02.hcie sec和参考1安全hc高可用

1.

链路冗余主备”/“主主”链路冗余隧道化链路冗余全网状网络2.

设备冗余Copyright

©

2010Technologies

Co.,.s.Page

2链路冗余1.1

“主主”“主备”链路冗余一般情况下，主用IPSec隧道采用以太网链路固定IP接入，备用IPSec隧道采用以太网链路或拨号链路（PPPoE/ADSL/3G）接入均可。主用链路故障时业务倒换到备用链路。1.2

隧道化链路备份（

）将IPSec策略应用到Tunnel接口上，IPSec策略跟具体的物理接口没有绑定关系，从而实现出接口链路的备份。当一条链路出现问题时，可直接路由到其他链路传输。Copyright

©

2010Technologies

Co.,.s.Page

3“主备”链路冗余拓扑和需求（物理口建

）需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个物理接口分别应用不同的IPSec策略需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。Site2192.168.1.0/24Site1Site1G0/0/0Site2G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24IPsec

隧道1G0/0/010.1.1.0/24IPsec隧道2G0/0/1203.100.1.0/24

G0/0/2203.100.2.0/24Copyright

©

2010Technologies

Co.,.s.Page

4“主备”链路冗余拓扑和需求（物理口建

）需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A和网关B分别通过静态路由或者动态路由，以及IP-Link引导流量。Site2192.168.1.0/24Site1Site1G0/0/0Site2G0/0/1202.101.1.0/24IPsec

隧道1G0/0/010.1.1.0/24G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24G0/0/2IPsec隧道2Copyright

©

2010Technologies

Co.,.s.Page

5“主主”链路冗余拓扑和需求（物理口建

）需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个物理接口分别应用不同的IPSec策略需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A和网关B分别通过静态路由或者动态路由，以及IP-Link引导流量。Site2192.168.1.0/24Site1Site1G0/0/0Site2G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24IPsec

隧道1G0/0/010.1.1.0/24IPsec隧道2G0/0/1203.100.1.0/24

G0/0/2203.100.2.0/24Copyright

©

2010Technologies

Co.,.s.Page

6“主主”

链路冗余拓扑和需求（物理口建

）需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。Site2192.168.1.0/24Site1Site1G0/0/0Site2G0/0/1202.101.1.0/24IPsec

隧道1G0/0/010.1.1.0/24G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24G0/0/2IPsec隧道2Copyright

©

2010Technologies

Co.,.s.Page

7“主主/主备”链路冗余拓扑（Loopback口建

）需求1：Site

1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A和网关B

Loopback接口分别应用IPSec策略。配置：Loopback接口要配置公网地址。需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：Loopback接口地址发布到两个出口ISP中，并通过静态路由或者动态路由，以及IP-Link引导流量。Site210.1.1.0/24G0/0/1192.168.1.0/24Site1G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24202.101.1.0/24IPsec隧道1G0/0/0Loopback接口Site1G0/0/0Loopback接口Site2Copyright

©

2010Technologies

Co.,.s.Page

8Case

Study

1：主备链路冗余拓扑和需求需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。Site2192.168.1.0/24Site1.1Site1G0/0/0.254Site2.1

202.100.1.0/24G0/0/2

.254202.101.1.0/24IPsec隧道1G0/0/0.254

.110.1.1.0/24G0/0/1

.254G0/0/1.1

202.100.2.0/24G0/0/2G0/0/0

G0/0/1.254

.1IPsec隧道2Copyright

©

2010Technologies

Co.,.s.Page

9基本网络配置(路由器)sysname

Site1-Server#interface

GigabitEthernet

0/0/0ip

address

192.168.1.1255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0192.168.1.254sysname

Internet#interface

GigabitEthernet

0/0/0ip

address

202.101.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ipaddress

202.100.1.254255.255.255.0#interface

GigabitEthernet

0/0/2ip

address

202.100.2.254

255.255.255.0sysname

Site2-Server#interface

GigabitEthernet

0/0/0ip

address

10.1.1.1

255.255.255.0#iproute-static

0.0.0.0

0.0.0.010.1.1.254Copyright

©

2010Technologies

Co.,.s.Page

10基本网络配置()sysname

Site1#interface

GigabitEthernet

0/0/0ip

address

192.168.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ip

address

202.100.1.1

255.255.255.0#interface

GigabitEthernet

0/0/2ip

address

202.100.2.1

255.255.255.0#firewall

zone

untrustadd

interface

GigabitEthernet0/0/1add

interface

GigabitEthernet0/0/2sysname

Site2#interface

GigabitEthernet

0/0/0ip

address

10.1.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ip

address

202.101.1.1

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0

202.101.1.254#firewall

zone

untrustadd

interfaceGigabitEthernet0/0/1Copyright

©

2010Technologies

Co.,.s.Page

11Site1配置双链路的IP-Link和相关路由ip-link check

enableip-link

1

destination

202.101.1.1

interface

g0/0/1

mode

icmpnext-hop

202.100.1.1#ip

route-static

0.0.0.0

0.0.0.0

202.100.1.254

preference

10track

ip-link

1ip

route-static

0.0.0.0

0.0.0.0

202.100.2.254

preference

20Copyright

©

2010Technologies

Co.,.s.Page

12Site1配置域间策略放行相关加密流量security-policyrule

namepolicy_ipsec_1source-zone

trustdestination-zone

untrustsource-address

192.168.1.0

24destination-address

10.1.1.0

24action

permitrule

namepolicy_ipsec_2source-zone

untrustdestination-zone

trustsource-address

10.1.1.0

24destination-address

192.168.1.0

24action

permitCopyright

©

2010Technologies

Co.,.s.Page

13Site1配置域间策略放行相关IKE流量rule

namepolicy_ipsec_3source-zone

localdestination-zone

untrustsource-address

202.100.1.1

32source-address

202.100.2.1

32destination-address

202.101.1.1

32action

permitrule

namepolicy_ipsec_4source-zone

untrustdestination-zone

localsource-address

202.101.1.1

32destination-address

202.100.1.1

32destination-address

202.100.2.1

32action

permitCopyright

©

2010Technologies

Co.,.s.Page

14Site1配置ACL定义需要保护的流量#acl

number

3000rule

5

permit

ip

source

192.168.1.0

0.0.0.255

destination

10.1.1.00.0.0.255#acl

number

3001rule

5

permit

ip

source

192.168.1.0

0.0.0.255

destination

10.1.1.00.0.0.255Copyright

©

2010Technologies

Co.,.s.Page

15Site1配置

安全提议ike

proposal

10authentication-method

pre-shareauthentication-algorithm

sha1#ipsec

proposal

trans1esp

authentication-algorithm

sha1esp

encryption-algorithm

aesencapsulation-mode

tunnelCopyright

©

2010Technologies

Co.,.s.Page

16Site1配置IKE

Peerike

peer

site2pre-shared-key

Key123ike-proposal

10undo

version

2remote-address

202.101.1.1Copyright

©

2010Technologies

Co.,.s.Page

17Site1配置IPsec安全策略组ipsec

policy

map1

10

isakmpsecurity

acl

3000ike-peer

site2proposal

trans1#ipsec

policy

map2

10

isakmpsecurity

acl

3001ike-peer

site2proposal

trans1Copyright

©

2010Technologies

Co.,.s.Page

18Site1接口调用相关安全策略组interface

GigabitEthernet0/0/1ipsec

policy

map1

auto-neg#interface

GigabitEthernet0/0/2ipsec

policy

map2

auto-negCopyright

©

2010Technologies

Co.,.s.Page

19Site2配置两个Tunnel接口用于建立interface

Tunnel1ip

address

unnumbered

interface

GigabitEthernet0/0/1tunnel-protocol

ipsec#interface

Tunnel2ip

address

unnumbered

interface

GigabitEthernet0/0/1tunnel-protocolipsec#firewall

zone

untrustadd

interface

Tunnel1add

interface

Tunnel2Copyright

©

2010Technologies

Co.,.s.Page

20Site2配置域间策略放行相关加密流量security-policyrule

namepolicy_ipsec_1source-zone

trustdestination-zone

untrustsource-address

10.1.1.0

24destination-address

192.168.1.0

24action

permitrule

namepolicy_ipsec_2source-zone

untrustdestination-zone

trustsource-address

192.168.1.0

24destination-address

10.1.1.0

24action

permitCopyright

©

2010Technologies

Co.,.s.Page

21Site2配置域间策略放行相关IKE流量rule

namepolicy_ipsec_3source-zone

localdestination-zone

untrustsource-address

202.101.1.1

32destination-address

202.100.1.1

32destination-address

202.100.2.1

32action

permitrule

namepolicy_ipsec_4source-zone

untrustdestination-zone

localsource-address

202.100.1.1

32source-address

202.100.2.1

32destination-address

202.101.1.1

32action

permitCopyright

©

2010Technologies

Co.,.s.Page

22Site2配置双链路的IP-Link和相关路由ip-link check

enableip-link

1

destination

202.100.1.1

interface

g0/0/1

mode

icmpnext-hop

202.101.1.1#ip

route-static

192.168.1.0

255.255.255.0

Tunnel

1

preference10

track

ip-link

1ip

route-static

192.168.1.0

255.255.255.0

Tunnel

2preference

20Copyright

©

2010Technologies

Co.,.s.Page

23Site2配置ACL定义需要保护的流量#acl

number

3000rule

permit

ip

source

10.1.1.0

0.0.0.255

destination

192.168.1.00.0.0.255#acl

number

3001rule

permit

ip

source

10.1.1.0

0.0.0.255

destination

192.168.1.00.0.0.255Copyright

©

2010Technologies

Co.,.s.Page

24Site2配置

安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithm

sha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelCopyright

©

2010Technologies

Co.,.s.Page

25Site2配置IKE

Peerike

peer

site1apre-shared-key

Key123ike-proposal

10undo

version

2remote-address

202.100.1.1#ike

peer

site1bpre-shared-key

Key123ike-proposal

10undo

version

2remote-address

202.100.2.1Copyright

©

2010Technologies

Co.,.s.Page

26Site2配置IPsec安全策略组ipsec

policy

map1

10

isakmpsecurity

acl

3000ike-peer

site1aproposal

trans1#ipsec

policy

map2

10

isakmpsecurity

acl

3001ike-peer

site1bproposal

trans1Copyright

©

2010Technologies

Co.,.s.Page

27Site2接口调用相关安全策略组interface

Tunnel

1ipsec

policy

map1#interface

Tunnel

2ipsec

policy

map2Copyright

©

2010Technologies

Co.,.s.Page

281.

链路冗余主备”/“主主”链路冗余隧道化链路冗余全网状网络2.

设备冗余Copyright

©

2010Technologies

Co.,.s.Page

29“主主/主备”链路冗余拓扑（隧道化）需求1：Site

1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A使用Tunnel隧道化技术建立一个

隧道。网关B使用物理接口建立一个

隧道。需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。IPSec隧道不需要进行重协商，故可快速完成流量切换。配置：通过静态路由或者动态路由，以及IP-Link引导流量至Tunnel隧道接口。Site210.1.1.0/24G0/0/1192.168.1.0/24Site1G0/0/1202.100.1.0/24G0/0/2202.100.2.0/24202.101.1.0/24IPsec

隧道1G0/0/0Tunnel接口Site1G0/0/0G0/0/1接口Site2Copyright

©

2010Technologies

Co.,.s.Page

30Case

Study

2：隧道化链路备份拓扑和需求需求1：Site1有两个出口接入不同的ISP中，Site

2只有一个出口之间配置：网关A的tunnel接口应用IPSec策略。（隧道化）网关B的物理接口应用IPSec策略。。需求2：通过Site

1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A通过静态路由或者动态路由，以及IP-Link引导流量。Site2G0/0/1.1G0/0/1Site1G0/0/0.1

.254192.168.1.0/24.1

202.100.1.0/24.254G0/0/2.1

202.100.2.0/24.254202.101.1.0/24G0/0/0.254

.110.1.1.0/24G0/0/1G0/0/2G0/0/0.254IPsec

隧道Tunnel接口Copyright

©

2010Technologies

Co.,.s.Page

31Site1G0/0/1接口Site2基本网络配置(路由器)sysname

Site1-Server#interface

GigabitEthernet

0/0/0ip

address

192.168.1.1255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0192.168.1.254sysname

Internet#interface

GigabitEthernet

0/0/0ip

address

202.101.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ipaddress

202.100.1.254255.255.255.0#interface

GigabitEthernet

0/0/2ip

address

202.100.2.254

255.255.255.0sysname

Site2-Server#interface

GigabitEthernet

0/0/0ip

address

10.1.1.1

255.255.255.0#iproute-static

0.0.0.0

0.0.0.010.1.1.254Copyright

©

2010Technologies

Co.,.s.Page

32基本网络配置()sysname

Site1#interface

GigabitEthernet

0/0/0ip

address

192.168.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ip

address

202.100.1.1

255.255.255.0#interface

GigabitEthernet

0/0/2ip

address

202.100.2.1

255.255.255.0#firewall

zone

untrustadd

interface

GigabitEthernet0/0/1add

interface

GigabitEthernet0/0/2sysname

Site2#interface

GigabitEthernet

0/0/0ip

address

10.1.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ip

address

202.101.1.1

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0

202.101.1.254#firewall

zone

untrustadd

interfaceGigabitEthernet0/0/1Copyright

©

2010Technologies

Co.,.s.Page

33Site1配置Tunnel接口用于建立interface

Tunnel1ip

address

1.1.1.1

24tunnel-protocol

ipsec#firewall

zone

untrustadd

interface

Tunnel1Copyright

©

2010Technologies

Co.,.s.Page

34Site1配置双链路的IP-Link和相关路由ip-link checkenableip-link1destination202.101.1.1interfaceg0/0/1modeicmpnext-hop202.100.1.1#ip

route-static

202.101.1.1

255.255.255.255

202.100.1.254preference10trackip-link1iproute-static202.101.1.1255.255.255.255202.100.2.254preference20ip

route-static

10.1.1.0

255.255.255.0

tunnel

1Copyright

©

2010Technologies

Co.,.s.Page

35Site1配置域间策略放行相关加密流量security-policyrule

namepolicy_ipsec_1source-zone

trustdestination-zone

untrustsource-address

192.168.1.0

24destination-address

10.1.1.0

24action

permitrule

namepolicy_ipsec_2source-zone

untrustdestination-zone

trustsource-address

10.1.1.0

24destination-address

192.168.1.0

24action

permitCopyright

©

2010Technologies

Co.,.s.Page

36Site1配置域间策略放行相关IKE流量rule

namepolicy_ipsec_3source-zone

localdestination-zone

untrustsource-address

202.100.1.1

32source-address

202.100.2.1

32source-address

1.1.1.1

32destination-address

202.101.1.1

32action

permitrule

namepolicy_ipsec_4source-zone

untrustdestination-zone

localsource-address

202.101.1.1

32destination-address

202.100.1.1

32destination-address

202.100.2.1

32destination-address

1.1.1.1

32action

permitCopyright

©

2010Technologies

Co.,.s.Page

37Site1配置ACL定义需要保护的流量#acl

number

3000rule

5

permit

ip

source

192.168.1.0

0.0.0.255

destination

10.1.1.00.0.0.255#acl

number

3001rule

5

permit

ip

source

192.168.1.0

0.0.0.255

destination

10.1.1.00.0.0.255Copyright

©

2010Technologies

Co.,.s.Page

38Site1配置

安全提议ike

proposal

10authentication-method

pre-shareauthentication-algorithm

sha1#ipsec

proposal

trans1esp

authentication-algorithm

sha1esp

encryption-algorithm

aesencapsulation-mode

tunnelCopyright

©

2010Technologies

Co.,.s.Page

39Site1配置IKE

Peerike

peer

site2pre-shared-key

Key123ike-proposal

10undo

version

2remote-address

202.101.1.1Copyright

©

2010Technologies

Co.,.s.Page

40Site1配置IPsec安全策略组ipsec

policy

map1

10

isakmpsecurity

acl

3000ike-peer

site2proposal

trans1Copyright

©

2010Technologies

Co.,.s.Page

41Site1接口调用相关安全策略组interface

Tunnel1ipsec

policy

map1

auto-neg#Copyright

©

2010Technologies

Co.,.s.Page

42Site2配置域间策略放行相关加密流量security-policyrule

namepolicy_ipsec_1source-zone

trustdestination-zone

untrustsource-address

10.1.1.0

24destination-address

192.168.1.0

24action

permitrule

namepolicy_ipsec_2source-zone

untrustdestination-zone

trustsource-address

192.168.1.0

24destination-address

10.1.1.0

24action

permitCopyright

©

2010Technologies

Co.,.s.Page

43Site2配置域间策略放行相关IKE流量rule

namepolicy_ipsec_3source-zone

localdestination-zone

untrustsource-address

202.101.1.1

32destination-address

202.100.1.1

32destination-address

202.100.2.1

32action

permitrule

namepolicy_ipsec_4source-zone

untrustdestination-zone

localsource-address

202.100.1.1

32source-address

202.100.2.1

32destination-address

202.101.1.1

32action

permitCopyright

©

2010Technologies

Co.,.s.Page

44Site2配置ACL定义需要保护的流量#acl

number

3000rule

permit

ip

source

10.1.1.0

0.0.0.255

destination

192.168.1.00.0.0.255#acl

number

3001rule

permit

ip

source

10.1.1.0

0.0.0.255

destination

192.168.1.00.0.0.255Copyright

©

2010Technologies

Co.,.s.Page

45Site2配置

安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithm

sha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelCopyright

©

2010Technologies

Co.,.s.Page

46Site2配置IKE

Peerike

peer

site1apre-shared-key

Key123ike-proposal

10undo

version

2remote-address

1.1.1.1Copyright

©

2010Technologies

Co.,.s.Page

47Site2配置IPsec安全策略组ipsec

policy

map1

10

isakmpsecurity

acl

3000ike-peer

site1aproposal

trans1Copyright

©

2010Technologies

Co.,.s.Page

48Site2接口调用相关安全策略组interface

GigabitEthernet

0/0/1ipsec

policy

map1#Copyright

©

2010Technologies

Co.,.s.Page

491.

链路冗余主备”/“主主”链路冗余隧道化链路冗余全网状网络2.

设备冗余Copyright

©

2010Technologies

Co.,.s.Page

50全网状网络，当网络中的所有节点之间都需要通信或者通信流量较大时，可采用网状结构建立

。所有节点都可以自行上网，任何节点Down掉都不影响其它节点。这种网络结构适用于同等重要的多个节点之间的

互联。Site2Site1Site1G0/0/0G0/0/1202.100.1.0/24IPsec隧道1Site2G0/0/010.1.1.0/24192.168.1.0/24G0/0/1接口Site3Site310.1.2.0/24G0/0/1接口G0/0/1

G0/0/1接口G0/0/1接口202.102.1.0/24G0/0/1接口G0/0/1202.101.1.0/24G0/0/1接口Copyright

©

2010Technologies

Co.,.s.Page

51Case

Study：全网状网络配置（Site1配置）ikepeer

bexchange-mode

autopre-shared-key

%$%$c([VET@941t/q_4tS-f7,ri/%$%$ike-proposal

1remote-id-type

ip

202.38.169.1remote-address

202.38.169.1#ike

peer

cexchange-mode

autopre-shared-key

%$%$c([VET@941t/q_4tS-f7,ri/%$%$ike-proposal

2remote-id-type

ip

202.38.170.1remote-address

202.38.170.1#ipsec

proposal

bencapsulation-mode

auto#ipsec

proposal

cencapsulation-mode

auto#ipsecpolicymap1 1isakmpsecurity

acl

3000ike-peerbaliaspolicy1proposalblocal-address202.38.163.1ipsec

policy

map1

2

isakmpsecurityacl3001ike-peericaliaspolicy2proposal

clocal-address202.38.163.1interfaceGigabitEthernet0/0/1ipsecpolicymap1Site1网关关键配置和其他Site安全网关配置类似Copyright

©

2010Technologies

Co.,.s.Page

521.

链路冗余设备冗余IPSec网关主备备份Copyright

©

2010Technologies

Co.,.s.Page

53设备冗余主备设备冗余IPSec

网关采用主备备份机制，当一台设备出现故障时，业务可以平滑的切换到备用设备上。Copyright

©

2010Technologies

Co.,.s.Page

54IPSec网关主备备份需求：Site

1有两个Gateway，两个Gateway分别有一个公网出口接入相同的ISP中，Site

2只有一个公网出口。通过Site

1上的设备发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：Site2网关和Site1虚拟地址建立IPsec隧道配置：Gateway1和Gateway2启用HA功能，对内网侧和

侧分别并生成一个虚拟地址，

侧的虚拟地址占用一个公网地址。分部10.6.1.0/24Gi0/0/1.1

.10.6.100Site2.254

.2Gi0/0/2.5.254202.10.1.0/24IPsec隧道Gateway

1Gi1/0/1

.310.100.10.0/24

Gi1/0/1

.2Gi0/0/0Gi0/0/2202.38.10.0/24.3Gi0/0/3.4Gi0/0/3Gateway

2.1.1总部

10.2.2.0/24Copyright

©

2010Technologies

Co.,.s.Page

55基本网络配置(路由器)sysname

Site1-Server#interface

GigabitEthernet

0/0/0ip

address

10.100.10.100255.255.255.0#ip

route-static

0.0.0.0

0.0.0.010.100.10.1sysname

Internet#interface

GigabitEthernet

0/0/0ip

address

202.10.1.254

255.255.255.0#interface

GigabitEthernet

0/0/1ip

address

202.38.10.254255.255.255.0#sysname

Site2-Server#interface

GigabitEthernet

0/0/0ip

address

10.6.1.100

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.010.6.1.1Copyright

©

2010Technologies

Co.,.s.Page

56基本网络配置(-Site1)sysname

Gateway1#firewall

zone

trustadd

interface

GigabitEthernet1/0/3#firewall

zone

untrustadd

interface

GigabitEthernet1/0/2#firewall

zone

dmzadd

interface

GigabitEthernet1/0/1#interface

GigabitEthernet

1/0/1ip

address

10.2.2.2

255.255.255.0#interface

GigabitEthernet

1/0/2ip

address

202.38.10.6

255.255.255.0#interface

GigabitEthernet

1/0/3ip

address

10.100.10.3

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0

202.38.10.254sysname

Gateway2#firewall

zone

trustadd

interface

GigabitEthernet1/0/3#firewall

zone

untrustadd

interface

GigabitEthernet1/0/2#firewall

zone

dmzadd

interface

GigabitEthernet1/0/1#interface

GigabitEthernet

1/0/1ip

address

10.2.2.3

255.255.255.0#interface

GigabitEthernet

1/0/2ip

address

202.38.10.5

255.255.255.0#interface

GigabitEthernet

1/0/3ip

address

10.100.10.4

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0

202.38.10.254Copyright

©

2010Technologies

Co.,.s.Page

57基本网络配置(-Site2)sysname

Site2#firewall

zone

trustadd

interface

GigabitEthernet1/0/3#firewall

zone

untrustadd

interface

GigabitEthernet1/0/1#interface

GigabitEthernet

1/0/3ip

address

10.6.1.1

255.255.255.0#interface

GigabitEthernet

1/0/1ip

address

202.10.1.2

255.255.255.0#ip

route-static

0.0.0.0

0.0.0.0

202.10.1.254Copyright

©

2010Technologies

Co.,.s.Page

58Site1(Gateway1)配置域间策略放行相关加密流量security-policyrule

namepolicy_ipsec_2source-zone

trustdestination-zone

untrustsource-address

10.100.10.0

24destination-address

10.6.1.024action

permitrule

namepolicy_ipsec_3source-zone

untrustdestination-zone

trustsource-address

10.6.1.0

24destination-address

10.100.10.0

24action

permitCopyright

©

2010Technologies

Co.,.s.Page

59Site1(Gateway1)配置域间策略放行相关IKE流量security-policyrule

name

policy_ipsec_1source-zone

localsource-zone

dmzdestination-zone

localdestination-zone

dmzaction

permitrule

name

policy_ipsec_4source-zone

untrustdestination-zone

localsource-address

202.10.1.2

32destination-address

202.38.10.0

24action

permitrule

name

policy_ipsec_5source-zone

localdestination-zone

untrustsource-address

202.38.10.0

24destination-address

202.10.1.2

32action

permitCopyright

©

2010Technologies

Co.,.s.Page

60Site1配置ACL定义需要保护的流量Gateway1：acl

3003rule

permit

ip

source

10.100.10.0

0.0.0.255

destination

10.6.1.00.0.0.255Gateway2：acl

3003rule

permit

ip

source

10.100.10.0

0.0.0.255

destination

10.6.1.00.0.0.255Copyright

©

2010Technologies

Co.,.s.Page

61Site1(Gateway1)配置

安全提议ike

proposal

10authentication-method

pre-shareauthentication-algorithm

sha1#ipsec

proposal

trans1esp

authentication-algorithm

sha1esp

encryption-algorithm

aesencapsulation-mode

tunnelCopyright

©

2010Technologies

Co.,.s.Page

62Site1(Gateway1)配置IKE

Peerike

peer

site2pre-shared-key

Key123ike-proposal

10undo

version

2remote-address

202.101.1.1Copyright

©

2010Technologies

Co.,.s.Page

63Site1(Gateway1)配置IPsec安全策略组ipsec

policy

map1

10

isakmpsecurity

acl

3000ike-peer

site2proposal

trans1Copyright

©

2010Technologies

Co.,.s.Page

64HA配置(

-Site1)Gateway1:#hrp

enablehrp

interface

GigabitEthernet

1/0/1#interface

GigabitEthernet

1/0/2ip

address

202.38.10.6

255.255.255.0vrrp

vrid

2

virtual-ip

202.38.10.1

24

activeipsec

policy

map1

auto-neg#interface

GigabitEthernet

1/0/3ip

address

10.100.10.3

255.255.255.0vrrp

vrid

1

virtual-ip

10.100.10.2

24

activeGateway2:#hrp

enablehrp

interface

GigabitEthernet

1/0/1#interface

GigabitEthernet

1/0/2ip

address

202.38.10.5

255.255.255.0vrrp

vrid

2

virtual-ip

202.38.10.1

24standbyipsec

policy

map1

auto-neg#interface

GigabitEthernet

1/0/3ip

address

10.100.10.4

255.255.255.0vrrp

vrid

1

virtual-ip

10.100.10.2

24