学习啦 > 学习电脑 > 网络知识 > 路由器 > 路由器设置 > 华为路由器 > 华为USG防火墙IPsec怎么配置

华为USG防火墙IPsec怎么配置

时间: 权威724 分享

华为USG防火墙IPsec怎么配置

  华为的产品主要涉及通信网络中的交换网络、传输网络、无线及有线固定接入网络和数据通信网络及无线终端产品,那么你知道华为USG防火墙 IPsec 怎么配置吗?下面是学习啦小编整理的一些关于华为USG防火墙 IPsec 怎么配置的相关资料,供你参考。

  华为USG防火墙 IPsec 配置的案例

  实验拓扑

  使用华为ensp 1.2.00.370模拟器来完成。连接方式是 client1 - USG-1 - AR1 - USG-2 - clent2 链式组网结构。

  实验需求

  USG-1和USG-2模拟企业边缘设备,分别在2台设备上配置NAT和IPsec 实现2边私网可以通过互相通信。

  实验配置

  R1的IP地址配置省略

  USG-1配置

  [USG-1]firewall zone trust //配置trust区域

  [USG-1-zone-trust]add interface g0/0/0 //将接口加入trust区域

  [USG-1-zone-trust]quit

  [USG-1]firewall zone untrust //配置untrust区域

  [USG-1-zone-untrust]add int g0/0/1 //将接口加入untrust区域

  [USG-1-zone-untrust]quit

  [USG-1]int g0/0/0

  [USG-1-GigabitEthernet0/0/0]ip add 192.168.10.1 24

  [USG-1-GigabitEthernet0/0/0]int g0/0/1

  [USG-1-GigabitEthernet0/0/1]ip add 11.0.0.2 24

  [USG-1-GigabitEthernet0/0/1]quit

  [USG-1]ip route-static 0.0.0.0 0.0.0.0 11.0.0.1 //配置默认路由上公网

  [USG-1]nat-policy interzone trust untrust outbound

  //进入trust到untrust区域out方向的策略视图

  [USG-1-nat-policy-interzone-trust-untrust-outbound]policy 1 //创建一个策略

  [USG-1-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.10.0 0.0.0.255

  [USG-1-nat-policy-interzone-trust-untrust-outbound-1]policy destination 192.168.20.0 0.0.0.255

  [USG-1-nat-policy-interzone-trust-untrust-outbound-1]action no-nat

  //以上三条命令意思是不允许将源为192.168.10.0/24网段目标为192.168.20.0/24网段的数据包进行NAT

  [USG-1-nat-policy-interzone-trust-untrust-outbound-1]quit

  [USG-1-nat-policy-interzone-trust-untrust-outbound]policy 2 //创建策略2

  [USG-1-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

  //允许对源IP进行NAT

  [USG-1-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/1

  //对接口G0/0/1地址复用

  [USG-1-nat-policy-interzone-trust-untrust-outbound-2]quit

  [USG-1-nat-policy-interzone-trust-untrust-outbound]quit

  -------阶段一---------

  [USG-1]ike proposal 1 //配置一个安全提议

  [USG-1-ike-proposal-1]authentication-method pre-share //配置IKE认证方式为预共享密钥

  [USG-1-ike-proposal-1]authentication-algorithm sha1 //配置IKE认证算法为sha1

  [USG-1-ike-proposal-1]integrity-algorithm aes-xcbc-96 //配置IKE完整性算法

  [USG-1-ike-proposal-1]dh group2 //配置IKE密钥协商DH组

  [USG-1-ike-proposal-1]quit

  [USG-1]ike peer USG-2 //创建一个IKE对等体名字为USG-2

  [USG-1-ike-peer-usg-2]pre-shared-key abc123 //配置预共享密钥

  [USG-1-ike-peer-usg-2]remote-address 12.0.0.2 //配置对等体IP地址

  [USG-1-ike-peer-usg-2]ike-proposal 1 //调用ike安全提议

  [USG-1-ike-peer-usg-2]quit

  ----------阶段二----------

  [USG-1]ipsec proposal test //配置一个ipsec安全提议

  [USG-1-ipsec-proposal-test]encapsulation-mode tunnel //封装方式采用隧道

  [USG-1-ipsec-proposal-test]transform esp //配置IPSEC安全协议为ESP

  [USG-1-ipsec-proposal-test]esp encryption-algorithm aes //配置ESP协议加密算法为aes

  [USG-1-ipsec-proposal-test]esp authentication-algorithm sha1 //配置ESP协议认证算法

  [USG-1-ipsec-proposal-test]quit

  [USG-1]acl 3000 //创建一个ACL定义感兴趣流

  [USG-1-acl-adv-3000]rule permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

  [USG-1]ipsec policy map 1 isakmp //创建一个安全策略,名称为map

  [USG-1-ipsec-policy-isakmp-map-1]ike-peer USG-2 //调用ike对等体

  [USG-1-ipsec-policy-isakmp-map-1]proposal test //调用IPsec安全提议

  [USG-1-ipsec-policy-isakmp-map-1]security acl 3000 //配置感兴趣流

  [USG-1-ipsec-policy-isakmp-map-1]quit

  [USG-1]int g0/0/1

  [USG-1-GigabitEthernet0/0/1]ipsec policy map //在外网口上调用安全策略

  区域间策略配置

  [USG-1]policy interzone trust untrust outbound .

  //进入trust到untrust区域out方向策略视图

  [USG-1-policy-interzone-trust-untrust-outbound]policy 1 //创建策略

  [USG-1-policy-interzone-trust-untrust-outbound-1]action permit

  //允许trust区域所有主机访问untrust区域

  [USG-1-policy-interzone-trust-untrust-outbound-1]quit

  [USG-1-policy-interzone-trust-untrust-outbound]quit

  [USG-1]policy interzone trust untrust inbound

  //进入trust区域到untrust区域的in方向策略视图

  [USG-1-policy-interzone-trust-untrust-inbound]policy 1

  [USG-1-policy-interzone-trust-untrust-inbound-1]policy source 192.168.20.0 0.0.0.255

  [USG-1-policy-interzone-trust-untrust-inbound-1]policy destination 192.168.10.0 0.0.0.255

  [USG-1-policy-interzone-trust-untrust-inbound-1]action permit

  //以上命令为允许数据包源地址为192.168.20.0/24网段和目标地址为192.168.10.0/24网段的流量过

  [USG-1-policy-interzone-trust-untrust-inbound-1]quit

  [USG-1-policy-interzone-trust-untrust-inbound]quit

  [USG-1]policy interzone local untrust inbound

  //进入local区域到untrust区域的in方向策略视图

  [USG-1-policy-interzone-local-untrust-inbound]policy 1

  [USG-1-policy-interzone-local-untrust-inbound-1]policy service service-set esp

  [USG-1-policy-interzone-local-untrust-inbound-1]policy source 12.0.0.2 0

  [USG-1-policy-interzone-local-untrust-inbound-1]policy destination 11.0.0.2 0

  [USG-1-policy-interzone-local-untrust-inbound-1]action permit

  //允许源地址是12.0.0.2目标地址是11.0.0.2的数据包访问esp协议

  USG-2配置

  [USG-2]firewall zone trust

  [USG-2-zone-trust]add int g0/0/0

  [USG-2-zone-trust]quit

  [USG-2]firewall zone untrust

  [USG-2-zone-untrust]add int g0/0/1

  [USG-2-zone-untrust]quit

  [USG-2]int g0/0/0

  [USG-2-GigabitEthernet0/0/0]ip add 192.168.20.1 24

  [USG-2-GigabitEthernet0/0/0]int g0/0/1

  [USG-2-GigabitEthernet0/0/1]ip add 12.0.0.2 24

  [USG-2-GigabitEthernet0/0/1]quit

  [USG-2]ip route-static 0.0.0.0 0.0.0.0 12.0.0.1

  [USG-2]nat-policy interzone trust untrust outbound

  [USG-2-nat-policy-interzone-trust-untrust-outbound]policy 1

  [USG-2-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.20.0 0.0.0.255

  [USG-2-nat-policy-interzone-trust-untrust-outbound-1]policy destination 192.168.10.0 0.0.0.255

  [USG-2-nat-policy-interzone-trust-untrust-outbound-1]action no-nat

  [USG-2-nat-policy-interzone-trust-untrust-outbound-1]quit

  [USG-2-nat-policy-interzone-trust-untrust-outbound]policy 2

  [USG-2-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

  [USG-2-nat-policy-interzone-trust-untrust-outbound-2]easy-ip GigabitEthernet0/0/1

  [USG-2-nat-policy-interzone-trust-untrust-outbound-2]quit

  [USG-2-nat-policy-interzone-trust-untrust-outbound]quit

  [USG-2]ike proposal 1

  [USG-2-ike-proposal-1]authentication-method pre-share

  [USG-2-ike-proposal-1]authentication-algorithm sha1

  [USG-2-ike-proposal-1]integrity-algorithm aes-xcbc-96

  [USG-2-ike-proposal-1]dh group2

  [USG-2-ike-proposal-1]quit

  [USG-2]ike peer USG-A

  [USG-2-ike-peer-usg-a]pre-shared-key abc123

  [USG-2-ike-peer-usg-a]ike-proposal 1

  [USG-2-ike-peer-usg-a]remote-address 11.0.0.2

  [USG-2-ike-peer-usg-a]quit

  [USG-2]ipsec proposal test

  [USG-2-ipsec-proposal-test]encapsulation-mode tunnel

  [USG-2-ipsec-proposal-test]transform esp

  [USG-2-ipsec-proposal-test]esp encryption-algorithm aes

  [USG-2-ipsec-proposal-test]esp authentication-algorithm sha1

  [USG-2-ipsec-proposal-test]quit

  [USG-2]acl 3000

  [USG-2-acl-adv-3000]rule permit ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

  [USG-2-acl-adv-3000]quit

  [USG-2]ipsec policy map 1 isakmp

  [USG-2-ipsec-policy-isakmp-map-1]ike-peer USG-A

  [USG-2-ipsec-policy-isakmp-map-1]proposal test

  [USG-2-ipsec-policy-isakmp-map-1]security acl 3000

  [USG-2-ipsec-policy-isakmp-map-1]quit

  [USG-2]int g0/0/1

  [USG-2-GigabitEthernet0/0/1]ipsec policy map

  [USG-2-GigabitEthernet0/0/1]quit

  [USG-2]policy interzone trust untrust outbound

  [USG-2-policy-interzone-trust-untrust-outbound]policy 1

  [USG-2-policy-interzone-trust-untrust-outbound-1]action permit

  [USG-2-policy-interzone-trust-untrust-outbound-1]quit

  [USG-2-policy-interzone-trust-untrust-outbound]quit

  [USG-2]policy interzone trust untrust inbound

  [USG-2-policy-interzone-trust-untrust-inbound]policy 1

  [USG-2-policy-interzone-trust-untrust-inbound-1]policy source 192.168.10.0 0.0.0.255

  [USG-2-policy-interzone-trust-untrust-inbound-1]policy destination 192.168.20.0 0.0.0.255

  [USG-2-policy-interzone-trust-untrust-inbound-1]action permit

  [USG-2-policy-interzone-trust-untrust-inbound-1]quit

  [USG-2-policy-interzone-trust-untrust-inbound]quit

  [USG-2]policy interzone local untrust inbound

  [USG-2-policy-interzone-local-untrust-inbound]policy 1

  [USG-2-policy-interzone-local-untrust-inbound-1]policy source 11.0.0.2 0

  [USG-2-policy-interzone-local-untrust-inbound-1]policy destination 12.0.0.2 0

  [USG-2-policy-interzone-local-untrust-inbound-1]policy service service-set esp

  [USG-2-policy-interzone-local-untrust-inbound-1]action permit

  使用C1(192.168.10.10)去ping C2(192.168.20.10)

  使用dispaly ike sa和display ipsec sa来查看邻居建立情况

  看过文章“华为USG防火墙 IPsec 怎么配置”的人还看了:

  1.华为路由器配置命令大全

  2.华为路由器设置

  3.华为路由器设置wifi的详细方法

  4.华为路由器配置详细教程

  5.华为如何设置连接两个无线路由器

  6.华为路由器详细介绍

574686