RT-MSR3660-H3，GRE over IPsecVPN对接详细配置

F1060 GRE OVER IPSEC关键配置点如下所示，全部配置过程及测试结果的详情见附件：

GRE OVER IPSEC关键配置点：

FW1：

[FW1]acl advanced 3000

[FW1-acl-ipv4-adv-3000]rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255

[FW1-acl-ipv4-adv-3000]quit

[FW1]ike proposal 1

[FW1-ike-proposal-1]quit

[FW1]ike keychain james

[FW1-ike-keychain-james]pre-shared-key address 123.0.0.2 255.255.255.252 key simple james

[FW1-ike-keychain-james]quit

[FW1]ike profile james

[FW1-ike-profile-james]proposal 1

[FW1-ike-profile-james]keychain james

[FW1-ike-profile-james]local-identity address 123.0.0.1

[FW1-ike-profile-james]match remote identity address 123.0.0.2 255.255.255.252

[FW1-ike-profile-james]quit

[FW1]ipsec transform-set james

[FW1-ipsec-transform-set-james]protocol esp

[FW1-ipsec-transform-set-james]encapsulation-mode tunnel

[FW1-ipsec-transform-set-james]esp authentication-algorithm md5

[FW1-ipsec-transform-set-james]esp encryption-algorithm des-cbc

[FW1-ipsec-transform-set-james]quit

[FW1]ipsec policy james 1 isakmp

[FW1-ipsec-policy-isakmp-james-1]security acl 3000

[FW1-ipsec-policy-isakmp-james-1]transform-set james

[FW1-ipsec-policy-isakmp-james-1]ike-profile james

[FW1-ipsec-policy-isakmp-james-1]remote-address 123.0.0.2

[FW1-ipsec-policy-isakmp-james-1]quit

[FW1]int Tunnel 0 mode gre

[FW1-Tunnel0]ip address 123.0.0.1 30

[FW1-Tunnel0]source 202.1.100.2

[FW1-Tunnel0]destination 202.2.100.2

[FW1-Tunnel0]ipsec apply policy james

[FW1-Tunnel0]quit

[FW1]ip route-static 172.16.1.0 255.255.255.0 123.0.0.2

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface Tunnel 0

[FW1-security-zone-Untrust]quit

FW2：

[FW2]acl advanced 3000

[FW2-acl-ipv4-adv-3000]rule 0 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

[FW2-acl-ipv4-adv-3000]quit

[FW2]ike proposal 1

[FW2-ike-proposal-1]quit

[FW2]ike keychain james

[FW2-ike-keychain-james]pre-shared-key address 123.0.0.1 255.255.255.252 key simple james

[FW2-ike-keychain-james]quit

[FW2]ike profile james

[FW2-ike-profile-james]keychain james

[FW2-ike-profile-james]proposal 1

[FW2-ike-profile-james]match remote identity address 123.0.0.1 255.255.255.252

[FW2-ike-profile-james]local-identity address 123.0.0.2

[FW2-ike-profile-james]quit

[FW2]ipsec policy james 1 isakmp

[FW2-ipsec-policy-isakmp-james-1]security acl 3000

[FW2-ipsec-policy-isakmp-james-1]transform-set james

[FW2-ipsec-policy-isakmp-james-1]ike-profile james

[FW2-ipsec-policy-isakmp-james-1]remote-address 123.0.0.1

[FW2-ipsec-policy-isakmp-james-1]quit

[FW2]int Tunnel 0 mode gre

[FW2-Tunnel0]ip address 123.0.0.2 30

[FW2-Tunnel0]source 202.2.100.2

[FW2-Tunnel0]destination 202.1.100.2

[FW2-Tunnel0]ipsec apply policy james

[FW2-Tunnel0]quit

[FW2]ip route-static 192.168.1.0 255.255.255.0 123.0.0.1

[FW2]security-zone name Untrust

[FW2-security-zone-Untrust]import interface Tunnel 0

[FW2-security-zone-Untrust]quit