資源描述：
《IPSEC VPN 站點(diǎn)到站點(diǎn)配置》由會員上傳分享，免費(fèi)在線閱讀，更多相關(guān)內(nèi)容在教育資源-天天文庫。
1、實(shí)驗(yàn)需求USG-1和USG-2模擬企業(yè)邊緣設(shè)備，分別在2臺設(shè)備上配置NAT和IPsecVPN實(shí)現(xiàn)2邊私網(wǎng)可以通過VPN互相通信實(shí)驗(yàn)配置R1IP地址配置省略USG-1配置[USG-1]firewallzonetrust?????//配置trust區(qū)域[USG-1-zone-trust]addinterfaceg0/0/0??//將接口加入trust區(qū)域[USG-1-zone-trust]quit[USG-1]firewallzoneuntrust?????//配置untrust區(qū)域[USG-1-zone-untrust]addintg0/0/1?
2、????//將接口加入untrust區(qū)域[USG-1-zone-untrust]quit[USG-1]intg0/0/0[USG-1-GigabitEthernet0/0/0]ipadd192.168.10.124[USG-1-GigabitEthernet0/0/0]intg0/0/1[USG-1-GigabitEthernet0/0/1]ipadd11.0.0.224[USG-1-GigabitEthernet0/0/1]quit[USG-1]iproute-static0.0.0.00.0.0.011.0.0.1?//配置默認(rèn)路由上公網(wǎng)[
3、USG-1]nat-policyinterzonetrustuntrustoutbound?//進(jìn)入trust到untrust區(qū)域out方向的策略視圖[USG-1-nat-policy-interzone-trust-untrust-outbound]policy1??//創(chuàng)建一個策略[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policysource192.168.10.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outb
4、ound-1]policydestination192.168.20.00.0.0.255[USG-1-nat-policy-interzone-trust-untrust-outbound-1]actionno-nat?//以上三條命令意思是不允許將源為192.168.10.0/24網(wǎng)段目標(biāo)為192.168.20.0/24網(wǎng)段的數(shù)據(jù)包進(jìn)行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-1]quit[USG-1-nat-policy-interzone-trust-untrust-ou
5、tbound]policy2?//創(chuàng)建策略2[USG-1-nat-policy-interzone-trust-untrust-outbound-2]actionsource-nat//允許對源IP進(jìn)行NAT[USG-1-nat-policy-interzone-trust-untrust-outbound-2]easy-ipg0/0/1//對接口G0/0/1地址復(fù)用[USG-1-nat-policy-interzone-trust-untrust-outbound-2]quit[USG-1-nat-policy-interzone-trust
6、-untrust-outbound]quit---------------------------階段一-----------------------------------------------------[USG-1]ikeproposal1??//配置一個安全提議[USG-1-ike-proposal-1]authentication-methodpre-share?//配置IKE認(rèn)證方式為預(yù)共享密鑰[USG-1-ike-proposal-1]authentication-algorithmsha1?//配置IKE認(rèn)證算法為sha1[U
7、SG-1-ike-proposal-1]integrity-algorithmaes-xcbc-96?//配置IKE完整性算法[USG-1-ike-proposal-1]dhgroup2?//配置IKE密鑰協(xié)商DH組[USG-1-ike-proposal-1]quit[USG-1]ikepeerUSG-2??????//創(chuàng)建一個IKE對等體名字為USG-2[USG-1-ike-peer-usg-2]pre-shared-keyabc123??//配置預(yù)共享密鑰[USG-1-ike-peer-usg-2]remote-address12.0.0.
8、2?//配置對等體IP地址[USG-1-ike-peer-usg-2]ike-proposal1???//調(diào)用ike安全提議[USG-1-ike-pe
