H3C or Cisco.doc

CISCO設(shè)備（PIX/ASA/ROUTER）:外網(wǎng)口ip：1.1.1.1內(nèi)網(wǎng)服務(wù)器：192.168.1.1H3C secpath：外網(wǎng)口ip：2.2.2.2內(nèi)網(wǎng)服務(wù)器：192.168.2.2通過ipsec vpn，允許兩臺服務(wù)器之間通訊CISCO配置：#步驟1crypto isakmp policy 10authentication pre-shareencryption 3deshash shagroup 2lifetime 86400#步驟2crypto ipsec transform-setMyset esp-des esp-sha-hmac crypto map Myvpn 1 matchaddress VPNcrypto map Myvpn 1 set peer 2.2.2.2crypto map Myvpn 1 settransform-set Mysetcrypto map Myvpn interfaceoutsidecrypto isakmp identity addresscrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption 3deshash shagroup 2lifetime 86400tunnel-group 2.2.2.2 type ipsec-l2ltunnel-group 2.2.2.2 ipsec-attributespre-shared-key 123456#定義感興趣流量access-list VPN extendedpermit ip host 192.168.1.1 host 192.168.2.2 H3C的配置：#ike peer peermtompre-shared-key 123456remote-address 1.1.1.1local-address 2.2.2.2#對應(yīng)cisco的步驟1（藍色標(biāo)記的參數(shù)兩邊必須一致）ike proposal 1authentication-algorithm shaauthentication-method pre-shareencryption-algorithm 3des-cbcdh group2sa duration 86400#對應(yīng)cisco的步驟2（藍色標(biāo)記的參數(shù)兩邊必須一致）ipsec proposal promtomencapsulation-mode tunnel transform espesp encryption-algorithm 3desesp authentication-algorithm sha1#ipsec policy policymtom 10 isakmpsecurity acl 3333ike-peer peermtomproposal promtom#定義感興趣流量（必須與cisco中定義的感興趣流量互為鏡像）acl number 3333rule 0 permit ip source 192.168.2.2 0destination 192.168.1.1 0rule 5 deny ip#將內(nèi)網(wǎng)服務(wù)器地址從nat轉(zhuǎn)換列表中去除(應(yīng)盡量放在第一行)假設(shè)防火墻上用于NAT轉(zhuǎn)換的acl為2000：acl number 2000rule 0 deny source 192.168.2.2 0# 配置到對方內(nèi)網(wǎng)服務(wù)器的靜態(tài)路由ip route-static 192.168.1.1 32g1/0 (g1/0為防火墻外網(wǎng)口)#在外網(wǎng)接口上應(yīng)用ipsec#int g1/0ipsecpolicy policymtom配置完成后，在