华为USG防火墙IPsec怎么配置.docx

华为USG防火墙IPsec怎么配置华为USG防火墙IPsec配置的案例实验拓扑使用华为ensp1.2.00.370模拟器来完成。连接方式是client1-USG-1-AR1-USG-2-clent2链式组网结构。实验需求USG-1和USG-2模拟企业边缘设备，分别在2台设备上配置NAT和IPsec实现2边私网可以通过互相通信。实验配置R1的IP地址配置省略USG-1配置[USG-1]firewallzonetrust//配置trust区域[USG-1-zone-trust]addinterfaceg0/0/0//将接口加入trust区域[USG-1-zone-trust]quit[USG-1]firewallzoneuntrust//配置untrust区域[USG-1-zone-untrust]addintg0/0/1//将接口加入untrust区域[USG-1-zone-untrust]quit[USG-1]intg0/0/0[USG-1-GigabitEthernet0/0/0]ipadd192.168.10.124[USG-1-GigabitEthernet0/0/0]intg0/0/1[USG-1-GigabitEthernet0/0/1]ipadd11.0.0.224[USG-1-GigabitEthernet0/0/1]quit[USG-1]iproute-static0.0.0.00.0.0.011.0.0.1//配置默认路由上公网[USG-1]nat-policyinterzonetrustuntrustoutbound//进入trust到untrust区域out方向的策略视图[USG-1-nat-policy-interzone-trust-untrust-outbound]policy1//创建一个策略[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policysource192.168.10.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policydestination192.168.20.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outbound-1]actionno-nat//以上三条命令意思是不允许将源为192.168.10.0/24网段目标为192.168.20.0/24网段的数据包进行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-1]quit[USG-1-nat-policy-interzone-trust-untrust-outbound]policy2//创建策略2[USG-1-nat-policy-interzone-trust-untrust-outbound-2]actionsource-nat//允许对源IP进行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-2]easy-ipg0/0/1//对接口G0/0/1地址复用[USG-1-nat-policy-interzone-trust-untrust-outbound-2]quit[USG-1-nat-policy-interzone-trust-untrust-outbound]quit-------阶段一---------[USG-1]ikeproposal1//配置一个安全提议[USG-1-ike-proposal-1]authentication-methodpre-share//配置IKE认证方式为预共享密钥[USG-1-ike-proposal-1]authentication-algorithmsha1//配置IKE认证算法为sha1[USG-1-ike-proposal-1]integrity-algorithmaes-xcbc-96//配置IKE完整性算法[USG-1-ike-proposal-1]dhgroup2//配置IKE密钥协商DH组[USG-1-ike-proposal-1]quit[USG-1]ikepeerUSG-2//创建一个IKE对等体名字为USG-2[USG-1-ike-peer-usg-2]pre-shared-keyabc123//配置预共享密钥[USG-1-ike-peer-usg-2]remote-address12.0.0.2//配置对等体IP地址[USG-1-ike-peer-usg-2]ike-proposal1//调用ike安全提议[USG-1-ike-peer-