ER3100+FS100-S-G2组建VPN

以下是一端固定地址，一端动态获取地址，设备配置野蛮模式ipsec的配置案例。固定地址的也可以配置野蛮模式。主模式与野蛮模式不同的配置地方参考以下案例的注释部分///

一、 组网

二：需求

描述：ER5200动态ip获取地址上网，F100-A-G2固定ip地址上网，ipsec vpn野蛮模式，使用域名类型对接ipsec vpn，使两边内网互通。

三、配置

F100-A-G2配置：

<H3C>dis cu

#

 dhcp enable

#

dhcp server ip-pool 1

 gateway-list 192.168.2.1

 network 192.168.2.0 mask 255.255.255.0

 dns-list 8.8.8.8

#

interface GigabitEthernet1/0/0

 port link-mode route

 ip address 192.168.2.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 20.20.20.2 255.255.255.0

 nat outbound 3002

 ipsec apply policy 1

#

security-zone name Trust      内网口加入Trust域

 import interface GigabitEthernet1/0/0

#

security-zone name Untrust    外网口加入Untrust域

 import interface GigabitEthernet1/0/1

#

security-zone name Management

#

zone-pair security source Any destination Any   放通域间策略

 packet-filter 3000

#              

zone-pair security source Local destination Trust

 packet-filter 3000

#

zone-pair security source Trust destination Local

 packet-filter 3000

#

 ip route-static 0.0.0.0 0 20.20.20.1

#

 ssh server enable

#

acl advanced 3000

 rule 0 permit ip

#

acl advanced 3001

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

acl advanced 3002     nat优先于ipsec，所以deny掉nat的感兴趣流

 rule 0 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

 rule 5 permit ip

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy-template 1 1

 transform-set 1

 security acl 3001

 ike-profile 1

#

ipsec policy 1 1 isakmp template 1

#

 ike identity fqdn F100-A-G2    配置本设备的域名    //主模式不用配置这个

#

ike profile 1

 keychain 1

 exchange-mode aggressive    //主模式修改为： exchange-mode  main

 match remote identity fqdn ER5200    //主模式修改为：match remote identity address  对端公网地址 

 match local address 20.20.20.2

 proposal 1

#

ike proposal 1

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

#

ike keychain 1

 pre-shared-key address 0.0.0.0 0.0.0.0 key simple 密码   //主模式修改为pre-shared-key address 对端公网地址 255.255.255.0 key simple 密码

ER5200G2端配置：

1.配置外网口为动态地址获取，“接口管理---WAN设置---连接到因特网”   //修改为固定地址

2.启用DHCP服务器

3.ipsec vpn虚接口设置，“VPN—Ipsec vpn---虚接口”

4.配置ike proposal，“VPN---IPsec vpn—安全提议”

5.配置ike 对等体参数，“VPN---IPsec vpn—IKE对等体”，注意ID的配置   //主模式修改为：协商模式为主模式，ID类型是IP类型，本端ID填写本端公网地址，对端ID填写对端公网di

6.配置ipsec transform，“VPN---IPsec vpn—IPSEC安全提议”

7.配置ipsec policy，“VPN---IPsec vpn—IPSEC安全策略”

8.启用IPSec设置

9.配置静态路由，“高级设置---路由设置---静态路由”

四、结果

F100-A-G2侧：

<H3C>dis ike sa

    Connection-ID   Remote                Flag         DOI    

------------------------------------------------------------------

    2               10.10.10.2            RD           IPsec  

Flags:

RD--READY RL--REPLACED FD-FADING RK-REKEY

<H3C>dis ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/1

-------------------------------

  -----------------------------

  IPsec policy: 1

  Sequence number: 1

  Mode: Template

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1444

    Tunnel:

        local  address: 20.20.20.2

        remote address: 10.10.10.2

    Flow:

        sour addr: 192.168.2.0/255.255.255.0  port: 0  protocol: ip

        dest addr: 192.168.1.0/255.255.255.0  port: 0  protocol: ip

    [Inbound ESP SAs]

      SPI: 22345204 (0x0154f5f4)

      Connection ID: 4294967298

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843195/2987

      Max received sequence-number: 25

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for NAT traversal: N

      Status: Active

    [Outbound ESP SAs]

      SPI: 2431012625 (0x90e64f11)

      Connection ID: 4294967299

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843196/2987

      Max sent sequence-number: 17

      UDP encapsulation used for NAT traversal: N

      Status: Active

ER5200G2侧：