1、组网

2、需求

建立ipsec vpn实现各分支和总部之间互通，并且各分支之间也能通过总部访问。总部是固定ip地址，分支IP地址不固定，并且分支A、B处无人值守且分支无主动自动访问总部的业务运行，所以为了防止分支设备断电重启后无法主动建立隧道，需要通过NQA来实现设备断电重启后自动触发隧道建立。

3、关键配置

总部：

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.1.1.2 255.255.255.252

 nat outbound 3002

 ipsec apply policy test

#

 ip route-static 0.0.0.0 0 1.1.1.1

#

acl advanced 3000

 description toBranchA

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 5 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

#

acl advanced 3001

 description toBranchB

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

#

acl advanced 3002

 description outboundNATDenyFlow

 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 5 deny ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 10 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

 rule 15 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

 rule 100 permit ip

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy-template branchA 1

 transform-set 1

 security acl 3000

 ike-profile branchA

#

ipsec policy-template branchB 1

 transform-set 1

 security acl 3001

 ike-profile branchB

#

ipsec policy test 1 isakmp template branchA

#

ipsec policy test 2 isakmp template branchB

#

ike dpd interval 10 on-deman 

#

ike profile branchA

 keychain branchA

 exchange-mode aggressive

 local-identity fqdn headquarters

 match remote identity fqdn branchA

#

ike profile branchB

 keychain branchB

 exchange-mode aggressive

 local-identity fqdn headquarters

 match remote identity fqdn branchB

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain branchA

 match local address 1.1.1.2

 pre-shared-key hostname branchA key cipher $c$3$nng95cm/zlG3ghvIRim5saZ3bMEhoJD+Ow==

#

ike keychain branchB

 match local address 1.1.1.2

 pre-shared-key hostname branchB key cipher $c$3$Rl2okdkTYNBEYWd32X25LOWYkYo5YCcrgw==

#

分支A：

#

nqa entry admin test

 type icmp-echo

  destination ip 192.168.1.1

  frequency 5000

  history-record enable

  history-record number 10

  probe count 10

  probe timeout 500

  source ip 192.168.2.1

#

nqa entry admin test1

 type icmp-echo

  destination ip 192.168.3.1

  frequency 5000

  history-record enable

  history-record number 10

  probe count 10

  probe timeout 500

  source ip 192.168.2.1

#

 nqa schedule admin test start-time now lifetime forever

 nqa schedule admin test1 start-time now lifetime forever

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 2.2.2.2 255.255.255.252

 nat outbound 3001

 ipsec apply policy 1

#

 ip route-static 0.0.0.0 0 2.2.2.1

#

acl advanced 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

#

acl advanced 3001

 rule 0 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

 rule 100 permit ip

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy 1 1 isakmp

 transform-set 1

 security acl 3000

 remote-address 1.1.1.2

 ike-profile 1

#

ike dpd interval 10 on-demand

#

ike profile 1

 keychain 1

 exchange-mode aggressive

 local-identity fqdn branchA

 match remote identity fqdn headquarters

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain 1

 pre-shared-key address 1.1.1.2 255.255.255.0 key cipher $c$3$5QlYyBFEZTju/oTPut9zgP5JNpmVleBIbA==

#

分支B：

#

nqa entry admin test

 type icmp-echo

  destination ip 192.168.1.1

  frequency 5000

  history-record enable

  history-record number 10

  probe count 10

  probe timeout 500

  source ip 192.168.3.1

#

nqa entry admin test1

 type icmp-echo

  destination ip 192.168.2.1

  frequency 5000

  history-record enable

  history-record number 10

  probe count 10

  probe timeout 500

  source ip 192.168.3.1

#

 nqa schedule admin test start-time now lifetime forever

 nqa schedule admin test1 start-time now lifetime forever

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 3.3.3.2 255.255.255.252

 nat outbound 3001

 ipsec apply policy 1

#

 ip route-static 0.0.0.0 0 3.3.3.1

#

acl advanced 3000

 rule 0 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

#

acl advanced 3001

 rule 0 deny ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 deny ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 100 permit ip

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy 1 1 isakmp

 transform-set 1

 security acl 3000

 remote-address 1.1.1.2

 ike-profile 1

#

ike dpd interval 10 on-demand

#

ike profile 1

 keychain 1

 exchange-mode aggressive

 local-identity fqdn branchB

 match remote identity fqdn headquarters

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain 1

 pre-shared-key address 1.1.1.2 255.255.255.0 key cipher $c$3$5QlYyBFEZTju/oTPut9zgP5JNpmVleBIbA==

#

4、测试

分支A侧可以ping通总部和分支B