IPSEC在NAT场景中所遇到的问题

一、实验拓扑

二、基础配置

如上图所示配置相应的接口地址和主机地址（此处省略..........）

三、详细配置及结果验证

（一）FW1和FW2通过IPSEC及NAT实现跨外网连接

FW3防火墙NAT设置

[FW3-address-group-NAT_POOL]dis th
#
nat address-group NAT_POOL 1
 mode no-pat global
 section 0 155.1.12.12 155.1.12.12
#

[FW3-policy-nat-rule-NAT]dis th
#
 rule name NAT
  source-zone trust
  destination-zone untrust
  source-address 10.1.121.12 mask 255.255.255.255
  action source-nat address-group NAT_POOL
#

在FW1和FW3启用OSPF并设置默认路由

[FW3]dis ip routing-table protocol static 

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        0.0.0.0/0   Static  60   0          RD   155.1.12.2      GigabitEthernet1/0/0

[FW3-ospf-1]dis th
#
ospf 1
 default-route-advertise
 area 0.0.0.0
  network 10.1.0.0 0.0.255.255
#

[FW3]dis firewall session table 
 Current Total Sessions : 1
 udp  VPN: public --> public  10.1.121.12:4500[155.1.12.12:4500] --> 155.1.132.1
3:4500

FW1和FW2防火墙之间设置站点到站点IPSEC vpn

FW1设置

acl number 3000
 rule 5 permit ip source 10.1.0.0 0.0.255.255 destination 10.1.0.0 0.0.255.255
#
ipsec proposal LAN_SET
 esp authentication-algorithm sha1
 esp encryption-algorithm 3des
#
ike proposal 10
 encryption-algorithm 3des
 dh group2
 authentication-algorithm sha1
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
ike peer FW2
 pre-shared-key HUAWEI@123
 ike-proposal 10

 nat traversal
 remote-address 155.1.132.13
#
ipsec policy LAN_MAP 10 isakmp
 security acl 3000
 ike-peer FW2
 proposal LAN_SET
#

FW2设置

acl number 3000
 rule 5 permit ip source 10.1.0.0 0.0.255.255 destination 10.1.0.0 0.0.255.255
#
ipsec proposal LAN_SET
 esp authentication-algorithm sha1
 esp encryption-algorithm 3des
#
ike proposal 10
 encryption-algorithm 3des
 dh group2
 authentication-algorithm sha1
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
ike peer FW1
 pre-shared-key HUAWEI@123
 ike-proposal 10

 nat traversal
 remote-address 155.1.12.12
#
ipsec policy LAN_MAP 10 isakmp
 security acl 3000
 ike-peer FW1
 proposal LAN_SET
#

防火墙安全策略

[FW1-policy-security]dis th#
security-policy
 rule name LOCAL_TO_ANY
  source-zone local
  action permit
 rule name IN_TO_OUT
  source-zone trust
  destination-zone untrust
  action permit
 rule name OUT_TO_LOCAL
  source-zone untrust
  destination-zone local
  service protocol udp destination-port 4500
  service protocol udp destination-port 500
  action permit
 rule name OUT_TO_IN
  source-zone untrust
  destination-zone trust
  source-address 10.1.0.0 mask 255.255.0.0
  destination-address 10.1.0.0 mask 255.255.0.0
  action permit
#

FW2安全策略与FW1相同

四、结果验证

PC>ping 10.1.13.10

Ping 10.1.13.10: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 10.1.13.10: bytes=32 seq=2 ttl=126 time=16 ms
From 10.1.13.10: bytes=32 seq=3 ttl=126 time=31 ms

[FW1]dis ike sa

IKE SA information :
 Conn-ID    Peer                                          VPN              Flag(
s)               Phase  RemoteType  RemoteID        
--------------------------------------------------------------------------------
----------------------------------------------------
 70         155.1.132.13:4500                                              RD|A 
                 v2:2   IP          155.1.132.13    
 69         155.1.132.13:4500                                              RD|A 
                 v2:1   IP          155.1.132.13    

  Number of IKE SA : 2
--------------------------------------------------------------------------------
----------------------------------------------------