首页 > 其他分享 >构建L2L结构IPSecVPN

构建L2L结构IPSecVPN

时间：2024-11-17 18:48:20浏览次数：3  
标签：interzone untrust L2L IPSecVPN 构建 policy trust FW1 FW2

1.启动设备

2.配置IP地址

FW1配置：

3.给防火墙划分区域

[FW1]firewall zone trust

[FW1-zone-trust]add int g0/0/0

[FW1-zone-trust]q

[FW1]firewall zone untrust

[FW1-zone-untrust]add int g0/0/1

4.配置路由条目

[FW1]ip route-static 0.0.0.0 0.0.0.0 100.0.0.2

5.配置NAT

[FW1]nat-policy interzone trust untrust outbound

[FW1-nat-policy-interzone-trust-untrust-outbound]policy 1

[FW1-nat-policy-interzone-trust-untrust-outbound-1]policy source 10.0.0.0 0.255.255.255

[FW1-nat-policy-interzone-trust-untrust-outbound-1]policy destination 192.168.1.0 0.0.0.255

[FW1-nat-policy-interzone-trust-untrust-outbound-1]action no-nat

[FW1-nat-policy-interzone-trust-untrust-outbound-1]q

[FW1-nat-policy-interzone-trust-untrust-outbound]policy 2

[FW1-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

[FW1-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/1

[FW1-nat-policy-interzone-trust-untrust-outbound-2]q

[FW1-nat-policy-interzone-trust-untrust-outbound]q

6.创建IKE安全协议

[FW1]ike proposal 1

[FW1-ike-proposal-1]authentication-method pre-share

[FW1-ike-proposal-1]authentication-algorithm sha1

[FW1-ike-proposal-1]integrity-algorithm aes-xcbc-96

[FW1-ike-proposal-1]dh group2

[FW1-ike-proposal-1]q

7.配置IKEpeer对等体连接

[FW1]ike peer FW2

[FW1-ike-peer-fw2]pre-shared-key 666.wyjx

[FW1-ike-peer-fw2]remote-address 200.0.0.1

[FW1-ike-peer-fw2]ike-proposal 1

[FW1-ike-peer-fw2]q

8.配置IPSec安全协议

[FW1]ipsec proposal test

[FW1-ipsec-proposal-test]encapsulation-mode tunnel

[FW1-ipsec-proposal-test]transform esp

[FW1-ipsec-proposal-test]esp encryption-algorithm aes

[FW1-ipsec-proposal-test]esp authentication-algorithm sha1

[FW1-ipsec-proposal-test]q

9.创建ACL列表，监控流量

[FW1]acl 3000

[FW1-acl-adv-3000]rule permit ip source 10.0.0.0 0.255.255.255 destination 192.168.1.0 0.0.0.255

[FW1-acl-adv-3000]q

10.创建安全策略

[FW1]ipsec policy wyjx 1 isakmp

[FW1-ipsec-policy-isakmp-wyjx-1]ike-peer FW2

[FW1-ipsec-policy-isakmp-wyjx-1]proposal test

[FW1-ipsec-policy-isakmp-wyjx-1]security acl 3000

[FW1-ipsec-policy-isakmp-wyjx-1]q

11.在接口上引用安全策略

[FW1]int g0/0/1

[FW1-GigabitEthernet0/0/1]ipsec policy wyjx

[FW1-GigabitEthernet0/0/1]q

12.配置区域间安全策略

[FW1]policy interzone trust untrust outbound

[FW1-policy-interzone-trust-untrust-outbound]policy 1

[FW1-policy-interzone-trust-untrust-outbound-1]action permit

[FW1-policy-interzone-trust-untrust-outbound-1]q

[FW1-policy-interzone-trust-untrust-outbound]q

[FW1]policy interzone trust untrust inbound

[FW1-policy-interzone-trust-untrust-inbound]policy 1

[FW1-policy-interzone-trust-untrust-inbound-1]policy source 192.168.1.0 0.0.0.255

[FW1-policy-interzone-trust-untrust-inbound-1]policy destination 10.0.0.0 0.255.255.255

[FW1-policy-interzone-trust-untrust-inbound-1]action permit

[FW1-policy-interzone-trust-untrust-inbound-1]q

[FW1-policy-interzone-trust-untrust-inbound]q

[FW1]policy interzone local untrust inbound

[FW1-policy-interzone-local-untrust-inbound]policy 1

[FW1-policy-interzone-local-untrust-inbound-1]policy source 200.0.0.1 0

[FW1-policy-interzone-local-untrust-inbound-1]policy destination 100.0.0.1 0

[FW1-policy-interzone-local-untrust-inbound-1]action permit

FW2配置

1.给防火墙划分区域

[FW2]firewall zone trust

[FW2-zone-trust]add int g0/0/0

[FW2-zone-trust]q

[FW2]firewall zone untrust

[FW2-zone-untrust]add int g0/0/1

2.配置路由条目

[FW2]ip route-static 0.0.0.0 0.0.0.0 200.0.0.2

3. 配置NAT

[FW2]nat-policy interzone trust untrust outbound

[FW2-nat-policy-interzone-trust-untrust-outbound]policy 1

[FW2-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.1.0 0.0.0.255

[FW2-nat-policy-interzone-trust-untrust-outbound-1]policy destination 10.0.0.0 0.255.255.255

[FW2-nat-policy-interzone-trust-untrust-outbound-1]action no-nat

[FW2-nat-policy-interzone-trust-untrust-outbound-1]q

[FW2-nat-policy-interzone-trust-untrust-outbound]policy 2

[FW2-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

[FW2-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/1

[FW2-nat-policy-interzone-trust-untrust-outbound-2]q

[FW2-nat-policy-interzone-trust-untrust-outbound]q

4. 创建IKE安全协议

[FW2]ike proposal 1

[FW2-ike-proposal-1]authentication-method pre-share

[FW2-ike-proposal-1]authentication-algorithm sha1

[FW2-ike-proposal-1]integrity-algorithm aes-xcbc-96

[FW2-ike-proposal-1]dh group2

[FW2-ike-proposal-1]q

5. 配置IKEpeer对等体连接

[FW2]ike peer FW1

[FW2-ike-peer-fw1]pre-shared-key 666.wyjx

[FW2-ike-peer-fw1]remote-address 100.0.0.1

[FW2-ike-peer-fw1]ike-proposal 1

[FW2-ike-peer-fw1]q

6. 配置IPSec安全协议

[FW2]ipsec proposal test

[FW2-ipsec-proposal-test]encapsulation-mode tunnel

[FW2-ipsec-proposal-test]transform esp

[FW2-ipsec-proposal-test]esp encryption-algorithm aes

[FW2-ipsec-proposal-test]esp authentication-algorithm sha1

[FW2-ipsec-proposal-test]q

7. 创建ACL列表，监控流量

[FW2]acl 3000

[FW2-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.255.255.255

[FW2-acl-adv-3000]q

8. 创建安全策略

[FW2]ipsec policy wyjx 1 isakmp

[FW2-ipsec-policy-isakmp-wyjx-1]ike-peer FW1

[FW2-ipsec-policy-isakmp-wyjx-1]proposal test

[FW2-ipsec-policy-isakmp-wyjx-1]security acl 3000

[FW2-ipsec-policy-isakmp-wyjx-1]q

9. 在接口上引用安全策略

[FW2]int g0/0/1

[FW2-GigabitEthernet0/0/1]ipsec policy wyjx

[FW2-GigabitEthernet0/0/1]q

10. 配置区域间安全策略

[FW2]policy interzone trust untrust outbound

[FW2-policy-interzone-trust-untrust-outbound]policy 1

[FW2-policy-interzone-trust-untrust-outbound-1]action permit

[FW2-policy-interzone-trust-untrust-outbound-1]q

[FW2-policy-interzone-trust-untrust-outbound]q

[FW2]policy interzone trust untrust inbound

[FW2-policy-interzone-trust-untrust-inbound]policy 1

[FW2-policy-interzone-trust-untrust-inbound-1]policy source 10.0.0.0 0.255.255.255

[FW2-policy-interzone-trust-untrust-inbound-1]policy destination 192.168.1.0 0.0.0.255

[FW2-policy-interzone-trust-untrust-inbound-1]action permit

[FW2-policy-interzone-trust-untrust-inbound-1]q

[FW2-policy-interzone-trust-untrust-inbound]q

[FW2]policy interzone local untrust inbound

[FW2-policy-interzone-local-untrust-inbound]policy 1

[FW2-policy-interzone-local-untrust-inbound-1]policy source 100.0.0.1 0

[FW2-policy-interzone-local-untrust-inbound-1]policy destination 200.0.0.1 0

[FW2-policy-interzone-local-untrust-inbound-1]action permit

启动HTTP服务器

验证：

Client1可以ping通HTTP服务器

Client1可以访问到HTTP服务器

抓取FW2的G0/0/1端口，Client1pingHTTP服务器看包为ESP

标签：interzone,untrust,L2L,IPSecVPN,构建,policy,trust,FW1,FW2
From： https://blog.csdn.net/2402_88627342/article/details/143777739

相关文章

  • Gitee push自动触发Jenkins构建测试
    Giteepush自动触发Jenkins测试可以实现每次提交代码(gitpull,PullRequest)后自动构建、测试（需要仓库管理者配置GiteeWebhook）。1配置方法简单来说：为一台服务器配置HTTP公网地址，实现内网穿透(如用花生壳做网页映射)在目标服务器上，安装并配置Jenkins，并配置对应的Gitee以......
  • 使用 PicoLisp 构建简易文字识别程序
    PicoLisp是一种轻量级的Lisp方言，适合于快速开发和实验性编程。本文将展示如何使用PicoLisp构建一个基本的文字识别程序。环境配置安装PicoLisp：下载PicoLisp的源代码，并根据系统进行编译。具体可参考PicoLisp官方文档。准备训练数据：我们使用简单的字符映射作为模型。......
  • cmake系列-怎么在构建C++库文件时动态的选择构建动态库还是静态库
    在之前我们介绍的内容里，关于构建动态库还是静态库都是在CMakeLists.txt里指定的，那如果一个解决方案原来是构建动态库，然后因为某些原因又希望构建静态库了，那岂不是还要修改CMakeLists.txt，对于平时用的构建系统来说好像还真的是需要修改，哈哈，但是cmake确实有方案能够在不用修改......
  • 构建最小生成树（Prim算法和Kruskal算法）
    其中克鲁斯卡尔算法中判断是否发生自环也可采用DFS和BFS判断，这里采用是并查集#include<iostream>#include<algorithm>#include<vector>usingnamespacestd;#defineINF100000000;classEdge{public:intx1,x2;//边的两个顶点intw;//权Edge(intX1......
  • 根据二叉树的前序和中序构建树，并按层次输出（C++）vector存树
    L2-006树的遍历#include<bits/stdc++.h>#defineintlonglongusingnamespacestd;#defineendl'\n'intpo[35];intino[35];vector<int>ans[50];intdfs(intl1,intr1,intl2,intr2){ for(inti=l2;i<=r2;i++){ if......
  • florr.io构建
    这里介绍一些综合性较强的构筑。(主要是PVP里的折叠突刺流（stingerrush）冲上去快速解决掉一个玩家！标签：#PvP #刺花瓣：3刺/玫瑰/更快/2泡泡/贝壳/粉末/触角收集难度：7/10优点：伤害极高，可以秒杀一个玩家或生物缺点：刺CD较长，被远程、召唤物消耗掉后不能快速回复；会被盐土海星反伤流克......
  • 写一个自动构建docker镜像推送至私有仓库并且部署的脚本
    脚本如下#catbuild/docker.sh#!/usr/bin/envbash#获取当前分支名BRANCH=`gitrev-parse--abbrev-refHEAD`#获取git提交的标识符用于Docker镜像的标签BUILD_TAG="$(gitrev-parse--short$BRANCH)"HARBOR_URL="harbor.xxx.com"echo"Tagis${BUILD_TAG}"......
  • 构建基于 HarmonyOS Next 的分布式工业监控系统
    本文旨在深入探讨华为鸿蒙HarmonyOSNext系统（截止目前API12）的技术细节，基于实际开发实践进行总结。主要作为技术分享与交流载体，难免错漏，欢迎各位同仁提出宝贵意见和问题，以便共同进步。本文为原创内容，任何形式的转载必须注明出处及原作者。工业自动化和智能制造的发展，正推动着......
  • HarmonyOS Next 实战：构建智能家居分布式协同系统
    本文旨在深入探讨华为鸿蒙HarmonyOSNext系统（截止目前API12）的技术细节，基于实际开发实践进行总结。主要作为技术分享与交流载体，难免错漏，欢迎各位同仁提出宝贵意见和问题，以便共同进步。本文为原创内容，任何形式的转载必须注明出处及原作者。随着智能家居的迅速发展，用户对智能设......
  • 自动化构建镜像：Packer
    在介绍Packer之前，先来回顾一下未使用Packer时自定义虚拟机镜像的步骤。先在本地启动一个虚拟机，从安装系统开始，再进行自定义配置或应用安装，最后封装压缩成镜像，详细操作步骤可以参考我之前写的文档，制作Centos7镜像：https://robin-2016.github.io/2019/04/08/制作openstack的centos7......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99