默认出口是拨号，专线对接IPSEC第一阶段不起来-1

默认出口是拨号，专线对接IPSEC第一阶段不起来。出口只用专线 IPSec就可以起来了。

[H3C]          

[H3C]

[H3C]

[H3C]dis cu 

#

 version 7.1.064, Release 9536P2415

#

 sysname H3C

#

 clock timezone Beijing add 08:00:00

 clock protocol ntp

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 dialer-group 2 rule ip permit

 dialer-group 3 rule ip permit

#

 dns server 114.114.114.114

 dns server 8.8.8.8

#

 lldp global enable

#

 password-recovery enable

#

vlan 1         

#

object-group ip address 5G-IP

 description 5G-IP System

 0 network host address 8.222.140.72

 10 network host address 49.12.234.183

 20 network host address 64.185.227.156

 30 network range 104.26.12.31 104.26.13.31

 40 network range 104.18.114.97 104.18.115.97

 50 network host address 104.237.62.211

 60 network host address 118.184.169.32

 70 network host address 172.67.75.172

 80 network host address 173.231.16.76

#

object-group ip address DShangYun

 0 network range 47.99.240.250 47.110.146.225

#

object-group ip address GlobalCall

 0 network host address 120.78.134.105

#

object-group ip address Lan104

 0 network subnet 10.10.104.0 255.255.255.0

#

object-group ip address Local-IP

 0 network subnet 10.10.104.0 255.255.255.0

#

object-group ip address PBX

 description PBX System

 0 network subnet 47.106.33.124 255.255.255.254

 10 network range 47.112.141.183 47.112.141.184

#

object-group ip address XinWangBank

 0 network host address 27.155.113.142

 10 network host address 59.63.226.78

 20 network host address 101.204.255.49

 30 network host address 112.45.111.110

 40 network host address 116.211.128.181

 50 network host address 119.4.94.210

 60 network host address 120.77.3.170

 70 network host address 182.140.247.25

 80 network host address 182.150.13.20

#

object-group ip address ZhongXinSystem

 description ZhongXin System

 0 network host address 113.105.124.18

 10 network host address 210.21.209.18

 20 network host address 120.234.64.18

 30 network host address 58.251.131.37

 40 network host address 59.37.28.37

 50 network host address 183.238.175.37

 60 network host address 202.99.22.161

 70 network host address 219.142.124.170

 80 network range 223.71.111.77 223.71.111.78

 90 network host address 114.247.86.171

 100 network host address 124.71.111.78

#

policy-based-route SpecialLine permit node 1

 if-match acl name JiaFangSystem

 apply next-hop 119.145.197.193 direct

 apply output-interface GigabitEthernet1/0/0

#

policy-based-route ZX permit node 5

 if-match acl 3200

 apply next-hop 119.145.197.193

#

controller Cellular1/0/0

#

interface Dialer0

 mtu 1492

 ppp chap password cipher $c$3$mQTyTS0L2xgUtqcoVjNK2jLGam1fTCE4W96g 

 ppp chap user 18029881968@163.gd 

 ppp ipcp dns admit-any 

 ppp ipcp dns request 

 ppp pap local-user 18029881968@163.gd password cipher $c$3$z2jllOkYkriZpzSZr81a8K83bRQ8KOgxPKDG 

 dialer bundle enable

 dialer-group 3

 dialer timer idle 0

 dialer timer autodial 5

 ip address ppp-negotiate

 tcp mss 1400

 nat outbound 3000

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

 ip address 119.145.197.195 255.255.255.224

 dns server 202.96.128.86

 dns server 114.114.114.114

 ip last-hop hold

 nat outbound 3000

 nat server protocol tcp global 119.145.197.195 52025 inside 10.10.104.1 443 rule WebFirewall

 ip policy-based-route SpecialLine

 ipsec apply policy SZHY

 gateway 119.145.197.193

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip last-hop hold

 nat outbound 3000

 pppoe-client dial-bundle-number 0

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

#

interface GigabitEthernet1/0/5

 port link-mode route

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

#

interface GigabitEthernet1/0/9

 port link-mode route

#

interface GigabitEthernet1/0/10

 port link-mode route

#

interface GigabitEthernet1/0/11

 port link-mode route

 ip address 10.10.104.1 255.255.255.0

 ip policy-based-route ZX

 gateway 10.10.104.1

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/11

#

security-zone name DMZ

#

security-zone name Untrust

 import interface Dialer0

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/1

#

security-zone name Management

 import interface GigabitEthernet1/0/2

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 authentication-mode scheme

 user-role network-admin

#              

line class vty

 user-role network-operator

#

line aux 0

 user-role network-admin

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 GigabitEthernet1/0/0 119.145.197.193 preference 80

 ip route-static 0.0.0.0 0 Dialer0

 ip route-static 10.10.100.0 24 GigabitEthernet1/0/0 119.145.197.193 preference 55

 ip route-static 10.10.113.0 24 GigabitEthernet1/0/0 119.145.197.193 preference 55

 ip route-static 192.168.111.0 24 GigabitEthernet1/0/0 119.145.197.193 preference 55

#

 ssh server enable

#

 arp ip-conflict log prompt

#              

acl advanced 3000

 description Basic

 rule 0 deny ip source 10.10.104.0 0.0.0.255 destination 10.10.100.0 0.0.0.255 counting

 rule 3 deny ip source 10.10.104.0 0.0.0.255 destination 192.168.111.0 0.0.0.255

 rule 5 deny ip source 10.10.104.0 0.0.0.255 destination 10.10.113.0 0.0.0.255

 rule 15 permit ip counting

#

acl advanced 3200

 rule 5 permit ip destination 61.144.201.178 0

 rule 6 permit ip destination 120.237.131.66 0

 rule 7 permit ip destination 101.230.4.30 0

 rule 8 permit ip source 10.10.104.0 0.0.0.255 destination 192.168.111.0 0.0.0.255

 rule 10 permit ip source 10.10.104.0 0.0.0.255 destination object-group 5G-IP

 rule 20 permit ip source 10.10.104.0 0.0.0.255 destination object-group PBX

 rule 30 permit ip source 10.10.104.0 0.0.0.255 destination object-group XinWangBank

 rule 40 permit ip source 10.10.104.0 0.0.0.255 destination object-group ZhongXinSystem

 rule 45 permit ip source 10.10.104.9 0

#

acl advanced name IPsec_SZHY_IPv4_1

 description HaoYangDepartment

 rule 0 permit ip source 10.10.104.0 0.0.0.255 destination 10.10.100.0 0.0.0.255

 rule 1 permit ip source 10.10.104.0 0.0.0.255 destination 10.10.113.0 0.0.0.255

#              

acl advanced name IPsec_SZHY_IPv4_2

 description ShenZhenSiCheng

 rule 0 permit ip source 10.10.104.0 0.0.0.255 destination 192.168.111.0 0.0.0.255

#

acl advanced name IPsec_SZHY_IPv4_3

 description GuangZhouBank

 rule 0 permit ip source 10.9.87.104 0 destination 10.15.205.0 0.0.0.255

 rule 1 permit ip source 10.9.150.0 0.0.0.255 destination 10.15.205.0 0.0.0.255

 rule 2 permit ip source 10.9.151.0 0.0.0.255 destination 10.15.205.0 0.0.0.255

#

acl advanced name JiaFangSystem

 description JiaFang System

 rule 0 permit ip destination object-group 5G-IP

 rule 5 permit ip destination object-group DShangYun

 rule 10 permit ip destination object-group GlobalCall

 rule 15 permit ip destination object-group PBX

 rule 20 permit ip destination object-group XinWangBank

 rule 25 permit ip destination object-group ZhongXinSystem

#

domain system

#

 domain default enable system

#              

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 password hash $h$6$ZVmZgU8ouSi3q6M+$k98iz8E1MpoDlvOU8yCc1/PYeXlqSUHEnCW5CZIiiz+Zzl4WAyf/+jmeNiH75wG/0o1gtT7CsV/QmESf4Pnfpw==

 service-type ssh terminal https

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

 ipsec logging negotiation enable

#

ipsec transform-set SZHY_IPv4_1

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

 pfs dh-group1

#

ipsec transform-set SZHY_IPv4_2

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

 pfs dh-group1

#

ipsec transform-set SZHY_IPv4_3

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

 pfs dh-group2

#

ipsec policy SZHY 1 isakmp

 transform-set SZHY_IPv4_1 

 security acl name IPsec_SZHY_IPv4_1 

 local-address 119.145.197.195

 remote-address 61.144.201.178

 description ShenZhenZongBu

 ike-profile SZHY_IPv4_1

#

ipsec policy SZHY 2 isakmp

 transform-set SZHY_IPv4_2 

 security acl name IPsec_SZHY_IPv4_2 

 local-address 119.145.197.195

 remote-address 120.237.131.66

 description SiCheng¡ê?Password: h3c123456

 ike-profile SZHY_IPv4_2

#

ipsec policy SZHY 3 isakmp

 transform-set SZHY_IPv4_3 

 security acl name IPsec_SZHY_IPv4_3 

 local-address 119.145.197.195

 remote-address 101.230.4.30

 description GuangZhouBank¡ê?Password¡êoHy2GzAYh

 ike-profile SZHY_IPv4_3

 sa duration time-based 86400

#

 ike logging negotiation enable

#

ike profile SZHY_IPv4_1

 keychain SZHY_IPv4_1

 local-identity address 119.145.197.195

 match remote identity address 61.144.201.178 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 1 

#

ike profile SZHY_IPv4_2

 keychain SZHY_IPv4_2

 exchange-mode aggressive

 local-identity address 119.145.197.195

 match remote identity address 120.237.131.66 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 2 

#

ike profile SZHY_IPv4_3

 keychain SZHY_IPv4_3

 local-identity address 119.145.197.195

 match remote identity address 101.230.4.30 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 3 

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike proposal 2

 encryption-algorithm aes-cbc-128

 sa duration 28800

#

ike proposal 3

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

#

ike keychain SZHY_IPv4_1

 match local address GigabitEthernet1/0/0

 pre-shared-key address 61.144.201.178 255.255.255.255 key cipher $c$3$gkcQkHdEZ8mi1UQFZFtc7W+dDNzwF9RdMe3U

#

ike keychain SZHY_IPv4_2

 match local address GigabitEthernet1/0/0

 pre-shared-key address 120.237.131.66 255.255.255.255 key cipher $c$3$3suCkx4qUbymnSuPfXBeAsNXo1yoQ15uS5IT7Q==

#

ike keychain SZHY_IPv4_3

 match local address GigabitEthernet1/0/0

 pre-shared-key address 101.230.4.30 255.255.255.255 key cipher $c$3$3lcB1EchyOv4OSCCi2Yl+XybadoXhd2kVV6U

#

 ip https enable

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

security-policy ip

 rule 2 name LocalAllow

  action pass

  disable

  logging enable

  source-zone Trust

  source-zone Untrust

  destination-zone Untrust

  destination-zone Trust

  source-ip Local-IP

  destination-ip 5G-IP

  destination-ip ZhongXinSystem

  destination-ip XinWangBank

  destination-ip PBX

  destination-ip GlobalCall

  destination-ip DShangYun

 rule 3 name LocalRefuse

  disable

  counting enable

  source-zone Trust

  source-zone Untrust

  destination-zone Trust

  destination-zone Untrust

  source-ip Local-IP

 rule 1 name AllNet

  action pass

  logging enable

  counting enable

#

 cloud-management server domain opstunnel-seccloud.h3c.com

#

return

[H3C]                                                                           

[H3C]

[H3C]

[H3C]

[H3C]