防火墙上配置ipsec VPN，两端配置除了IP地址都需要一致么？

 

这样配置可以么？

FW1

ipsec policy celue 10 isakmp

ipsec transform-set suidao

ike profile kuangjia

ike keychain miyao

FW2

ipsec policy celue 10 isakmp

ipsec transform-set suidao1

ike profile kuangjia1

ike keychain miyao1

 

 

 

配置

FW1

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

 ip address 1.1.1.2 255.255.255.0

 ipsec apply policy celue

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet1/0/10

 port link-mode route

 combo enable copper

 ip address 192.168.56.110 255.255.255.0

#              

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/0

#

security-zone name Management

 import interface GigabitEthernet1/0/10

#

 ip route-static 0.0.0.0 0 1.1.1.1

#

acl advanced 3000

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

#

ipsec transform-set suidao

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec policy celue 10 isakmp

 transform-set suidao 

 security acl 3000 

 local-address 1.1.1.2

 remote-address 2.2.2.2 

 ike-profile kuangjia

#

ike profile kuangjia

 keychain miyao

 local-identity address 1.1.1.2

 match remote identity address 2.2.2.2 255.255.255.255

 proposal 1 

#

ike proposal 1

 encryption-algorithm aes-cbc-128

#

ike keychain miyao

 pre-shared-key address 2.2.2.2 255.255.255.255 key simple ***.***

#

security-policy ip

 rule 0 name all

  action pass

#

return

 

 

FW2

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

 ip address 2.2.2.2 255.255.255.0

 ipsec apply policy celue

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip address 192.168.2.1 255.255.255.0

#

interface GigabitEthernet1/0/10

 port link-mode route

 combo enable copper

 ip address 192.168.56.111 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/0

#

security-zone name Management

 import interface GigabitEthernet1/0/10

#

 ip route-static 0.0.0.0 0 2.2.2.1

#

acl advanced 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

ipsec transform-set suidao1

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec policy celue 10 isakmp

 transform-set suidao1 

 security acl 3000 

 local-address 2.2.2.2

 remote-address 1.1.1.2 

 ike-profile kuangjia1

#

ike profile kuangjia1

 keychain miyao1

 local-identity address 2.2.2.2

 match remote identity address 1.1.1.2 255.255.255.255

 proposal 1 

#

ike proposal 1

 encryption-algorithm aes-cbc-128

#

ike keychain miyao1

 pre-shared-key address 1.1.1.2 255.255.255.255 key simple ***.***

#

security-policy ip

 rule 0 name all

  action pass

#

return