F1000-AK110
- 0关注
- 1收藏，850浏览
问题描述：
两台防护墙搭建IPsec，由于一端地址不固定，故采用野蛮模式。
配置完后ike sa 已建立，但无法通信。检查感兴趣流，加密认证方式均无问题。
烦请大神帮忙协助一下。
组网及组网描述：
相关配置已添加至附件
- 2020-10-14提问
- 举报
-
(0)
最佳答案
总部配置：
[H3C]dis cur
interface GigabitEthernet1/0/10
port link-mode route
ip address 113.140.12.18 255.255.255.252
nat outbound 3000
ipsec apply policy GE1/0/10
ip route-static 0.0.0.0 0 113.140.12.17
ip route-static 10.0.0.0 8 10.234.235.213 description to beijing mi
ip route-static 10.240.68.0 22 10.254.254.2 description to vlan 5
ip route-static 10.240.70.0 24 113.140.12.17 description to ipsec vpn
#
acl advanced 3000
rule 5 deny ip source 10.240.68.0 0.0.1.255 destination 10.240.70.0 0.0.0.255
rule 7 deny ip source 10.108.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 9 deny ip source 10.132.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 11 deny ip source 10.237.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 13 deny ip source 10.115.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 20 permit ip
acl advanced name IPsec_GE1/0/10_IPv4_1
rule 1 permit ip source 10.240.68.0 0.0.1.255 destination 10.240.70.0 0.0.0.255
rule 2 permit ip source 10.108.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 3 permit ip source 10.132.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 4 permit ip source 10.237.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
rule 5 permit ip source 10.115.0.0 0.0.255.255 destination 10.240.70.0 0.0.0.255
#
#
local-user admin class manage
password hash $h$6$xOepK/5371cBciGm$Mq3iHCQCidZUQzfzAi5bf0epLaQD1VU+RGsB9sHUokOgZJtIU6a7pRz41+d6obmqGeWsBo0IH6ZylpbgfpCGow==
service-type ftp
service-type ssh terminal https
authorization-attribute work-directory slot1#flash:
authorization-attribute user-role level-15
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
session top-statistics enable
#
ipsec transform-set GE1/0/10_IPv4_1
esp encryption-algorithm aes-cbc-128
esp authentication-algorithm sha1
#
ipsec policy GE1/0/10 1 isakmp
transform-set GE1/0/10_IPv4_1
security acl name IPsec_GE1/0/10_IPv4_1
local-address 113.140.12.18
remote-address F100
ike-profile GE1/0/10_IPv4_1
#
ike identity fqdn F1000
#
ike profile GE1/0/10_IPv4_1
keychain GE1/0/10_IPv4_1
exchange-mode aggressive
local-identity address 113.140.12.18
match remote identity fqdn F100
match local address GigabitEthernet1/0/10
proposal 65535
#
ike proposal 65535
description GE1/0/10_IPv4_1
#
ike keychain GE1/0/10_IPv4_1
match local address GigabitEthernet1/0/10
pre-shared-key hostname F100 key cipher $c$3$V9bq5l1BOGU9jYDlsmLU95GNhgsA7ngLfw==
#
#
return
分部配置：
[H3C]dis current-configuration
#
dhcp enable
#
#
dhcp server ip-pool 10.240.70.0
gateway-list 10.240.70.1
network 10.240.70.0 mask 255.255.255.0
dns-list 10.108.6.6
interface GigabitEthernet1/0/4
port link-mode route
ip address 10.240.70.1 255.255.255.0
dhcp server apply ip-pool 10.240.70.0
#
interface GigabitEthernet1/0/11
port link-mode route
ip address 192.168.2.100 255.255.255.0
nat outbound 3001
ipsec apply policy GE1/0/11
#
ip route-static 0.0.0.0 0 192.168.2.1
#
acl advanced 3001
rule 5 deny ip source 10.240.70.0 0.0.0.255 destination 10.240.68.0 0.0.1.255
rule 7 deny ip source 10.240.70.0 0.0.0.255 destination 10.108.0.0 0.0.255.255
rule 9 deny ip source 10.240.70.0 0.0.0.255 destination 10.132.0.0 0.0.255.255
rule 11 deny ip source 10.240.70.0 0.0.0.255 destination 10.237.0.0 0.0.255.255
rule 13 deny ip source 10.240.70.0 0.0.0.255 destination 10.115.0.0 0.0.255.255
rule 15 permit ip
#
acl advanced 3005
rule 5 permit ip source 10.240.70.0 0.0.0.255 destination 10.240.68.0 0.0.1.255
rule 7 permit ip source 10.240.70.0 0.0.0.255 destination 10.108.0.0 0.0.255.255
rule 9 permit ip source 10.240.70.0 0.0.0.255 destination 10.132.0.0 0.0.255.255
rule 11 permit ip source 10.240.70.0 0.0.0.255 destination 10.237.0.0 0.0.255.255
rule 13 permit ip source 10.240.70.0 0.0.0.255 destination 10.115.0.0 0.0.255.255
#
#
session top-statistics enable
#
ipsec transform-set GE1/0/11_IPv4_1
esp encryption-algorithm aes-cbc-128
esp authentication-algorithm sha1
#
ipsec policy GE1/0/11 1 isakmp
transform-set GE1/0/11_IPv4_1
security acl 3005
remote-address 113.140.12.18
ike-profile GE1/0/11_IPv4_1
#
ike identity fqdn F100
#
ike profile GE1/0/11_IPv4_1
keychain GE1/0/11_IPv4_1
exchange-mode aggressive
local-identity fqdn F100
match remote identity address 113.140.12.18 255.255.255.252
match local address GigabitEthernet1/0/11
proposal 65535
#
ike proposal 65535
description GE1/0/11_IPv4_1
#
ike keychain GE1/0/11_IPv4_1
match local address GigabitEthernet1/0/11
pre-shared-key address 113.140.12.18 255.255.255.252 key cipher $c$3$AN0UDqqhGiMZLtBBuVW5FmJMex5MvH1DGw==
#
#
return
- 2020-10-14回答
- 评论(0)
- 举报
-
(0)
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
ipsec sa没有建立成功
总部这边remote-address后面添加的是主机名，是需要能够解析出来的地址，若不固定可以不配： # ipsec policy GE1/0/10 1 isakmp transform-set GE1/0/10_IPv4_1 security acl name IPsec_GE1/0/10_IPv4_1 local-address 113.140.12.18 remote-address F100 ike-profile GE1/0/10_IPv4_1
主机名不应该是 ike identity fqdn的值吗，还是要怎么设置
可以参考命令手册，这个主机名是需要解析的而不是fqdn：https://www.h3c.com/cn/d_202006/1308294_30005_0.htm#_Toc43392940 hostname：IPsec隧道的对端主机名，为1～253个字符的字符串，不区分大小写。该主机名可被DNS服务器解析为IP地址。