eNSP模拟器—IPsec配置实验4

参考配置：
https://support.huawei.com/enterprise/zh/doc/EDOC1000010139?section=j00d
https://blog.51cto.com/sunjie123/1742580

主要内容：
IPSec手动模式、USG、隧道模式、ESP封装

FW1

# CLI_VERSION=V300R001

# Last configuration was changed at 2020/02/17 14:19:44 from console0
#*****BEGIN****public****#
#
stp region-configuration
 region-name 60e1a215e041
 active region-configuration
#
acl number 3000
 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
#
ipsec proposal tran1
 esp authentication-algorithm sha1
 esp encryption-algorithm aes
#
ipsec policy map1 10 manual
 security acl 3000
 proposal tran1
 tunnel local 202.38.163.1
 tunnel remote 202.38.169.1
 sa spi inbound esp 54321
 sa string-key inbound esp %$%$-v5#1[=d)0K2("J.N*I:t,#w%$%$
 sa spi outbound esp 12345
 sa string-key outbound esp %$%$VCe/VT,L92z}lnRy`)l1tZQH%$%$
#
interface GigabitEthernet0/0/0
 alias GE0/MGMT
 ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 ip address 202.38.163.1 255.255.255.0
 ipsec policy map1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface NULL0
 alias NULL0
#
firewall zone local
 set priority 100
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#
firewall zone dmz
 set priority 50
#
aaa
 local-user admin password cipher %$%$u`NO*pI,w:h]ko~YT0I4s8/&%$%$
 local-user admin service-type web terminal telnet
 local-user admin level 15
 authentication-scheme default
 #
 authorization-scheme default
 #
 accounting-scheme default
 #
 domain default
 #
#
nqa-jitter tag-version 1

#
 ip route-static 10.1.2.0 255.255.255.0 202.38.163.2
 ip route-static 202.38.169.0 255.255.255.0 202.38.163.2
#
 banner enable
#
user-interface con 0
 authentication-mode none
user-interface vty 0 4
 authentication-mode none
 protocol inbound all
#
 slb
#
right-manager server-group
#
 sysname SRG
#
 l2tp domain suffix-separator @
#
 firewall packet-filter default permit interzone local trust direction inbound
 firewall packet-filter default permit interzone local trust direction outbound
 firewall packet-filter default permit interzone local untrust direction outbound
 firewall packet-filter default permit interzone local dmz direction outbound
#
 ip df-unreachables enable
#
 firewall ipv6 session link-state check
 firewall ipv6 statistic system enable
#
 dns resolve
#
 firewall statistic system enable
#
 pki ocsp response cache refresh interval 0
 pki ocsp response cache number 0
#
 undo dns proxy
#
 license-server domain lic.huawei.com
#
 web-manager enable
#
policy interzone local untrust inbound
 policy 0 

 policy 1
  action permit
  policy source 202.38.169.1 0
  policy destination 202.38.163.1 0
#
policy interzone trust untrust inbound
 policy 1
  action permit
  policy source 10.1.2.0 0.0.0.255
  policy destination 10.1.1.0 0.0.0.255
#
policy interzone trust untrust outbound
 policy 1
  action permit
#
nat-policy interzone trust untrust outbound
 policy 0
  action no-nat
  policy source 10.1.1.0 0.0.0.255
  policy destination 10.1.2.0 0.0.0.255

 policy 2
  action source-nat
  easy-ip GigabitEthernet0/0/1
#
return
#-----END----#

FW2

# CLI_VERSION=V300R001

# Last configuration was changed at 2020/02/17 14:19:58 from console0
#*****BEGIN****public****#
#
stp region-configuration
 region-name 30eca215b04c
 active region-configuration
#
acl number 3000
 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
ipsec proposal tran1
 esp authentication-algorithm sha1
 esp encryption-algorithm aes
#
ipsec policy map1 10 manual
 security acl 3000
 proposal tran1
 tunnel local 202.38.169.1
 tunnel remote 202.38.163.1
 sa spi inbound esp 12345
 sa string-key inbound esp %$%$zc/wOGx70T.01dE+u2.CtSJA%$%$
 sa spi outbound esp 54321
 sa string-key outbound esp %$%$hGs:[email protected]@gFtri`%$%$
#
interface GigabitEthernet0/0/0
 alias GE0/MGMT
 ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 ip address 202.38.169.1 255.255.255.0
 ipsec policy map1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface NULL0
 alias NULL0
#
firewall zone local
 set priority 100
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#
firewall zone dmz
 set priority 50
#
aaa
 local-user admin password cipher %$%$)`V/Xz‘4Q/O`<1W{:DiOs90‘%$%$
 local-user admin service-type web terminal telnet
 local-user admin level 15
 authentication-scheme default
 #
 authorization-scheme default
 #
 accounting-scheme default
 #
 domain default
 #
#
nqa-jitter tag-version 1

#
 ip route-static 10.1.1.0 255.255.255.0 202.38.169.2
 ip route-static 202.38.163.0 255.255.255.0 202.38.169.2
#
 banner enable
#
user-interface con 0
 authentication-mode none
user-interface vty 0 4
 authentication-mode none
 protocol inbound all
#
 slb
#
right-manager server-group
#
 sysname SRG
#
 l2tp domain suffix-separator @
#
 firewall packet-filter default permit interzone local trust direction inbound
 firewall packet-filter default permit interzone local trust direction outbound
 firewall packet-filter default permit interzone local untrust direction outbound
 firewall packet-filter default permit interzone local dmz direction outbound
#
 ip df-unreachables enable
#
 firewall ipv6 session link-state check
 firewall ipv6 statistic system enable
#
 dns resolve
#
 firewall statistic system enable
#
 pki ocsp response cache refresh interval 0
 pki ocsp response cache number 0
#
 undo dns proxy
#
 license-server domain lic.huawei.com
#
 web-manager enable
#
policy interzone local untrust inbound
 policy 1
  action permit
  policy source 202.38.163.1 0
  policy destination 202.38.169.1 0
#
policy interzone trust untrust inbound
 policy 1
  action permit
  policy source 10.1.1.0 0.0.0.255
  policy destination 10.1.2.0 0.0.0.255
#
policy interzone trust untrust outbound
 policy 1
  action permit
#
nat-policy interzone trust untrust outbound
 policy 1
  action no-nat
  policy source 10.1.2.0 0.0.0.255
  policy destination 10.1.1.0 0.0.0.255

 policy 2
  action source-nat
  easy-ip GigabitEthernet0/0/1
#
return
#-----END----#

AR1


[V200R003C00]
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
 drop illegal-mac alarm
#
 set cpu-usage threshold 80 restore 75
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface Ethernet0/0/0
#
interface Ethernet0/0/1
#
interface Ethernet0/0/2
#
interface Ethernet0/0/3
#
interface Ethernet0/0/4
#
interface Ethernet0/0/5
#
interface Ethernet0/0/6
#
interface Ethernet0/0/7
#
interface GigabitEthernet0/0/0
 ip address 202.38.163.2 255.255.255.0
#
interface GigabitEthernet0/0/1
 ip address 202.38.169.2 255.255.255.0
#
interface NULL0
#
ip route-static 10.1.1.0 255.255.255.0 202.38.163.1
ip route-static 10.1.2.0 255.255.255.0 202.38.169.1
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

原文地址：https://blog.51cto.com/antivirusjo/2471661

时间： 2024-11-08 18:26:56

eNSP模拟器—IPsec配置实验4的相关文章

eNSP模拟器—IPsec配置实验1

1 拓扑图 2 两个PC配置 3 RouterA配置 # sysname RouterA # acl number 3101 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ipsec policy map1

使用华为eNSP模拟器完成FTP实验

华为eNSP模拟器功能强大,使用该模拟器可以进行FTP实验,支持FTP主动.被动模式,搭建实验拓扑,至少包括一个server.一个client,并进行简单的设置,即可实验FTP工作流程:通过该模拟器自带的抓包功能,使用wireshark对server和client 通信报文进行抓取,就可以分析FTP的业务流程,对理解FTP原理大有帮助. 下图为Client侧的FTP配置,需要注意的是,要正确地配置用户名和密码,才能成功登录FTP服务器,用户名为huawei,密码为[email protected

eNSP模拟器中配置Hybrid端口

实现不同vlan间PC不可访问,不同vlan的PC均可访问服务器的效果,具体要求如下 在交换机中创建相关vlan 修改端口模式 修改端口允许通过的数据帧 结果验证,vlan5与vlan10的pc不可互通,但与服务器互通 方案 使用eNSP搭建实验环境 步骤 配置第一台交换机ps:交换机1与pc的接口为0/0/1,与pc的接口为0/0/2,交换机与交换机之间的接口为0/0/3,交换机2与pc3的接口为0/0/1 [SW1]vlan batch 5 10 50 //创建5 10 50的vlan [S

eNSP模拟器拓扑图：浮动路由的实际作用和分析，默认路由的配置，抓包分析

本篇介绍一下浮动路由和默认路由的配置和一些讲解本篇内容附带详细的分析讲解.会敲命令并不代表什么,能敲明白才是关键. 往后的篇章内容 都尽量不写地址配置了,如果地址都还不会配置的话,可以去翻一翻其他博文了解一下 打开ensp模拟器如图所示AR3260路由器三台PC机两台Copper线5根操作步骤:1.规划线路,地址2.配置IP地址3.配置浮动路由,默认路由4.ping通所有设备 具体的地址配置就不详细的一 一列出了,基本的地址配置自己配置好在进入系统模式之前在用户模式下可以试着输入undo ter

用华为eNSP模拟器配置Hybrid、Trunk和Access三种链路类型端口

上一篇文章写到三层交换机实现多个VLAN之间互相通讯,有朋友提问要如何进行配置,可有案例分析.其实那天我在写的时候也有做过模拟,只是后来没有保存.今天重新模拟一次,并附上详细配置命令,希望能够帮助到大家. 首先回忆下VLAN间数据传输的三种端口模式各自代表的含义: Access 类型的端口只能属于1个VLAN,一般用于连接计算机的端口,也可以连接交换机和交换机. Trunk 类型的端口可以允许多个VLAN通过,可以接收和发送多个VLAN的报文,trunk口一般用于连接两台交换机,这样可以只用一条

华为eNSP模拟器下NAT地址转换实验

华为eNSP模拟器下NAT地址转换实验 前言 NAT:网络地址转换 当在专用网内部的一些主机本来已经分配到了本地IP地址(即仅在本专用网内使用的专用地址),但现在又想和因特网上的主机通信(并不需要加密)时,可使用NAT方法. 这种方法需要在专用网连接到因特网的路由器上安装NAT软件.装有NAT软件的路由器叫做NAT路由器,它至少有一个有效的外部全球IP地址.这样,所有使用本地地址的主机在和外界通信时,都要在NAT路由器上将其本地地址转换成全球IP地址,才能和因特网连接. 另外,这种通过使用少量的

华为eNSP模拟器上实现FTP服务

**华为售后认证实验2.1:华为设备热补丁升级(真机) 实验日期:2019-03-22 ** 2.1 实验目标 本实验以AR2220为例,演示华为路由交换设备热补丁升级的一般步骤.完成本实验,你可以: · 使用FTP方式上传补丁文件的方法· 华为设备热补丁在线升级的方法· 恢复设备到安装补丁之前的状态的方法 2.2 组网及业务描述 图 2-1热补丁升级实验拓扑 配置用PC机使用Console线缆连接至路由器,并使用以太网线连接至路由器的GE0/0/2端口,以供上传文件使用.将补丁文件传至路由器,

Win 10 x64 版本安装华为 ENSP 模拟器

1.安装ensp模拟器主程序 去官网下载安装包,链接如下; http://support.huawei.com/enterprise/SoftwareVersionActionNew!showVDetailNew?idAbsPath=fixnode01|7919710|21782036|21782103|21782135|9017384&pid=9017384&vrc=9017411|9169984|21726015&from=soft 下载如下图所示软件; 安装过程这里就不叙述了

routeos ipsec配置

今天实验了半天,把西安-上海 点对点的IPSEC调试完成,最终测试正常.下面是方案 1.拓扑图 我们需要实现172.19.0.0/24--西安路由--219.145.57.220--互联网--116.231.52.80--上海路由–172.18.0.0/16 首先配置西安路由 1.因为LAN口和WAN口都是设置好的,这里就不写了,我们直接进入IPSEC配置 添加加密方式,我这边用的默认的,也可以用MD5来加密 接下来设置对端的连接方式和连接密码 最后我们还需要添加一条NAT,这条NAT需要放在L