1、acl number 3001 创建序号3001的高级访问控制列表rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255总部到分支1的网网段VPN触发策略rule 10 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255总部到分支2的网网段VPN触发策略3、配置IKE安全提议ike proposal 10 创建名称为10的IKE安全提议authentication-algorithm md5 选择加密的
2、算法为md54、配置IKE PEERike peer a 创建名称为a的IKE PEER exchange-mode aggressive 模式选择野蛮模式 pre-shared-key 123456 IKE协商的密钥为123456 ike-proposal 10 绑定IKE安全提议 undo version 2 选择V1的版本 local-id-type name 使用野蛮模式的IKE local-name验证 nat traversal 打开NAT穿越5、创建IPSEC安全提议ipsec proposal tran1 创建名称为tran1的IPSEC安全提议 esp authenticat
3、ion-algorithm sha1 选择安全算法为哈希算法sha16、配置IPSEC安全策略模板ipsec policy-template map 1 创建名称为map的策略模板 security acl 3001 绑定触发ACL ike-peer a 选择前面创建的 ike-peer a proposal tran1 选择前面创建的IPSEC安全提议tran17、创建IPSEC安全策略ipsec policy map1 1 isakmp template map 创建名称为map1的IPSEC安全策略绑定map策略模板8、在外网接口上应用IPSEC安全策略interface Etherne
4、t0/0/0 ip address 119.97.240.106 255.255.255.248 ipsec policy map1 应用map1的IPSEC VPN策略9、配置目的地址为192.168.X.X/16网段不做NAT转换；这步不配的话网数据直接做NAT转换了，不会通过VPN隧道，那么前面的配置就白做了。nat-policy interzone trust untrust outbound 进入NAT配置视图 policy 1 策略1这是优先级，数字越小越优先 action no-nat 不做NAT转换 policy destination 192.168.0.0 0.0.255.
5、255 目的地址为192.168.0.0/16不做NAT转换 policy 2 策略2 action source-nat 基于源地址的转换 policy source 172.16.1.0 0.0.0.255 源地址为172.16.1.0/24做NAT转换 easy-ip Ethernet0/0/0 转换的外网地址为Ethernet0/0/0的接口地址# 一定要注意策略的优先级，反了就没有作用了。二分之机构配置 分之机构1的配置详解ike local-name fenzhi1 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination
6、172.16.1.0 0.0.0.255分之1到总部网网段的VPN触发策略remote-address 119.97.240.106 总部的外网地址6、配置IPSEC安全策略ipsec policy map1 10 isakmp 创建名称为map1的策略7、在外网接口上应用IPSEC安全策略 ip address 59.175.185.126 255.255.255.08、NAT策略配置。 policy destination 172.16.0.0 0.0.255.255 目的地址为172.16.0.0/16不做NAT转换 policy source 192.168.1.0 0.0.0.255
7、 源地址为192.168.1.0/24做NAT转换分之2的配置参照分之1， ACL源地址改本钱地网网段，IKE本地名称重新命名；其它主要VPN主要配置都一样三配置总结总部和分之的配置区别在于，总部采用IPSEC安全策略模板绑定到外网接口，分之机构使用安全策略。完成所有配置后使用可以display ike sa、display ipsec sa 查看ike安全联盟状态和ipsec安全联盟状态；有这些信息就代表ipsec vpn连接成功。 三、详细配置文档现网成功稳定运行配置文档1、总部的配置文档 firewall packet-filter default permit interzone lo
8、cal trust direction inbound firewall packet-filter default permit interzone local trust direction outbound firewall packet-filter default permit interzone local untrust direction inbound firewall packet-filter default permit interzone local untrust direction outbound firewall packet-filter default p
9、ermit interzone local dmz direction inbound firewall packet-filter default permit interzone local dmz direction outbound firewall packet-filter default permit interzone trust untrust direction inbound firewall packet-filter default permit interzone trust untrust direction outbound firewall packet-fi
10、lter default permit interzone trust dmz direction inbound firewall packet-filter default permit interzone trust dmz direction outbound firewall packet-filter default permit interzone dmz untrust direction inbound firewall packet-filter default permit interzone dmz untrust direction outboundacl numbe
11、r 3001 rule 5 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 rule 10 permit ip source 172.16.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 #ike proposal 10 authentication-algorithm md5ike peer a exchange-mode aggressive pre-shared-key 123456 ike-proposal 10 undo version 2
12、local-id-type namenat traversalipsec proposal tran1 esp authentication-algorithm sha1ipsec policy-template map 1 security acl 3001 ike-peer a proposal tran1ipsec policy map1 1 isakmp template map# interface Vlanif1 ip address 172.16.1.1 255.255.255.0interface Cellular5/0/0 link-protocol ppp ipsec po
13、licy map1interface Ethernet1/0/0 portswitch port link-type accessinterface Ethernet1/0/1interface Ethernet1/0/2interface Ethernet1/0/3 interface Ethernet1/0/4interface Ethernet1/0/5interface Ethernet1/0/6interface Ethernet1/0/7interface NULL0 firewall zone local set priority 100firewall zone trust s
14、et priority 85 add interface Ethernet1/0/0 add interface Ethernet1/0/1 add interface Ethernet1/0/2 add interface Ethernet1/0/3 add interface Ethernet1/0/4 add interface Ethernet1/0/5 add interface Ethernet1/0/6 add interface Ethernet1/0/7 add interface Vlanif1firewall zone untrust set priority 5 add
15、 interface Ethernet0/0/0ip route-static 0.0.0.0 0.0.0.0 119.97.240.105nat-policy interzone trust untrust outbound policy 1 action no-nat policy destination 182.168.0.0 0.0.255.255 policy 2 action source-nat policy source 172.16.1.0 0.0.0.255 easy-ip Ethernet0/0/02、分之1的配置 ike local-name fenzhi-1l2fwd
16、fast enable rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 172.16.1.0 0.0.0.255 remote-address 119.97.240.106 nat traversalipsec policy map1 10 isakmp proposal tran1 ip address 192.168.1.1 255.255.255.0 port link-type access interface Ethernet1/0/3 portswitch interface Ethernet2/0/0interface NULL0 detect ftpfirewall zone untrust add interface Ethernet2/0/0 ip route-static 0.0.0.0 0.0.0.0 59.175.185.1 policy destination 172.16.0.0 0.0.255.255 policy source 192.168.1.0 0.0.0.2553、分之2的配置文档 ike local-name fenzhi-2
