{"id":1687,"date":"2026-03-23T14:27:12","date_gmt":"2026-03-23T06:27:12","guid":{"rendered":"https:\/\/www.jchj.top\/?p=1687"},"modified":"2026-04-24T18:07:30","modified_gmt":"2026-04-24T10:07:30","slug":"%e5%8d%8e%e4%b8%ba%e8%b7%af%e7%94%b1%e5%99%a8ipsecvpn%e9%85%8d%e7%bd%ae%e9%9c%80%e8%a6%81%e6%b3%a8%e6%84%8f%e7%9a%84%e9%97%ae%e9%a2%98","status":"publish","type":"post","link":"https:\/\/www.jchj.top\/?p=1687","title":{"rendered":"\u534e\u4e3a\u8def\u7531\u5668ipsecVPN\u914d\u7f6e\u9700\u8981\u6ce8\u610f\u7684\u95ee\u9898"},"content":{"rendered":"\n

\u534e\u4e3a\u8def\u7531\u5668ipsecVPN\u914d\u7f6e\u65b9\u6cd5<\/p>\n\n\n\n

\u524d\u8a00\uff1b\u4f01\u4e1a\u5e0c\u671b\u5bf9\u5206\u652f\u5b50\u7f51\u4e0e\u603b\u90e8\u5b50\u7f51\u4e4b\u95f4\u76f8\u4e92\u8bbf\u95ee\u7684\u5b89\u5168\u7684\u8fde\u63a5\u3002\u5206\u652f\u4e0e\u603b\u90e8\u901a\u8fc7\u516c\u7f51\u5efa\u7acb\u901a\u4fe1\uff0c\u53ef\u4ee5\u5728\u5206\u652f\u7f51\u5173\u4e0e\u603b\u90e8\u7f51\u5173\u4e4b\u95f4\u5efa\u7acb\u4e00\u4e2aIPSec\u96a7\u9053\u6765\u5b9e\u65bd\u5b89\u5168\u4fdd\u62a4\u3002\u7531\u4e8e\u7ef4\u62a4\u7f51\u5173\u8f83\u5c11\uff0c\u53ef\u4ee5\u8003\u8651\u91c7\u7528\u624b\u5de5\u65b9\u5f0f\u5efa\u7acbIPSec\u96a7\u9053\u6216\u662fIKE\u81ea\u52a8\u534f\u5546\u6a21\u5f0f<\/p>\n\n\n\n

    \n
  1. \u624b\u52a8\u6a21\u5f0f<\/li>\n<\/ol>\n\n\n\n
    \"\"\/<\/figure>\n\n\n\n

    RouterA\u7684\u914d\u7f6e<\/strong><\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    sysname RouterA<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    acl number 3101 \/\/\u914d\u7f6eACL 3101\uff0c\u5339\u914d\u4ece\u5206\u652f\u5b50\u7f51\u5230\u603b\u90e8\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

    rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec proposal tran1 \/\/\u914d\u7f6eIPSec\u5b89\u5168\u63d0\u8bae<\/p>\n\n\n\n

    esp authentication-algorithm sha2-256<\/p>\n\n\n\n

    esp encryption-algorithm aes-128<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ipsec policy map1 10 manual \/\/\u914d\u7f6e\u624b\u52a8\u65b9\u5f0f\u5b89\u5168\u7b56\u7565<\/p>\n\n\n\n

    security acl 3101<\/p>\n\n\n\n

    proposal tran1<\/p>\n\n\n\n

    tunnel local 1.1.1.1<\/p>\n\n\n\n

    tunnel remote 2.1.1.1<\/p>\n\n\n\n

    sa spi inbound esp 54321<\/p>\n\n\n\n

    sa string-key inbound esp cipher %^%#JvZxR2g8c;a9~FPN~n’$7`DEV&=G(=Et02P\/%\\*!%^%# \/\/\u914d\u7f6e\u5165\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

    sa spi outbound esp 12345<\/p>\n\n\n\n

    sa string-key outbound esp cipher %^%#K{JG:rWVHPMnf;5\\|,GW(Luq’qi8BT4nOj%5W5=)%^%# \/\/\u914d\u7f6e\u51fa\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet1\/0\/0<\/p>\n\n\n\n

    ip address 1.1.1.1 255.255.255.0<\/p>\n\n\n\n

    ipsec policy map1<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    interface GigabitEthernet2\/0\/0<\/p>\n\n\n\n

    ip address 10.1.1.1 255.255.255.0<\/p>\n\n\n\n

    #<\/p>\n\n\n\n

    ip route-static 2.1.1.0 255.255.255.0 1.1.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u603b\u90e8\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    ip route-static 10.1.2.0 255.255.255.0 1.1.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u603b\u90e8\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

    RouterB\u7684\u914d\u7f6e<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    sysname RouterB<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    acl number 3101 \/\/\u914d\u7f6eACL 3101\uff0c\u5339\u914d\u4ece\u603b\u90e8\u5b50\u7f51\u5230\u5206\u652f\u5b50\u7f51\u7684\u6d41\u91cf<\/strong><\/p>\n\n\n\n

    rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    ipsec proposal tran1 \/\/\u914d\u7f6eIPSec\u5b89\u5168\u63d0\u8bae<\/strong><\/p>\n\n\n\n

    esp authentication-algorithm sha2-256<\/strong><\/p>\n\n\n\n

    esp encryption-algorithm aes-128<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    ipsec policy use1 10 manual \/\/\u914d\u7f6e\u624b\u52a8\u65b9\u5f0f\u5b89\u5168\u7b56\u7565<\/strong><\/p>\n\n\n\n

    security acl 3101<\/strong><\/p>\n\n\n\n

    proposal tran1<\/strong><\/p>\n\n\n\n

    tunnel local 2.1.1.1<\/strong><\/p>\n\n\n\n

    tunnel remote 1.1.1.1<\/strong><\/p>\n\n\n\n

    sa spi inbound esp 12345<\/strong><\/p>\n\n\n\n

    sa string-key inbound esp cipher %^%#IRFGEiFPJ1$&a’Qy,L*XQL_+*Grq-=yMb}ULZdS6%^%# \/\/\u914d\u7f6e\u5165\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/strong><\/p>\n\n\n\n

    sa spi outbound esp 54321<\/strong><\/p>\n\n\n\n

    sa string-key outbound esp cipher %^%#(3fr1!&6O=)!GN#~{)n,2fq>4#4+%;lMTs5(]:c)%^%# \/\/\u914d\u7f6e\u51fa\u65b9\u5411SA\u7684\u8ba4\u8bc1\u5bc6\u94a5\u4e3ahuawei<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    interface GigabitEthernet1\/0\/0<\/strong><\/p>\n\n\n\n

    ip address 2.1.1.1 255.255.255.0<\/strong><\/p>\n\n\n\n

    ipsec policy use1<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    interface GigabitEthernet2\/0\/0<\/strong><\/p>\n\n\n\n

    ip address 10.1.2.1 255.255.255.0<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    ip route-static 1.1.1.0 255.255.255.0 2.1.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u5206\u652f\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/strong><\/p>\n\n\n\n

    ip route-static 10.1.1.0 255.255.255.0 2.1.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662f\u5206\u652f\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/strong><\/p>\n\n\n\n

    #<\/strong><\/p>\n\n\n\n

    return<\/strong><\/p>\n\n\n\n

    ……\u6ce8\u610f\u4f7f\u7528\u9ad8\u7ea7ACL\u7cbe\u51c6\u914d\u7f6e\uff0c\u5982\u5148\u88abnat outbound\u7684\u6d41\u91cf\u662f\u4e0d\u4f1a\u88ab\u5339\u914d\u4e0a\u7684<\/strong><\/p>\n\n\n\n

    \u5982\uff1a<\/strong><\/p>\n\n\n\n

    acl number 3999<\/p>\n\n\n\n

    rule 5 deny ip source 10.0.0.0 0.0.1.255 destination 10.2.12.0 0.0.1.255 \/\/\u5339\u914d\u76ee\u6807\u5185\u7f51\u5730\u5740\u5230\u5206\u652f\u5185\u7f51\u5730\u5740\u6d41\u91cf\u4e0d\u88abnat\u8f6c\u6362\uff0c\u5176\u4f59\u6d41\u91cf\u505anat\u8f6c\u6362\uff0c\u51fa\u53e3\u5730\u5740\u5e94\u7528\u6b64nat outbound 3999<\/p>\n\n\n\n

    rule 100 permit ip<\/p>\n\n\n\n

    \u5728\u5b9e\u9645\u4f7f\u7528\u73af\u5883\u914d\u7f6e\u8fc7\u7a0b\u8fc7\u7a0b\u4e2d\uff0c\u51fa\u73b0\u95ee\u9898\u4e86IP\u5730\u5740\u53ca\u4f7f\u7528\u7aef\u53e3\u90fd\u901a\u598210.0.0.43:33080 \u4f46\u662f\u5e94\u7528\u5b58http:\/\/10.0.0.43:30080\u8bbf\u95ee\u65f6\u4e0d\u901a\uff0c\u540e\u7ecf\u8fc7\u534e\u4e3a\u7814\u53d1\u53d1\u73b0\u662f\u5305\u5207\u7247\u7684\u95ee\u9898\uff0c\u4e5f\u5c31\u662ftcp adjust-mss<\/strong><\/p>\n\n\n\n

    \u9700\u5206\u522b\u5728\u4e24\u7aef\u51fa\u53e3\u8def\u7531\u5668\u7684\u6d41\u91cf\u5165\u53e3\u914d\u7f6etcp adjust-mss 1200<\/strong><\/p>\n\n\n\n

    \u5982\u4e0b\u56fe\uff1a<\/p>\n\n\n\n

    \u603b\u90e8\u8def\u7531\u5668<\/p>\n\n\n\n

    \"\"\/<\/figure>\n\n\n\n

    \u5206\u90e8\u8def\u7531\u5668<\/p>\n\n\n\n

    \"\"\/<\/figure>\n\n\n\n

    3.\u9a8c\u8bc1\u914d\u7f6e\u7ed3\u679c<\/strong><\/p>\n\n\n\n

    RouterA\u548cRouterB\u4e0a\u6267\u884cdisplay ipsec sa\u547d\u4ee4\uff0c\u53ef\u4ee5\u67e5\u770bIPSec\u96a7\u9053\u4e0a\u914d\u7f6e\u7684\u4fe1\u606f\u3002<\/strong><\/p>\n\n\n\n

    RouterA\u548cRouterB\u4e0a\u67e5\u770b\u5339\u914d\u7684ACL\u662f\u5426\u6709\u6d41\u91cf\u4fe1\u606fdisplay acl al<\/strong><\/p>\n\n\n\n

    RouterA\u548cRouterB\u4e0a\u67e5\u770b\u5339\u914d\u7684\u76ee\u6807\u7f51\u6bb5\u8def\u7531\u51fa\u53e3\u662f\u5426\u4e00\u81f4display ip routing-table x.x.x.x<\/strong><\/p>\n\n\n\n

      \n
    1. IKE\u52a8\u6001\u534f\u5546\u6a21\u5f0f<\/li>\n<\/ol>\n\n\n\n
      \"\"\/<\/figure>\n\n\n\n

      Headquarters\u7684\u914d\u7f6e<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      sysname Headquarters<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      acl number 3000 \/\/\u914d\u7f6eACL 3000\uff0c\u5339\u914d\u4ece\u603b\u90e8\u5b50\u7f51\u5230\u5206\u652f\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

      rule 0 permit ip source 10.1.0.0 0.0.0.255 destination 10.2.0.0 0.0.0.255<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec proposal def \/\/\u914d\u7f6eIPSec\u63d0\u8bae<\/p>\n\n\n\n

      esp authentication-algorithm sha2-256<\/p>\n\n\n\n

      esp encryption-algorithm aes-192<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike proposal 5 \/\/\u914d\u7f6eIKE\u63d0\u8bae<\/p>\n\n\n\n

      encryption-algorithm aes-cbc-128 \/\/V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\uff0caes-cbc-128\u53c2\u6570\u4fee\u6539\u4e3aaes-128<\/p>\n\n\n\n

      dh group14<\/p>\n\n\n\n

      authentication-algorithm sha2-256<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike peer Center v1 \/\/\u914d\u7f6eIKE\u5bf9\u7b49\u4f53\u53ca\u5176\u4f7f\u7528\u7684\u534f\u8bae\u65f6\uff0c\u4e0d\u540c\u7684\u8f6f\u4ef6\u7248\u672c\u95f4\u7684\u914d\u7f6e\u6709\u5dee\u5f02\uff1aV200R008\u4e4b\u524d\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name [ v1 | v2 ]\u3002V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name\u548cversion { 1 | 2 }\uff0c\u5982\u679c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u7248\u672c\u540c\u65f6\u542f\u7528\uff0c\u8bbe\u5907\u53d1\u8d77\u534f\u5546\u65f6\u4f1a\u4f7f\u7528IKEv2\u534f\u8bae\uff0c\u54cd\u5e94\u534f\u5546\u65f6\u5219\u540c\u65f6\u652f\u6301IKEv1\u534f\u8bae\u548cIKEv2\u534f\u8bae\u3002\u81eaV200R008\u7248\u672c\u5230V200R021\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u540c\u65f6\u542f\u7528\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u5219\u53ef\u4ee5\u6267\u884c\u547d\u4ee4undo version 2\uff1bV200R021\u53ca\u4e4b\u540e\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u542f\u7528\u5bf9\u7b49\u4f53IKEv2\u7248\u672c\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u9700\u8981\u5148\u6267\u884c\u547d\u4ee4version 1\uff0c\u518d\u6267\u884c\u547d\u4ee4undo version 2\u3002<\/p>\n\n\n\n

      pre-shared-key cipher %^%#JvZxR2g8c;a9~FPN~n’$7`DEV&=G(=Et02P\/%\\*!%^%# \/\/\u914d\u7f6e\u9884\u5171\u4eab\u5bc6\u94a5\u8ba4\u8bc1\u5b57\u4e3a\u201chuawei\u201d\uff0c\u4ee5\u5bc6\u6587\u663e\u793a\uff0c\u8be5\u547d\u4ee4\u5728V2R3C00\u4ee5\u524d\u7684\u7248\u672c\u4e2d\u4e3a\u201cpre-shared-key huawei\u201d\uff0c\u4ee5\u660e\u6587\u663e\u793a<\/p>\n\n\n\n

      remote-address 1.2.2.1 \/\/\u914d\u7f6e\u5bf9\u7aefIP\u5730\u5740<\/p>\n\n\n\n

      dpd type on-demand \/\/\u914d\u7f6eDPD\u68c0\u6d4b\u6a21\u5f0f\u4e3a\u6839\u636e\u9700\u8981\u8fdb\u884c\u68c0\u6d4b<\/p>\n\n\n\n

      ike-proposal 5<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec policy center 1 isakmp \/\/\u914d\u7f6eIPSec\u7b56\u7565<\/p>\n\n\n\n

      security acl 3000<\/p>\n\n\n\n

      ike-peer Center<\/p>\n\n\n\n

      proposal def<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet1\/0\/0<\/p>\n\n\n\n

      ip address 1.2.1.1 255.255.255.0<\/p>\n\n\n\n

      ipsec policy center<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet2\/0\/0<\/p>\n\n\n\n

      ip address 10.1.0.1 255.255.255.0<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ip route-static 1.2.2.0 255.255.255.0 1.2.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fBranch\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      ip route-static 10.2.0.0 255.255.255.0 1.2.1.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fBranch\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      return<\/p>\n\n\n\n

      Branch\u7684\u914d\u7f6e<\/strong><\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      sysname Branch<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      acl number 3000 \/\/\u914d\u7f6eACL 3000\uff0c\u5339\u914d\u4ece\u5206\u652f\u5b50\u7f51\u5230\u603b\u90e8\u5b50\u7f51\u7684\u6d41\u91cf<\/p>\n\n\n\n

      rule 0 permit ip source 10.2.0.0 0.0.0.255 destination 10.1.0.0 0.0.0.255<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec proposal def \/\/\u914d\u7f6eIPSec\u63d0\u8bae<\/p>\n\n\n\n

      esp authentication-algorithm sha2-256<\/p>\n\n\n\n

      esp encryption-algorithm aes-192<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike proposal 5 \/\/\u914d\u7f6eIKE\u63d0\u8bae<\/p>\n\n\n\n

      encryption-algorithm aes-cbc-128 \/\/V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\uff0caes-cbc-128\u53c2\u6570\u4fee\u6539\u4e3aaes-128<\/p>\n\n\n\n

      dh group14<\/p>\n\n\n\n

      authentication-algorithm sha2-256<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ike peer Branch v1 \/\/\u914d\u7f6eIKE\u5bf9\u7b49\u4f53\u53ca\u5176\u4f7f\u7528\u7684\u534f\u8bae\u65f6\uff0c\u4e0d\u540c\u7684\u8f6f\u4ef6\u7248\u672c\u95f4\u7684\u914d\u7f6e\u6709\u5dee\u5f02\uff1aV200R008\u4e4b\u524d\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name [ v1 | v2 ]\u3002V200R008\u53ca\u4e4b\u540e\u7684\u7248\u672c\u547d\u4ee4\u4e3aike peer peer-name\u548cversion { 1 | 2 }\uff0c\u5982\u679c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u7248\u672c\u540c\u65f6\u542f\u7528\uff0c\u8bbe\u5907\u53d1\u8d77\u534f\u5546\u65f6\u4f1a\u4f7f\u7528IKEv2\u534f\u8bae\uff0c\u54cd\u5e94\u534f\u5546\u65f6\u5219\u540c\u65f6\u652f\u6301IKEv1\u534f\u8bae\u548cIKEv2\u534f\u8bae\u3002\u81eaV200R008\u7248\u672c\u5230V200R021\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u5bf9\u7b49\u4f53IKEv1\u548cIKEv2\u540c\u65f6\u542f\u7528\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u5219\u53ef\u4ee5\u6267\u884c\u547d\u4ee4undo version 2\uff1bV200R021\u53ca\u4e4b\u540e\u7248\u672c\uff0c\u7f3a\u7701\u60c5\u51b5\u4e0b\uff0c\u542f\u7528\u5bf9\u7b49\u4f53IKEv2\u7248\u672c\u3002\u5982\u679c\u8bbe\u5907\u9700\u8981\u4f7f\u7528IKEv1\u534f\u8bae\uff0c\u9700\u8981\u5148\u6267\u884c\u547d\u4ee4version 1\uff0c\u518d\u6267\u884c\u547d\u4ee4undo version 2\u3002<\/p>\n\n\n\n

      pre-shared-key cipher %^%#K{JG:rWVHPMnf;5\\|,GW(Luq’qi8BT4nOj%5W5=)%^%# \/\/\u914d\u7f6e\u9884\u5171\u4eab\u5bc6\u94a5\u8ba4\u8bc1\u5b57\u4e3a\u201chuawei\u201d\uff0c\u4ee5\u5bc6\u6587\u663e\u793a\uff0c\u8be5\u547d\u4ee4\u5728V2R3C00\u4ee5\u524d\u7684\u7248\u672c\u4e2d\u4e3a\u201cpre-shared-key huawei\u201d\uff0c\u4ee5\u660e\u6587\u663e\u793a<\/p>\n\n\n\n

      remote-address 1.2.1.1 \/\/\u914d\u7f6e\u5bf9\u7aefIP\u5730\u5740<\/p>\n\n\n\n

      dpd type on-demand \/\/\u914d\u7f6eDPD\u68c0\u6d4b\u6a21\u5f0f\u4e3a\u6839\u636e\u9700\u8981\u8fdb\u884c\u68c0\u6d4b<\/p>\n\n\n\n

      ike-proposal 5<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ipsec policy branch 1 isakmp \/\/\u914d\u7f6eIPSec\u7b56\u7565<\/p>\n\n\n\n

      security acl 3000<\/p>\n\n\n\n

      ike-peer Branch<\/p>\n\n\n\n

      proposal def<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet1\/0\/0<\/p>\n\n\n\n

      ip address 1.2.2.1 255.255.255.0<\/p>\n\n\n\n

      ipsec policy branch<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      interface Ethernet2\/0\/0<\/p>\n\n\n\n

      ip address 10.2.0.1 255.255.255.0<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      ip route-static 1.2.1.0 255.255.255.0 1.2.2.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fHeadquarters\u5916\u7f51\u51fa\u53e3\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      ip route-static 10.1.0.0 255.255.255.0 1.2.2.2 \/\/\u914d\u7f6e\u4e00\u6761\u76ee\u7684\u5730\u5740\u662fHeadquarters\u5185\u7f51\u7684\u9759\u6001\u8def\u7531<\/p>\n\n\n\n

      #<\/p>\n\n\n\n

      return<\/p>\n\n\n\n

      ……\u6ce8\u610f\u4f7f\u7528\u9ad8\u7ea7ACL\u7cbe\u51c6\u914d\u7f6e\uff0c\u5982\u5148\u88abnat outbound\u7684\u6d41\u91cf\u662f\u4e0d\u4f1a\u88ab\u5339\u914d\u4e0a\u7684<\/strong><\/p>\n\n\n\n

      \u5982\uff1a<\/strong><\/p>\n\n\n\n

      acl number 3999<\/p>\n\n\n\n

      rule 5 deny ip source 10.0.0.0 0.0.1.255 destination 10.2.12.0 0.0.1.255 \/\/\u5339\u914d\u76ee\u6807\u5185\u7f51\u5730\u5740\u5230\u5206\u652f\u5185\u7f51\u5730\u5740\u6d41\u91cf\u4e0d\u88abnat\u8f6c\u6362\uff0c\u5176\u4f59\u6d41\u91cf\u505anat\u8f6c\u6362\uff0c\u51fa\u53e3\u5730\u5740\u5e94\u7528\u6b64nat outbound 3999<\/p>\n\n\n\n

      rule 100 permit ip<\/p>\n\n\n\n

      3.\u9a8c\u8bc1\u914d\u7f6e\u7ed3\u679c<\/strong><\/p>\n\n\n\n

      RouterA\u548cRouterB\u4e0a\u6267\u884cdisplay ipsec sa\u547d\u4ee4\uff0c\u53ef\u4ee5\u67e5\u770bIPSec\u96a7\u9053\u4e0a\u914d\u7f6e\u7684\u4fe1\u606f\u3002<\/strong><\/p>\n\n\n\n

      RouterA\u548cRouterB\u4e0a\u67e5\u770b\u5339\u914d\u7684ACL\u662f\u5426\u6709\u6d41\u91cf\u4fe1\u606fdisplay acl al<\/strong><\/p>\n\n\n\n

      RouterA\u548cRouterB\u4e0a\u67e5\u770b\u5339\u914d\u7684\u76ee\u6807\u7f51\u6bb5\u8def\u7531\u51fa\u53e3\u662f\u5426\u4e00\u81f4display ip routing-table x.x.x.x<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

      \u534e\u4e3a\u8def\u7531\u5668ipsecVPN\u914d\u7f6e\u65b9\u6cd5 \u524d\u8a00\uff1b\u4f01\u4e1a\u5e0c\u671b…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,10],"tags":[],"class_list":["post-1687","post","type-post","status-publish","format-standard","hentry","category-19","category-10"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1687"}],"version-history":[{"count":1,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1687\/revisions"}],"predecessor-version":[{"id":1688,"href":"https:\/\/www.jchj.top\/index.php?rest_route=\/wp\/v2\/posts\/1687\/revisions\/1688"}],"wp:attachment":[{"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jchj.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}