华为IPsec 手动配置实例_rule 1 permit source-CSDN博客

本文提供了华为设备R1、R3的手动IPsec配置实例，详细阐述了如何进行DHCP设置、ACL规则、IP地址分配、NAT转换、静态路由以及IPsec提案和策略的配置，以实现安全的网络互连。通过配置，R1和R3之间的通信将受到ESP协议的sha2-256和aes-256加密保护。

在这里插入图片描述
R1配置
dhcp en

acl 3001
rule 1 deny ip destination 192.168.20.0 0.0.0.255
rule 2 permit ip

int g0/0/0
ip add 192.168.10.254 24
dhcp sel interface
int g0/0/1
ip add 12.0.0.1 24
nat outbound 3001
ip route-static 0.0.0.0 12.0.0.2

acl 3000
rule 1 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

ipsec proposal toSH
esp Authentication-algorithm sha2-256
esp Encryption-algorithm aes-256

ipsec policy hfvpn 1 manual
security acl 3000
proposal toSH
tunnel local 12.0.0.1
tunnel remote 23.0.0.3
sa spi inbound esp 12345
sa string-key inbound esp cipher wakin
sa spi outbound esp 54321
sa string-key outbound esp cipher wakin

R3配置

dhcp en

acl 3001
rule 1 deny ip destination 192.168.10.0 0.0.0.255
rule 2 permit ip

int g0/0/1
ip add 192.168.20.254 24
dhcp sel interface
int g0/0/0
ip add 23.0.0.1 24
nat out 3001
ip route-static 0.0.0.0 23.0.0.2

acl 3000
rule 1 permit ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

ipsec proposal toHF
esp Authentication-algorithm sha2-256
esp Encryption-algorithm aes-256

ipsec policy SHvpn 1 manual
security acl 3000
proposal toHF
tunnel local 23.0.0.3
tunnel remote 12.0.0.1
sa spi inbound esp 54321
sa string-key inbound esp cipher wakin
sa spi outbound esp 12345
sa string-key outbound esp cipher wakin

R2配置

sysname ISP

interface GigabitEthernet0/0/0
ip address 12.0.0.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 23.0.0.2 255.255.255.0

interface LoopBack2
ip address 2.2.2.2 255.255.255.255