{"id":1205,"date":"2024-10-30T15:44:55","date_gmt":"2024-10-30T07:44:55","guid":{"rendered":"https:\/\/www.jchj.top\/?p=1205"},"modified":"2025-09-26T11:23:35","modified_gmt":"2025-09-26T03:23:35","slug":"%e5%8d%8e%e4%b8%ba%e8%b7%af%e7%94%b1%e5%99%a8%e9%85%8d%e7%bd%aeipsecvpn%e9%9c%80%e8%a6%81%e6%b3%a8%e6%84%8f%e7%9a%84%e9%97%ae%e9%a2%98","status":"publish","type":"post","link":"https:\/\/www.jchj.top\/?p=1205","title":{"rendered":"\u534e\u4e3a\u8def\u7531\u5668\u914d\u7f6eipsecVPN\u9700\u8981\u6ce8\u610f\u7684\u95ee\u9898"},"content":{"rendered":"\n

\u534e\u4e3a\u8def\u7531\u5668ipsecVPN\u914d\u7f6e\u65b9\u6cd5<\/p>\n\n\n\n

\u524d\u8a00\uff1b\u4f01\u4e1a\u5e0c\u671b\u5bf9\u5206\u652f\u5b50\u7f51\u4e0e\u603b\u90e8\u5b50\u7f51\u4e4b\u95f4\u76f8\u4e92\u8bbf\u95ee\u7684\u5b89\u5168\u7684\u8fde\u63a5\u3002\u5206\u652f\u4e0e\u603b\u90e8\u901a\u8fc7\u516c\u7f51\u5efa\u7acb\u901a\u4fe1\uff0c\u53ef\u4ee5\u5728\u5206\u652f\u7f51\u5173\u4e0e\u603b\u90e8\u7f51\u5173\u4e4b\u95f4\u5efa\u7acb\u4e00\u4e2aIPSec\u96a7\u9053\u6765\u5b9e\u65bd\u5b89\u5168\u4fdd\u62a4\u3002\u7531\u4e8e\u7ef4\u62a4\u7f51\u5173\u8f83\u5c11\uff0c\u53ef\u4ee5\u8003\u8651\u91c7\u7528\u624b\u5de5\u65b9\u5f0f\u5efa\u7acbIPSec\u96a7\u9053\u6216\u662fIKE\u81ea\u52a8\u534f\u5546\u6a21\u5f0f<\/p>\n\n\n\n

    \n
  1. \u624b\u52a8\u6a21\u5f0f<\/li>\n<\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    RouterA\u7684\u914d\u7f6e<\/strong><\/strong><\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    sysname RouterA  <\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    acl number 3101  \/\/\u914d\u7f6eACL 3101\uff0c\u5339\u914d\u4ece\u5206\u652f\u5b50\u7f51\u5230\u603b\u90e8\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

     rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec proposal tran1  \/\/\u914d\u7f6eIPSec\u5b89\u5168\u63d0\u8bae<\/p>\n\n\n\n

     esp authentication-algorithm sha2-256<\/p>\n\n\n\n

     esp encryption-algorithm aes-128<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec policy map1 10 manual  \/\/\u914d\u7f6e\u624b\u52a8\u65b9\u5f0f\u5b89\u5168\u7b56\u7565<\/p>\n\n\n\n

     security acl 3101<\/p>\n\n\n\n

     proposal tran1<\/p>\n\n\n\n

     tunnel local 1.1.1.1<\/p>\n\n\n\n

     tunnel remote 2.1.1.1<\/p>\n\n\n\n

     sa spi inbound esp 54321<\/p>\n\n\n\n

     sa string-key inbound esp cipher %^%#JvZxR2g8c;a9~FPN~n’$7`DEV&=G(=Et02P\/%\\*!%^%#  \/\/\u914d\u7f6e\u5165\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

     sa spi outbound esp 12345<\/p>\n\n\n\n

     sa string-key outbound esp cipher %^%#K{JG:rWVHPMnf;5\\|,GW(Luq’qi8BT4nOj%5W5=)%^%#  \/\/\u914d\u7f6e\u51fa\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet1\/0\/0<\/p>\n\n\n\n

     ip address 1.1.1.1 255.255.255.0<\/p>\n\n\n\n

     ipsec policy map1<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet2\/0\/0<\/p>\n\n\n\n

     ip address 10.1.1.1 255.255.255.0<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ip route-static 2.1.1.0 255.255.255.0 1.1.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u603b\u90e8\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    ip route-static 10.1.2.0 255.255.255.0 1.1.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u603b\u90e8\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    RouterB\u7684\u914d\u7f6e<\/strong><\/strong><\/p>\n\n\n\n

    #<\/p>\n\n\n\n

     sysname RouterB<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    acl number 3101  \/\/\u914d\u7f6eACL 3101\uff0c\u5339\u914d\u4ece\u603b\u90e8\u5b50\u7f51\u5230\u5206\u652f\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

     rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec proposal tran1  \/\/\u914d\u7f6eIPSec\u5b89\u5168\u63d0\u8bae<\/p>\n\n\n\n

     esp authentication-algorithm sha2-256<\/p>\n\n\n\n

     esp encryption-algorithm aes-128<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec policy use1 10 manual  \/\/\u914d\u7f6e\u624b\u52a8\u65b9\u5f0f\u5b89\u5168\u7b56\u7565<\/p>\n\n\n\n

     security acl 3101<\/p>\n\n\n\n

     proposal tran1<\/p>\n\n\n\n

     tunnel local 2.1.1.1<\/p>\n\n\n\n

     tunnel remote 1.1.1.1<\/p>\n\n\n\n

     sa spi inbound esp 12345<\/p>\n\n\n\n

     sa string-key inbound esp cipher %^%#IRFGEiFPJ1$&a’Qy,L*XQL_+*Grq-=yMb}ULZdS6%^%#  \/\/\u914d\u7f6e\u5165\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

     sa spi outbound esp 54321<\/p>\n\n\n\n

     sa string-key outbound esp cipher %^%#(3fr1!&6O=)!GN#~{)n,2fq>4#4+%;lMTs5(]:c)%^%#  \/\/\u914d\u7f6e\u51fa\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet1\/0\/0<\/p>\n\n\n\n

     ip address 2.1.1.1 255.255.255.0<\/p>\n\n\n\n

     ipsec policy use1<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet2\/0\/0<\/p>\n\n\n\n

     ip address 10.1.2.1 255.255.255.0<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ip route-static 1.1.1.0 255.255.255.0 2.1.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u5206\u652f\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    ip route-static 10.1.1.0 255.255.255.0 2.1.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u5206\u652f\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    return<\/p>\n\n\n\n

    ……\u6ce8\u610f\u4f7f\u7528\u9ad8\u7ea7ACL\u7cbe\u51c6\u914d\u7f6e\uff0c\u5982\u5148\u88abnat outbound\u7684\u6d41\u91cf\u662f\u4e0d\u4f1a\u88ab\u5339\u914d\u4e0a\u7684<\/strong><\/strong><\/p>\n\n\n\n

    \u5982\uff1a<\/strong><\/strong><\/p>\n\n\n\n

    acl number 3999  <\/p>\n\n\n\n

     rule 5 deny ip source 10.0.0.0 0.0.1.255 destination 10.2.12.0 0.0.1.255 \/\/\u5339\u914d\u76ee\u6807\u5185\u7f51\u5730\u5740\u5230\u5206\u652f\u5185\u7f51\u5730\u5740\u6d41\u91cf\u4e0d\u88abnat\u8f6c\u6362\uff0c\u5176\u4f59\u6d41\u91cf\u505anat\u8f6c\u6362\uff0c\u51fa\u53e3\u5730\u5740\u5e94\u7528\u6b64nat outbound 3999<\/p>\n\n\n\n

     rule 100 permit ip<\/p>\n\n\n\n

    3.\u9a8c\u8bc1\u914d\u7f6e\u7ed3\u679c<\/strong><\/strong><\/p>\n\n\n\n

    RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a<\/strong>\u6267\u884cdisplay ipsec sa\u547d\u4ee4\uff0c\u53ef\u4ee5\u67e5\u770bIPSec\u96a7\u9053\u4e0a\u914d\u7f6e\u7684\u4fe1\u606f\u3002<\/strong><\/strong><\/p>\n\n\n\n

    RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a<\/strong>\u67e5\u770b\u5339\u914d\u7684ACL\u662f\u5426\u6709\u6d41\u91cf\u4fe1\u606f<\/strong>display acl al<\/strong><\/strong><\/p>\n\n\n\n

    RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a\u67e5\u770b\u5339\u914d\u7684\u76ee\u6807\u7f51\u6bb5\u8def\u7531\u51fa\u53e3\u662f\u5426\u4e00\u81f4<\/strong>display ip routing-table <\/strong>x.x.x.x<\/strong><\/strong><\/p>\n\n\n\n

      \n
    • IKE\u52a8\u6001\u534f\u5546\u6a21\u5f0f<\/li>\n<\/ul>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      Headquarters\u7684\u914d\u7f6e<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

       sysname Headquarters  <\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      acl number 3000  \/\/\u914d\u7f6eACL 3000\uff0c\u5339\u914d\u4ece\u603b\u90e8\u5b50\u7f51\u5230\u5206\u652f\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

       rule 0 permit ip source 10.1.0.0 0.0.0.255 destination 10.2.0.0 0.0.0.255<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec proposal def  \/\/\u914d\u7f6eIPSec\u63d0\u8bae<\/p>\n\n\n\n

       esp authentication-algorithm sha2-256<\/p>\n\n\n\n

       esp encryption-algorithm aes-192<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike proposal 5   \/\/\u914d\u7f6eIKE\u63d0\u8bae<\/p>\n\n\n\n

       encryption-algorithm aes-cbc-128   \/\/V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\uff0caes-cbc-128\u53c2\u6570\u4fee\u6539\u4e3aaes-128<\/p>\n\n\n\n

       dh group14<\/p>\n\n\n\n

       authentication-algorithm sha2-256<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike peer Center v1  \/\/\u914d\u7f6eIKE\u5bf9\u7b49\u4f53\u53ca\u5176\u4f7f\u7528\u7684\u534f\u8bae\u65f6\uff0c\u4e0d\u540c\u7684\u8f6f\u4ef6\u7248\u672c\u95f4\u7684\u914d\u7f6e\u6709\u5dee\u5f02\uff1aV200R008\u4e4b\u524d\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name [ v1 | v2 ]\u3002V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name\u548cversion { 1 | 2 }\uff0c\u5982\u679c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u7248\u672c\u540c\u65f6\u542f\u7528\uff0c\u8bbe\u5907\u53d1\u8d77\u534f\u5546\u65f6\u4f1a\u4f7f\u7528IKEv2\u534f\u8bae\uff0c\u54cd\u5e94\u534f\u5546\u65f6\u5219\u540c\u65f6\u652f\u6301IKEv1\u534f\u8bae\u548cIKEv2\u534f\u8bae\u3002\u81eaV200R008\u7248\u672c\u5230V200R021\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u540c\u65f6\u542f\u7528\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u5219\u53ef\u4ee5\u6267\u884c\u547d\u4ee4undo version 2\uff1bV200R021\u53ca\u4e4b\u540e\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u542f\u7528\u5bf9\u7b49\u4f53IKEv2\u7248\u672c\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u9700\u8981\u5148\u6267\u884c\u547d\u4ee4version 1\uff0c\u518d\u6267\u884c\u547d\u4ee4undo version 2\u3002<\/p>\n\n\n\n

       pre-shared-key cipher %^%#JvZxR2g8c;a9~FPN~n’$7`DEV&=G(=Et02P\/%\\*!%^%#  \/\/\u914d\u7f6e\u9884\u5171\u4eab\u5bc6\u94a5\u8ba4\u8bc1\u5b57\u4e3a\u201chuawei\u201d\uff0c\u4ee5\u5bc6\u6587\u663e\u793a\uff0c\u8be5\u547d\u4ee4\u5728V2R3C00\u4ee5\u524d\u7684\u7248\u672c\u4e2d\u4e3a\u201cpre-shared-key huawei\u201d\uff0c\u4ee5\u660e\u6587\u663e\u793a<\/p>\n\n\n\n

       remote-address 1.2.2.1  \/\/\u914d\u7f6e\u5bf9\u7aefIP\u5730\u5740<\/p>\n\n\n\n

       dpd type on-demand  \/\/\u914d\u7f6eDPD\u68c0\u6d4b\u6a21\u5f0f\u4e3a\u6839\u636e\u9700\u8981\u8fdb\u884c\u68c0\u6d4b<\/p>\n\n\n\n

       ike-proposal 5<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec policy center 1 isakmp  \/\/\u914d\u7f6eIPSec\u7b56\u7565<\/p>\n\n\n\n

       security acl 3000<\/p>\n\n\n\n

       ike-peer Center<\/p>\n\n\n\n

       proposal def<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet1\/0\/0<\/p>\n\n\n\n

       ip address 1.2.1.1 255.255.255.0<\/p>\n\n\n\n

       ipsec policy center<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet2\/0\/0<\/p>\n\n\n\n

       ip address 10.1.0.1 255.255.255.0<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ip route-static 1.2.2.0 255.255.255.0 1.2.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fBranch\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      ip route-static 10.2.0.0 255.255.255.0 1.2.1.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fBranch\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      return<\/p>\n\n\n\n

      Branch\u7684\u914d\u7f6e<\/strong><\/strong><\/p>\n\n\n\n

      #<\/p>\n\n\n\n

       sysname Branch  <\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      acl number 3000  \/\/\u914d\u7f6eACL 3000\uff0c\u5339\u914d\u4ece\u5206\u652f\u5b50\u7f51\u5230\u603b\u90e8\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

       rule 0 permit ip source 10.2.0.0 0.0.0.255 destination 10.1.0.0 0.0.0.255<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec proposal def  \/\/\u914d\u7f6eIPSec\u63d0\u8bae<\/p>\n\n\n\n

       esp authentication-algorithm sha2-256<\/p>\n\n\n\n

       esp encryption-algorithm aes-192<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike proposal 5   \/\/\u914d\u7f6eIKE\u63d0\u8bae<\/p>\n\n\n\n

       encryption-algorithm aes-cbc-128   \/\/V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\uff0caes-cbc-128\u53c2\u6570\u4fee\u6539\u4e3aaes-128<\/p>\n\n\n\n

       dh group14<\/p>\n\n\n\n

       authentication-algorithm sha2-256<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike peer Branch v1  \/\/\u914d\u7f6eIKE\u5bf9\u7b49\u4f53\u53ca\u5176\u4f7f\u7528\u7684\u534f\u8bae\u65f6\uff0c\u4e0d\u540c\u7684\u8f6f\u4ef6\u7248\u672c\u95f4\u7684\u914d\u7f6e\u6709\u5dee\u5f02\uff1aV200R008\u4e4b\u524d\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name [ v1 | v2 ]\u3002V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name\u548cversion { 1 | 2 }\uff0c\u5982\u679c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u7248\u672c\u540c\u65f6\u542f\u7528\uff0c\u8bbe\u5907\u53d1\u8d77\u534f\u5546\u65f6\u4f1a\u4f7f\u7528IKEv2\u534f\u8bae\uff0c\u54cd\u5e94\u534f\u5546\u65f6\u5219\u540c\u65f6\u652f\u6301IKEv1\u534f\u8bae\u548cIKEv2\u534f\u8bae\u3002\u81eaV200R008\u7248\u672c\u5230V200R021\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u540c\u65f6\u542f\u7528\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u5219\u53ef\u4ee5\u6267\u884c\u547d\u4ee4undo version 2\uff1bV200R021\u53ca\u4e4b\u540e\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u542f\u7528\u5bf9\u7b49\u4f53IKEv2\u7248\u672c\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u9700\u8981\u5148\u6267\u884c\u547d\u4ee4version 1\uff0c\u518d\u6267\u884c\u547d\u4ee4undo version 2\u3002<\/p>\n\n\n\n

       pre-shared-key cipher %^%#K{JG:rWVHPMnf;5\\|,GW(Luq’qi8BT4nOj%5W5=)%^%#   \/\/\u914d\u7f6e\u9884\u5171\u4eab\u5bc6\u94a5\u8ba4\u8bc1\u5b57\u4e3a\u201chuawei\u201d\uff0c\u4ee5\u5bc6\u6587\u663e\u793a\uff0c\u8be5\u547d\u4ee4\u5728V2R3C00\u4ee5\u524d\u7684\u7248\u672c\u4e2d\u4e3a\u201cpre-shared-key huawei\u201d\uff0c\u4ee5\u660e\u6587\u663e\u793a<\/p>\n\n\n\n

       remote-address 1.2.1.1  \/\/\u914d\u7f6e\u5bf9\u7aefIP\u5730\u5740<\/p>\n\n\n\n

       dpd type on-demand  \/\/\u914d\u7f6eDPD\u68c0\u6d4b\u6a21\u5f0f\u4e3a\u6839\u636e\u9700\u8981\u8fdb\u884c\u68c0\u6d4b<\/p>\n\n\n\n

       ike-proposal 5<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec policy branch 1 isakmp  \/\/\u914d\u7f6eIPSec\u7b56\u7565<\/p>\n\n\n\n

       security acl 3000<\/p>\n\n\n\n

       ike-peer Branch<\/p>\n\n\n\n

       proposal def<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet1\/0\/0<\/p>\n\n\n\n

       ip address 1.2.2.1 255.255.255.0<\/p>\n\n\n\n

       ipsec policy branch<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet2\/0\/0<\/p>\n\n\n\n

       ip address 10.2.0.1 255.255.255.0<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ip route-static 1.2.1.0 255.255.255.0 1.2.2.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fHeadquarters\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      ip route-static 10.1.0.0 255.255.255.0 1.2.2.2  \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fHeadquarters\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      return<\/p>\n\n\n\n

      ……\u6ce8\u610f\u4f7f\u7528\u9ad8\u7ea7ACL\u7cbe\u51c6\u914d\u7f6e\uff0c\u5982\u5148\u88abnat outbound\u7684\u6d41\u91cf\u662f\u4e0d\u4f1a\u88ab\u5339\u914d\u4e0a\u7684<\/strong><\/strong><\/p>\n\n\n\n

      \u5982\uff1a<\/strong><\/strong><\/p>\n\n\n\n

      acl number 3999  <\/p>\n\n\n\n

       rule 5 deny ip source 10.0.0.0 0.0.1.255 destination 10.2.12.0 0.0.1.255 \/\/\u5339\u914d\u76ee\u6807\u5185\u7f51\u5730\u5740\u5230\u5206\u652f\u5185\u7f51\u5730\u5740\u6d41\u91cf\u4e0d\u88abnat\u8f6c\u6362\uff0c\u5176\u4f59\u6d41\u91cf\u505anat\u8f6c\u6362\uff0c\u51fa\u53e3\u5730\u5740\u5e94\u7528\u6b64nat outbound 3999<\/p>\n\n\n\n

       rule 100 permit ip<\/p>\n\n\n\n

      3.\u9a8c\u8bc1\u914d\u7f6e\u7ed3\u679c<\/strong><\/strong><\/p>\n\n\n\n

      RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a<\/strong>\u6267\u884cdisplay ipsec sa\u547d\u4ee4\uff0c\u53ef\u4ee5\u67e5\u770bIPSec\u96a7\u9053\u4e0a\u914d\u7f6e\u7684\u4fe1\u606f\u3002<\/strong><\/strong><\/p>\n\n\n\n

      RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a\u67e5\u770b\u5339\u914d\u7684ACL\u662f\u5426\u6709\u6d41\u91cf\u4fe1\u606f<\/strong>display acl al<\/strong><\/strong><\/p>\n\n\n\n

      RouterA<\/strong>\u548c<\/strong>Router<\/strong>B\u4e0a\u67e5\u770b\u5339\u914d\u7684\u76ee\u6807\u7f51\u6bb5\u8def\u7531\u51fa\u53e3\u662f\u5426\u4e00\u81f4<\/strong>display ip routing-table <\/strong>x.x.x.x<\/strong><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

      \u534e\u4e3a\u8def\u7531\u5668ipsecVPN\u914d\u7f6e\u65b9\u6cd5 \u524d\u8a00\uff1b\u4f01\u4e1a\u5e0c\u671b…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,1],"tags":[],"class_list":["post-1205","post","type-post","status-publish","format-standard","hentry","category-19","category-1"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1205"}],"version-history":[{"count":1,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1205\/revisions"}],"predecessor-version":[{"id":1208,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1205\/revisions\/1208"}],"wp:attachment":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}