華為IPSECVPN互通+上網(wǎng)配置示例【包含基本VPN+NAT+NAT免俗】

華為IPSECVPN互通+上網(wǎng)配置示例【包含基本VPN+NAT+NAT免俗】一、實(shí)驗(yàn)?zāi)康恼莆誑AT的配置掌握IPSECVPN的基礎(chǔ)配置二、實(shí)驗(yàn)拓?fù)?€(Xj'1.20/24GEO/M)EthernetCWM1CLIErJH172.16.10,gw10.1/InternetgM20.123-1.1,216/24172.16.20Ethem0€(Xj'1.20/24GEO/M)EthernetCWM1CLIErJH172.16.10,gw10.1/InternetgM20.123-1.1,216/24172.16.20Ethem第時1CLIENT2l&O,lOfl.iee.lOO2&e.2&&.2e&.2eeIPSECVPN配荒示例三、配置要點(diǎn)1.總公司的配置#sysnameZongGongSi#aclnumber3000rule5denyipsource172.16.10.00.0.0.255destination172.16.20.00.0.0,255rule10permitipaclnumber3001rule5permitipsource172.16.10.00.0.0.255destination172.16.20.00.0.0,255#ipsecproposaltest#ikeproposal1#ikepeertestv2pre-shared-keysimplepasswordremote-address23.1,1.2ipsecpolicytest10isakmpsecurityacl3001ike-peertestproposaltest#interfaceGigabitEthernet0/0/0ipaddress172.16.10.1255.255.255.0interfaceGigabitEthernet0/0/1ipaddress12.1,1,1255.255.255.0ipsecpolicytestnatoutbound3000#iproute-static0.0,0.00.0.0,012.1.1.22.分公司配置sysnameFenGongSi#aclnumber3000rule5denyipsource172.16.20.00.0.0.255destination172.16.10.00.0.0,255rule10permitipaclnumber3001rule5permitipsource172.16.20.00.0.0.255destination172.16.10.00.0.0,255#ipsecproposaltest#ikepeertestv2pre-shared-keysimplepasswordremote-address12.1,1.1#ipsecpolicytest10isakmpsecurityacl3001ike-peertestproposaltest#interfaceGigabitEthernet0/0/0ipaddress172.16.20.1255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress23.1,1,2255.255.255.0ipsecpolicytestnatoutbound3000#iproute-static0.0,0.00.0.0,023.1.1.1#3,互聯(lián)網(wǎng)的配置#sysnameInternet#interfaceGigabitEthernet0/0/0ipaddress12.1,1,2255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress23.1,1,1255.255.255.0#interfaceLoopBack100ipaddress100.100.100.100255.255.255.0#interfaceLoopBack200ipaddress200.200.200.200255.255.255.0互通測試.主機(jī)上ping分支上網(wǎng)PC>ping172.16.20.20Ping172.16.20.20:32databytes,PressCtrl_CtobreakFrom172.16.20.20:bytes=32seq=1ttl=127time=47msFrom172.16.20.20:bytes=32seq=2ttl=127time=47msFrom172.16.20.20:bytes=32seq=3ttl=127time=31msFrom172.16.20.20:bytes=32seq=4ttl=127time=16msFrom172.16.20.20:bytes=32seq=5ttl=127time=31ms---172.16.20.20pingstatistics--5packet(s)transmitted5packet(s)received0.00%packetlossround-tripmin/avg/max=16/34/47msPC>ping100.100.100.100Ping100.100.100.100:32databytes,PressCtrl_CtobreakFrom100.100.100.100:bytes=32seq=1ttl=254time=31msFrom100.100.100.100:bytes=32seq=2ttl=254time=15msFrom100.100.100.100:bytes=32seq=3ttl=254time=31msFrom100.100.100.100:bytes=32seq=4ttl=254time=47msFrom100.100.100.100:bytes=32seq=5ttl=254time=47ms---100.100.100.100pingstatistics--5packet(s)transmitted5packet(s)received0.00%packetlossround-tripmin/avg/max=15/34/47ms.路由器上校驗(yàn)<ZongGongSi>disikesav2Conn-IDPeerVPNFlag(s)Phase23.1.1.20RD2223.1.1.20RD1FlagDescription:RD--READYST--STAYALIVERL--REPLACEDFD--FADINGTO--TIMEOUTHRT--HEARTBEATLKG--LASTKNOWNGOODSEQNO,BCK--BACKEDUP<ZongGongSi>disipsecsabriefN