IPSec 虚拟专用网实验拓扑图（完整命令）

配置命令和基本参数路由器配置命令[AR1]int g0/0/1[AR1-GigabitEthernet0/0/1]ip add 1.1.3.2 255.255.255.0[AR1-GigabitEthernet0/0/1]int g0/0/2[AR1-GigabitEthernet0/0/2]ip add 1.1.5.2 255.255.255.0防火墙1配置命令[FW_A]int g 1/0/1[FW_A-GigabitEthernet1/0/1]ip add 1.1.3.1 255.255.255.0[FW_A-GigabitEthernet1/0/1]int g1/0/3[FW_A-GigabitEthernet1/0/3]ip add 10.1.1.1 255.255.255.0[FW_A-GigabitEthernet1/0/3]q[FW_A]firewall zone trust[FW_A-zone-trust]add int g1/0/3[FW_A-zone-trust]fir[FW_A-zone-trust]firewall zone untrust[FW_A-zone-untrust]add int g1/0/1[FW_A-zone-untrust]q[FW_A]ip rout[FW_A]ip route-s[FW_A]ip route-static 1.1.5.0 255.255.255.0 1.1.3.2[FW_A]ip route-static 10.1.2.0 255.255.255.0 1.1.3.2[FW_A]security-policy[FW_A-policy-security]rule name policy1[FW_A-policy-security-rule-policy1]source-zone trust[FW_A-policy-security-rule-policy1]destination-zone untrust[FW_A-policy-security-rule-policy1]source-address 10.1.1.0 mask 255.255.255.0[FW_A-policy-security-rule-policy1]destination-address 10.1.2.0 mask 255.255.255.0[FW_A-policy-security-rule-policy1]action permit[FW_A-policy-security-rule-policy1]q[FW_A-policy-security]rule name policy2[FW_A-policy-security-rule-policy2]source-zone local[FW_A-policy-security-rule-policy2]destination-zone untrust[FW_A-policy-security-rule-policy2]source-address 1.1.3.1 mask 255.255.255.255[FW_A-policy-security-rule-policy2]destination-address 1.1.5.1 mask 255.255.255.255[FW_A-policy-security-rule-policy2]action permit[FW_A-policy-security-rule-policy2]q[FW_A-policy-security]rul[FW_A-policy-security]rule name policy3[FW_A-policy-security-rule-policy3]source-zone untrust[FW_A-policy-security-rule-policy3]destination-zone trust[FW_A-policy-security-rule-policy3]source-address 10.1.2.0 mask 255.255.255.0[FW_A-policy-security-rule-policy3]destination-address 10.1.1.0 mask 255.255.255.0[FW_A-policy-security-rule-policy3]action permit[FW_A-policy-security-rule-policy3]q[FW_A-policy-security]rule name policy4[FW_A-policy-security-rule-policy4]source-zone untrust[FW_A-policy-security-rule-policy4]destination-zone local[FW_A-policy-security-rule-policy4]source-address 1.1.5.1 mask 255.255.255.255[FW_A-policy-security-rule-policy4]destination-address 1.1.3.1 mask 255.255.255.255[FW_A-policy-security-rule-policy4]action permit[FW_A-policy-security-rule-policy4]q[FW_A-policy-security]q[FW_A]acl 3000[FW_A-acl-adv-3000]rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255[FW_A-acl-adv-3000]q[FW_A]ipsec proposal tran1这个是数字1️⃣不要敲成字母了[FW_A-ipsec-proposal-tran1]q[FW_A]ike proposal 10[FW_A-ike-proposal-10]q[FW_A]ike peer b[FW_A-ike-peer-b]ike-proposal 10[FW_A-ike-peer-b]remote-add[FW_A-ike-peer-b]remote-address 1.1.5.1[FW_A-ike-peer-b]pre-shared-key Test!1234 ⚠️!后面没有空格前后要保持一致[FW_A-ike-peer-b]q[FW_A]ipsec policy map1 10 isakmp这个是数字1️⃣不要敲成字母了Info: The ISAKMP policy sequence number should be smaller than the template policy sequence number in the policy group. Otherwise, the ISAKMP policy does not take effect.[FW_A-ipsec-policy-isakmp-map1-10]security acl 3000[FW_A-ipsec-policy-isakmp-map1-10]proposal tran1这个是数字1️⃣不要敲成字母了[FW_A-ipsec-policy-isakmp-map1-10]ike-peer b[FW_A-ipsec-policy-isakmp-map1-10]q[FW_A]int g1/0/1[FW_A-GigabitEthernet1/0/1]ipsec policy map1这个map1是数字1️⃣不要敲成字母了[FW_A-GigabitEthernet1/0/1]q防火墙2配置命令[FW_B]int g 1/0/1[FW_B-GigabitEthernet1/0/1]ip add 1.1.5.1 255.255.255.0[FW_B-GigabitEthernet1/0/1]int g1/0/3[FW_B-GigabitEthernet1/0/3]ip add 10.1.2.1 255.255.255.0[FW_B-GigabitEthernet1/0/3]q[FW_B]firewall zone trust[FW_B-zone-trust]add int g1/0/3[FW_B-zone-trust]firewall zone untrust[FW_B-zone-untrust]add int g1/0/1[FW_B-zone-untrust]q[FW_B]ip route-static 1.1.3.0 255.255.255.0 1.1.5.2[FW_B]ip route-static 10.1.1.0 255.255.255.0 1.1.5.2[FW_B]security-policy[FW_B-policy-security]rule name policy[FW_B-policy-security-rule-policy]source-zone trust[FW_B-policy-security-rule-policy]destination-zone untrust[FW_B-policy-security-rule-policy]source-address 10.1.2.0 mask 255.255.255.0[FW_B-policy-security-rule-policy]destination-address 10.1.1.0 mask 255.255.255.0[FW_B-policy-security-rule-policy]action permit[FW_B-policy-security-rule-policy]q[FW_B-policy-security]rule name policy2[FW_B-policy-security-rule-policy2]source-zone local[FW_B-policy-security-rule-policy2]destination-zone untrust[FW_B-policy-security-rule-policy2]source-address 1.1.5.1 mask 255.255.255.255[FW_B-policy-security-rule-policy2]destination-address 1.1.3.1 mask 255.255.255.255[FW_B-policy-security-rule-policy2]action permit[FW_B-policy-security-rule-policy2]q[FW_B-policy-security]rule name policy3[FW_B-policy-security-rule-policy3]source-zone untrust[FW_B-policy-security-rule-policy3]destination-zone trust[FW_B-policy-security-rule-policy3]source-address 10.1.1.0 mask 255.255.255.0[FW_B-policy-security-rule-policy3]destination-address 10.1.2.0 mask 255.255.255.0[FW_B-policy-security-rule-policy3]action permit[FW_B-policy-security-rule-policy3]q[FW_B-policy-security]rule name policy4[FW_B-policy-security-rule-policy4]source-zone untrust[FW_B-policy-security-rule-policy4]destination-zone local[FW_B-policy-security-rule-policy4]source-address 1.1.3.1 mask 255.255.255.255[FW_B-policy-security-rule-policy4]destination-address 1.1.5.1 mask 255.255.255.255[FW_B-policy-security-rule-policy4]action permit[FW_B-policy-security-rule-policy4]q[FW_B-policy-security]q[FW_B]acl 3000[FW_B-acl-adv-3000]rule permit ip source 10.1.2.0 0.0.0.255 des[FW_B-acl-adv-3000]rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255[FW_B-acl-adv-3000]q[FW_B]ipsec proposal tran1这个是数字1️⃣不要敲成字母了[FW_B-ipsec-proposal-tran1]q[FW_B]ike pro[FW_B]ike proposal 10[FW_B-ike-proposal-10]q[FW_B-ike-peer-a]ike-proposal 10[FW_B-ike-peer-a]remote-address 1.1.3.1[FW_B-ike-peer-a]pre-shared-key Test!1234⚠️ 前后保持一致[FW_B-ike-peer-a]q[FW_B]ipsec policy map1 10 isakmp这个map1是数字1️⃣不要敲成字母了Info: The ISAKMP policy sequence number should be smaller than the template policy sequence number in the policy group. Otherwise, the ISAKMP policy does not take effect.[FW_B-ipsec-policy-isakmp-map1-10]security acl 3000[FW_B-ipsec-policy-isakmp-map1-10]proposal tran1这个map1是数字1️⃣不要敲成字母了[FW_B-ipsec-policy-isakmp-map1-10]ike-peer a[FW_B-ipsec-policy-isakmp-map1-10]q[FW_B]int g1/0/1[FW_B-GigabitEthernet1/0/1]ipsec policy map1[FW_B-GigabitEthernet1/0/1]q验证隧道建立成功