组网需求

网络A和网络B分别通过FW_A和FW_B连接到Internet。网络环境描述如下:

  • 网络A属于10.1.1.0/24子网,通过接口GigabitEthernet 1/0/3与FW_A连接。
  • 网络B属于10.1.2.0/24子网,通过接口GigabitEthernet 1/0/3与FW_B连接。
  • FW_A_B路由可达。

通过组网实现如下需求:在FW_A和FW_B之间建立IKE方式的IPSec隧道,使网络A和网络B的用户可通过IPSec隧道互相访问。

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_华为防火墙


配置思路

对于FW_A和FW_B,配置思路相同。如下:

  1. 完成接口基本配置。
  2. 配置安全策略,允许私网指定网段进行报文交互。
  3. 配置到对端内网的路由。
  4. 配置IPSec策略。包括配置IPSec策略的基本信息、配置待加密的数据流、配置安全提议的协商参数。


eNSP拓扑

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_华为防火墙_02


操作步骤

配置FW_A的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_A]interface GigabitEthernet 1/0/3
[FW_A-GigabitEthernet1/0/3]ip add
[FW_A-GigabitEthernet1/0/3]ip address 10.1.1.1 24
[FW_A-GigabitEthernet1/0/3]quit.
[FW_A]interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1]ip address 1.1.3.1 24
[FW_A-GigabitEthernet1/0/1]quit
[FW_A]firewall zone trust
[FW_A-zone-trust]add interface GigabitEthernet 1/0/3
[FW_A-zone-trust]quit
[FW_A]firewall zone untrust
[FW_A-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_A-zone-untrust]quit
[FW_A]security-policy 
[FW_A-policy-security]rule name policy1
[FW_A-policy-security-rule-policy1]source-zone trust
[FW_A-policy-security-rule-policy1]destination-zone untrust
[FW_A-policy-security-rule-policy1]source-address 10.1.1.0 24
[FW_A-policy-security-rule-policy1]destination-address 10.1.2.0 24
[FW_A-policy-security-rule-policy1]action permit
[FW_A-policy-security-rule-policy1]quit
[FW_A-policy-security]rule name policy2
[FW_A-policy-security-rule-policy2]source-zone untrust
[FW_A-policy-security-rule-policy2]destination-zone trust
[FW_A-policy-security-rule-policy2]source-address 10.1.2.0 24
[FW_A-policy-security-rule-policy2]destination-address 10.1.1.0 24
[FW_A-policy-security-rule-policy2]action permit
[FW_A-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_A-policy-security] rule name policy3
[FW_A-policy-security-rule-policy3] source-zone local
[FW_A-policy-security-rule-policy3] destination-zone untrust
[FW_A-policy-security-rule-policy3] source-address 1.1.3.1 32
[FW_A-policy-security-rule-policy3] destination-address 1.1.5.1 32
[FW_A-policy-security-rule-policy3] action permit
[FW_A-policy-security-rule-policy3] quit
[FW_A-policy-security] rule name policy4
[FW_A-policy-security-rule-policy4] source-zone untrust
[FW_A-policy-security-rule-policy4] destination-zone local
[FW_A-policy-security-rule-policy4] source-address 1.1.5.1 32
[FW_A-policy-security-rule-policy4] destination-address 1.1.3.1 32
[FW_A-policy-security-rule-policy4] action permit
[FW_A-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由,此处假设到达网络B的下一跳地址为1.1.3.254

[FW_A]ip route-static 10.1.2.0 255.255.255.0 1.1.3.254
[FW_A]ip route-static 1.1.5.0 255.255.255.0 1.1.3.254

在FW_A上配置IPSec策略,并在接口上应用此IPSec策略

[FW_A]acl 3000
[FW_A-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2
.0 0.0.0.255
[FW_A-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_A] ipsec proposal tran1
[FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_A-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_A] ike proposal 10
[FW_A-ike-proposal-10] authentication-method pre-share
[FW_A-ike-proposal-10] prf hmac-sha2-256
[FW_A-ike-proposal-10] encryption-algorithm aes-256
[FW_A-ike-proposal-10] dh group14
[FW_A-ike-proposal-10] integrity-algorithm hmac-sha2-256
[FW_A-ike-proposal-10] quit

配置IKE peer。

[FW_A] ike peer b
[FW_A-ike-peer-b] ike-proposal 10
[FW_A-ike-peer-b] remote-address 1.1.5.1
[FW_A-ike-peer-b] pre-shared-key Test!1234
[FW_A-ike-peer-b] quit

配置IPSec策略

[FW_A] ipsec policy map1 10 isakmp
[FW_A-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_A-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_A-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_A-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit


配置FW_B的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_B]interface GigabitEthernet 1/0/3
[FW_B-GigabitEthernet1/0/3]ip add
[FW_B-GigabitEthernet1/0/3]ip address 10.1.2.1 24
[FW_B-GigabitEthernet1/0/3]quit.
[FW_B]interface GigabitEthernet 1/0/1
[FW_B-GigabitEthernet1/0/1]ip address 1.1.5.1 24
[FW_B-GigabitEthernet1/0/1]quit
[FW_B]firewall zone trust
[FW_B-zone-trust]add interface GigabitEthernet 1/0/3
[FW_B-zone-trust]quit
[FW_B]firewall zone untrust
[FW_B-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_B-zone-untrust]quit[FW_B]security-policy
[FW_B-policy-security]rule name policy1
[FW_B-policy-security-rule-policy1]source-zone trust
[FW_B-policy-security-rule-policy1]destination-zone untrust
[FW_B-policy-security-rule-policy1]source-address 10.1.2.0 24
[FW_B-policy-security-rule-policy1]destination-address 10.1.1.0 24
[FW_B-policy-security-rule-policy1]action permit
[FW_B-policy-security-rule-policy1]quit
[FW_B-policy-security]rule name policy2
[FW_B-policy-security-rule-policy2]source-zone untrust
[FW_B-policy-security-rule-policy2]destination-zone trust
[FW_B-policy-security-rule-policy2]source-address 10.1.1.0 24
[FW_B-policy-security-rule-policy2]destination-address 10.1.2.0 24
[FW_B-policy-security-rule-policy2]action permit
[FW_B-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_B-policy-security] rule name policy3
[FW_B-policy-security-rule-policy3] source-zone local
[FW_B-policy-security-rule-policy3] destination-zone untrust
[FW_B-policy-security-rule-policy3] source-address 1.1.5.1 32
[FW_B-policy-security-rule-policy3] destination-address 1.1.3.1 32
[FW_B-policy-security-rule-policy3] action permit
[FW_B-policy-security-rule-policy3] quit
[FW_B-policy-security] rule name policy4
[FW_B-policy-security-rule-policy4] source-zone untrust
[FW_B-policy-security-rule-policy4] destination-zone local
[FW_B-policy-security-rule-policy4] source-address 1.1.3.1 32
[FW_B-policy-security-rule-policy4] destination-address 1.1.5.1 32
[FW_B-policy-security-rule-policy4] action permit
[FW_B-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由,此处假设到达网络B的下一跳地址为1.1.3.254

[FW_B]ip route-static 10.1.1.0 255.255.255.0 1.1.5.254
[FW_B]ip route-static 1.1.3.0 255.255.255.0 1.1.5.254

在FW_B上配置IPSec策略,并在接口上应用此IPSec策略

[FW_B]acl 3000
[FW_B-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[FW_B-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_B] ipsec proposal tran1
[FW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_B-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_B-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_B] ike proposal 10
[FW_B-ike-proposal-10] authentication-method pre-share
[FW_B-ike-proposal-10] prf hmac-sha2-256
[FW_B-ike-proposal-10] encryption-algorithm aes-256
[FW_B-ike-proposal-10] dh group14
[FW_B-ike-proposal-10] integrity-algorithm hmac-sha2-256
[FW_B-ike-proposal-10] quit

配置IKE peer。

[FW_B] ike peer a 
[FW_B-ike-peer-a] ike-proposal 10
[FW_B-ike-peer-a] remote-address 1.1.3.1
[FW_B-ike-peer-a] pre-shared-key Test!1234
[FW_B-ike-peer-a] quit

配置IPSec策略

[FW_B] ipsec policy map1 10 isakmp
[FW_B-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_B-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_B-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_B-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit


网关路由配置静态

[Huawei]ip route-static 10.1.1.0 255.255.255.0 1.1.3.1
[Huawei]ip route-static 10.1.2.0 255.255.255.0 1.1.5.1

结果验证

  1. 配置完成后,在PC1执行ping命令,触发IKE协商。
    若IKE协商成功,隧道建立后可以ping通PC2。反之,IKE协商失败,隧道没有建立则PC1不能ping通PC2。

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_配置命令_03

  1. 分别在FW_A和FW_B上执行display ike sadisplay ipsec sa会显示安全联盟的建立情况。以FW_B为例,出现以下显示说明IKE安全联盟、IPSec安全联盟建立成功。

FW_A

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_配置命令_04

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_华为防火墙_05

FW_B

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_eNSP_06

华为防火墙网关间通过IKE方式协商IPSec VPN隧道(共享密钥认证)_eNSP_07