IPSEC 主模式

总部采用策略模版

分不正常配置ipsec

建立不起来

总部配置

ipsec transform-set 1
 esp encryption-algorithm 3des-cbc
 esp authentication-algorithm md5
#
ipsec policy-template 1 1
 transform-set 1
 ike-profile 1
#
ipsec policy 1 1 isakmp template 1
#              
 ike identity address 100.1.1.1
#
ike profile 1
 keychain 1
 match remote identity address 100.2.2.3 255.255.255.0
 proposal 1
#
ike proposal 1
#
ike keychain 1
 pre-shared-key address 100.2.2.3 255.255.255.0 key cipher $c$3$E6r8gM1FAL4K/83tjjCZRSyRrexo+g==

#

interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 100.1.1.1 255.255.255.0
 ipsec apply policy 1

#

ip route-static 0.0.0.0 0 100.1.1.2
#

分不配置：

 ip route-static 0.0.0.0 0 100.2.2.2
#
acl advanced 3000
 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

ipsec transform-set 1
 esp encryption-algorithm des-cbc
 esp authentication-algorithm md5
#
ipsec policy 1 1 isakmp
 transform-set 1
 security acl 3000
 remote-address 100.1.1.1
 ike-profile 1
#
ike profile 1
 keychain 1
 match remote identity address 100.1.1.1 255.255.255.255
 proposal 1
#
ike proposal 1
#
ike keychain bj
 pre-shared-key address 100.1.1.1 255.255.255.255 key cipher $c$3$nVsTxrq1BG2XPlmYlvGk2Lu7jR0+mA==
#

interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 100.2.2.3 255.255.255.0
 ipsec apply policy 1