USG防火墻IPSecVPN配置

《USG防火墻IPSecVPN配置》由會(huì)員上傳分享，免費(fèi)在線閱讀，更多相關(guān)內(nèi)容在工程資料-天天文庫。

1、實(shí)用文檔場景公司的網(wǎng)絡(luò)分為總部區(qū)域、分部網(wǎng)絡(luò)和分支辦公室三個(gè)部分。要求分部Trust區(qū)域的用戶和分支辦公室能夠訪問總部Trust區(qū)域。傳輸?shù)臄?shù)據(jù)需要加密。步驟一：基本配置system-view[Huawei]sysnameR1[R1]interfaceGigabitEthernet0/0/1[R1-GigabitEthernet0/0/1]ipaddress10.0.10.224[R1-GigabitEthernet0/0/1]interfaceSerial1/0/0[R1-Seri

2、al1/0/0]ipaddress10.0.12.124[R1-Serial1/0/0]interfaceloopback0標(biāo)準(zhǔn)文案實(shí)用文檔[R1-LoopBack0]ipaddress10.0.1.124[Huawei]sysnameR2[R2]interfaceGigabitEthernet0/0/2[R2-GigabitEthernet0/0/2]ipaddress10.0.20.124[R2-GigabitEthernet0/0/2]interfaceSerial1/0/0[R2-Seria

3、l1/0/0]ipaddress10.0.12.224[R2-Serial1/0/0]interfaceloopback0[R2-LoopBack0]ipaddress10.0.2.224[Huawei]sysnameR3[R3]interfaceSerial2/0/0[R3-Serial2/0/0]ipaddress10.0.23.324[R3-Serial2/0/0]interfaceloopback0[R3-LoopBack0]ipaddress10.0.3.324配置FW1和FW2防火墻

4、SG2100>system-view標(biāo)準(zhǔn)文案實(shí)用文檔[USG2100]sysnameFW1[FW1]interfaceEthernet0/0/0[FW1-Ethernet0/0/0]ipaddress10.0.100.124[FW1-Ethernet0/0/0]interfaceEthernet2/0/0[FW1-Ethernet2/0/0]ipaddress10.0.10.124[FW1-Ethernet2/0/0]interfacevlanif1[FW1-Vlanf1]undoipaddress

5、system-view[USG2100]sysnameFW2[FW2]interfaceEthernet0/0/0[FW2-Ethernet0/0/0]ipaddress10.0.200.124[FW2-Ethernet0/0/0]interfaceEthernet2/0/0[FW2-Ethernet2/0/0]ipaddress10.0.20.124[FW2-Ethernet2/0/0]interfacevlanif1[FW2-Vlanf1]undoipaddress[FW1]f

6、irewallzoneuntrust標(biāo)準(zhǔn)文案實(shí)用文檔[FW1-zone-untrust]addinterfaceEthernet2/0/0[FW1-zone-untrust]undoaddinterfaceEthernet0/0/0[FW1-zone-untrust]quit[FW1]firewallzonetrust[FW1-zone-trust]addinterfaceEthernet0/0/0[FW2]firewallzoneuntrust[FW2-zone-untrust]addinterf

7、aceEthernet2/0/0[FW2-zone-untrust]undoaddinterfaceEthernet0/0/0[FW2-zone-untrust]quit[FW2]firewallzonetrust[FW2-zone-trust]addinterfaceEthernet0/0/0步驟二：配置區(qū)域的安全過濾[FW1]firewallpacket-filterdefaultpermitinterzonetrustuntrust//允許trust訪untrust區(qū)域[FW1]firewal

8、lpacket-filterdefaultpermitinterzonelocaluntrust[FW2]firewallpacket-filterdefaultpermitinterzonetrustuntrust標(biāo)準(zhǔn)文案實(shí)用文檔[FW2firewallpacket-filterdefaultpermitinterzonelocaluntrust步驟三：配置路由[R1]ospf1[R1-ospf-1]area0.0.0.0[R1-ospf-1-area-0.0.0.