone trust

 add interface GigabitEthernet0/1

 set priority 85

#

firewall zone untrust

 add interface GigabitEthernet0/0

 set priority 5

#

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.1 preference 60

#

 

2.        Eudemon 200的主要配置

#

 sysname Eudemon200

#

 ike local-name zhongxin

#

 firewall packet-filter default permit interzone local trust direction inbound

 firewall packet-filter default permit interzone local trust direction outbound

 firewall packet-filter default permit interzone local untrust direction inbound

 firewall packet-filter default permit interzone local untrust direction outbound

 firewall packet-filter default permit interzone local DMZ direction inbound

 firewall packet-filter default permit interzone local DMZ direction outbound

 firewall packet-filter default permit interzone trust untrust direction inbound

 firewall packet-filter default permit interzone trust untrust direction outbound

 firewall packet-filter default permit interzone trust DMZ direction inbound

 firewall packet-filter default permit interzone trust DMZ direction outbound

 firewall packet-filter default permit interzone DMZ untrust direction inbound

 firewall packet-filter default permit interzone DMZ untrust direction outbound

#

 nat alg enable ftp

 nat alg enable dns

 nat alg enable icmp

 nat alg enable netbios

 undo nat alg enable h323

 undo nat alg enable hwcc

 undo nat alg enable ils

 undo nat alg enable pptp

 undo nat alg enable qq

 undo nat alg enable msn

 undo nat alg enable user-define

#

 firewall statistic system enable

#

ike peer 1

 exchange-mode aggressive

 pre-shared-key 123

 local-id-type name

 remote-name fenzhi

 nat traversal

#

ipsec proposal 1

#

ipsec policy-template temp 1

 ike-peer 1

 proposal 1

#

ipsec policy pol1 1 isakmp template temp

#

interface Ethernet0/0/0

 ip address 202.38.1.1 255.255.255.0

 ipsec policy pol1

#

interface Ethernet0/0/1

 ip address 192.168.1.1 255.255.255.0

#

firewall zone trust

 add interface Ethernet0/0/1

 set priority 85

#

firewall zone untrust

 add interface Ethernet0/0/0

 set priority 5

#

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.2

#

 

四、 配置关键点

略。