ipsec 野蛮模式点到多点（分支通过总部进行互相访问）

需求：

总部与二分支之间通过ipsec vpn进行连通，需要实现分支1与分支2通过总部ipsec vpn进行连通 （测试需要分支1与分支2同时进行ping去触发感兴趣流）

总部配置分解：

ACL配置感兴趣流：
acl advanced 3005（总部与分支1的感兴趣流）
rule 1 permit ip source 192.168.30.0 0.0.0.255 destination 192.168.20.0 0.0.0.255   //分支2访问分支1
rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255  //总部与分支1访问

acl advanced 3009（总部与分支2的感兴趣流）
rule 1 permit ip source 192.168.20.0 0.0.0.255 destination 192.168.30.0 0.0.0.255  //分支1访问分支2
rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.30.0 0.0.0.255  //总部访问分支2

共用配置：
ipsec transform-set tran1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5

ike proposal 1
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm sha256

总部上分支1的配置：
ike keychain fenzhi_1
pre-shared-key hostname fenzhi_1 key cipher $c$3$17qIYFtCHXAMt5U2ljnoyIVyz4K7cEh89+oI

ike profile fenzhi_1
keychain fenzhi_1
exchange-mode aggressive
local-identity fqdn idc
match remote identity fqdn fenzhi_1

ipsec policy-template fenzhi_1 1
transform-set tran1
security acl 3005
ike-profile fenzhi_1

ipsec policy idc 1 isakmp template fenzhi_1

总部上分支2的配置：
ike keychain fenzhi_2
pre-shared-key hostname fenzhi_2 key cipher $c$3$IvFLho69ketSeD0h3YJliwxEJeXt1jHVotbb

ike profile fenzhi_2
keychain fenzhi_2
exchange-mode aggressive
local-identity fqdn idc
match remote identity fqdn fenzhi_2
proposal 1

ipsec policy-template fenzhi_2 1
transform-set tran1
security acl 3009
ike-profile fenzhi_2

ipsec policy idc 2 isakmp template fenzhi_2 

接口配置：
interface GigabitEthernet0/1
ip address 1.1.1.2 255.255.255.252
ipsec apply policy idc

分支2上的vpn配置：

感兴趣流：
acl advanced 3005
rule 0 permit ip source 192.168.30.0 0.0.0.255 destination 192.168.10.0 0.0.0.255   //访问总部
rule 1 permit ip source 192.168.30.0 0.0.0.255 destination 192.168.20.0 0.0.0.255  //访问分支1

ipsec transform-set tran1    //ipsec安全提议
esp encryption-algorithm des-cbc
esp authentication-algorithm md5

ike identity fqdn fenzhi_2   //本地fqdn标签

ike proposal 1   //ike安全提议
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm sha256

ike keychain fenzhi_2   //ike对等体
pre-shared-key address 1.1.1.2 255.255.255.252 key cipher $c$3$QRgyTxGfARrXuUD+q/wXU2IkUxzzgYJvzpIE

ike profile fenzhi_2
keychain fenzhi_2
exchange-mode aggressive
local-identity fqdn fenzhi_2
match remote identity fqdn idc
proposal 1

ipsec policy fenzhi_2 1 isakmp    //ipsec安全策略
transform-set tran1
security acl 3005
remote-address 1.1.1.2
ike-profile fenzhi_2

interface GigabitEthernet0/0
ipsec apply policy fenzhi_2

分支一的配置参照分支2即可

验证截图：