点击上方网络技术干货圈，选择设为星标
优质文章，及时送达
今天给大家带来的是华三的IPSecNAT穿越实验。
下面大家直接打开HCL开搞吧！
组网及说明
配置步骤
1.VPNA配置
2.VPNB配置
3、测试
配置关键点
组网及说明在内网的VPNA与在公网的VPNB建立IPSec隧道
配置步骤1.VPNA配置interfaceLoopBack0#配置内网接口ipaddress..2....0#
interfaceGigabitEthernet0/0#配置物理接口ipaddress..1.2...0ipsecapplypolicyipsec#绑定IPSec策略#
iproute-static0.0.0.00..1.1#配置静态路由#
acladvanced#配置IPSec感兴趣流rule10permitipsource..2.00.0.0.destination..3.00.0.0.#
ipsectransform-setipsec#配置IPSec转换集espencryption-algorithmaes-cbc-espauthentication-algorithmsha1#
ipsecpolicyipsec10isakmp#配置IPSec策略transform-setipsecsecurityaclremote-address...2#非模板模式必须指定对端地址ike-profileike#
ikeidentityfqdnvpna#配置IKEname#
ikeprofileike#配置IKE对等体keychainikeexchange-modeaggressivematchremoteidentityaddress...2...#
ikekeychainike#配置IKE预共享密钥pre-shared-keyaddress...2...keysimpleipsec2.VPNB配置
interfaceLoopBack0#配置内网接口ipaddress..3....0#
interfaceGigabitEthernet0/0#配置外网接口ipaddress...2...ipsecapplypolicyipsec#绑定IPSec策略#
iproute-static0.0.0.00...1#配置静态路由#
ipsectransform-setipsec#配置IPSec转换集espencryption-algorithmaes-cbc-espauthentication-algorithmsha1#
ipsecpolicy-templateipsec10#配置IPSec策略模板transform-setipsecike-profileike#
ipsecpolicyipsec10isakmptemplateipsec#将IPSec策略模板应用到策略中#
ikeprofileike#配置IKE对等体keychainikeexchange-modeaggressivematchremoteidentityfqdnvpna#匹配对端name#
ikekeychainike#配置IKE预共享密钥pre-shared-keyhostnamevpnakeysimpleipsec3、测试配置关键点
注意模板方式配置的IPSec不能主动触发IPSecSA协商，必须在另一端非模板方式配置的IPSec触发协商。
预览时标签不可点收录于话题#个上一篇下一篇