MSR36-20 IPsec IKEv2

拓扑如下：

对端微软云IPSEC VPN参数，根据使用场景不同，有以下两种配置方式对接。

一、基于tunnel口的IPSEC VPN建立

主要配置

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 123.XXX.XXX.XXX 255.255.255.252

 nat outbound 2000

#

interface Tunnel1 mode ipsec

 ip address 192.254.0.1 255.255.255.0

 tcp mss 1350

 source  123.XXX.XXX.XXX         

 destination 321.XXX.XXX.XXX 

 tunnel protection ipsec profile weiruanyun  

 ipsec sa idle-time 7200 

#

ipsec transform-set weiruanyun

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha1

 pfs dh-group24

#

ipsec profile weiruanyun isakmp

 transform-set weiruanyun

 ikev2-profile weiruanyun

#

ike dpd interval 5 on-demand 

#

ikev2 keychain weiruanyun

 peer peer_weiruanyun

  address 321.XXX.XXX.XXX 255.255.255.255

  identity address 321.XXX.XXX.XXX

  pre-shared-key ciphertext  XXXX

#

ikev2 profile profile_azure

 authentication-method local pre-share

 authentication-method remote pre-share

 keychain weiruanyun

 match local address 123.XXX.XXX.XXX

 match remote identity address 321.XXX.XXX.XXX 255.255.255.255

#

ikev2 proposal proposal_weiruanyun

 encryption aes-cbc-256 

 integrity sha384

 dh group24

#

ikev2 policy policy_weiruanyun

 proposal proposal_weiruanyun

#

二、修改IPSEC VPN感兴趣流

主要配置

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 123.XXX.XXX.XXX 255.255.255.224

 nat outbound 2000

 ipsec apply policy weiruanyun

#

acl advanced 3050

 rule 0 permit ip source any     //允许所有流量进行IPSEC 封装

#

ipsec transform-set weiruanyun

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha1

 pfs dh-group24

#

ipsec policy weiruanyun isakmp

 transform-set weiruanyun

 security acl 3050

 remote-address 321.XXX.XXX.XXX

 ikev2-profile profile_weiruanyun

 sa idle-time 7200

#

ike dpd interval 5 on-demand

#

ike profile weiruanyun

 keychain key_weiruanyun

 dpd interval 5 on-demand

 local-identity address 123.XXX.XXX.XXX

 match remote identity address 321.XXX.XXX.XXX 255.255.255.255

 match local address GigabitEthernet1/0/1

  proposal weiruanyun

#

ike proposal weiruanyun

 encryption-algorithm aes-cbc-256

 authentication-algorithm sha384

 dh group24

#

ike keychain key_weiruanyun

 match local address GigabitEthernet1/0/1

 pre-shared-key address 321.XXX.XXX.XXX 255.255.255.255 key cipher XXXX

1.       使用第二种方式配置时，注意全部流量都会被IPSEC 封装，正常访问公网的流量会不同。

2.       使用第一种方式配置时，在tunnel口下的tunnel protection ipsec的命令在仅较新版本支持，防火墙相同。