FW-A配置:
acl advanced 3000
rule 5 deny ip soure 192.168.0.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 10 permit ip
acl advanced 3000
rule 5 permit ip soure 192.168.0.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
IKE 阶段
ike keychain CJ
pre-shared-key address 218.17.21.25 255.255.255.255 key simple 12345678
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
ike profile CJ
keychain CJ
local-identity address 183.62.141.212
match remote identity address 218.17.21.25 255.255.255.255
match local address GigabitEthernet1/0/0
proposal 1
IPSEC 阶段:
ipsec transform-set JT
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
ipsec policy ipsec-cj 1 isakmp
transform-set JT
security acl 3001
local-address 183.62.141.242
remote-address 218.17.21.2
description TO_CJ
ike-profile CJ
在接口调用策略和nat
interface GigabitEthernet1/0/0
ip address 183.62.141.212 255.255.255.252
ipsec apply policy ipsec-cj
nat outbound 3000
FW-B配置:
两端配置是相对的。
acl advanced 3000
rule 5 deny ip soure 192.168.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255
rule 10 permit ip
acl advanced 3000
rule 5 permit ip soure 192.168.1.0 0.0.0.255 destination 192.168.0.0 0.0.0.255
IKE 阶段
ike keychain JT
pre-shared-key address 183.62.141.212 255.255.255.255 key simple 12345678
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
ike profile JT
keychain JT
local-identity address 218.17.21.25
match remote identity address 183.62.141.212 255.255.255.255
match local address GigabitEthernet1/0/0
proposal 1
IPSEC 阶段:
ipsec transform-set CJ
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
ipsec policy ipsec-jt 1 isakmp
transform-set JT
security acl 3001
local-address 218.17.21.25
remote-address 183.62.141.212
description TO_JT
ike-profile JT
在接口调用策略和nat
interface GigabitEthernet1/0/0
ip address 218.17.21.25 255.255.255.252
ipsec apply policy ipsec-jt
nat outbound 3000
最后在两端内网终端ping测试对端终端。
查询ike、ipsec信息传输
dis ike sa
dis ike sa verbpse
dis ipsec policy