H3C-MSR路由器配置

配置配置 telnet 登录登录 telnet server enable 创建本地账号与密码 local user admin password simple hnjb8013 user interface vty 0 4 authentication mode schema user role level 15 配置配置 WAN 口地址口地址 system view H3C interface GigabitEthernet 0 0 H3C GigabitEthernet0 0 ip address 119 57 73 67 255 255 255 248 IP 地址 和掩码配置运营商分配的地址 H3C GigabitEthernet0 0 quit 2 设置内网网关 H3C interface GigabitEthernet 0 1 H3C GigabitEthernet0 1 ip address 192 168 1 1 24 内网网关 IP 地址 H3C GigabitEthernet0 1 quit 设置 DHCP system view H3C dhcp server ip pool 1 H3C dhcp pool 1 network 192 168 1 0 mask 255 255 255 0 H3C dhcp pool 1 gateway list 192 168 1 1 H3C dhcp pool 1 address range 192 168 1 2 192 168 1 200 地址池 H3C dhcp pool 1 dns list 202 106 0 20 114 114 114 114 具体的运营商 DNS 地址 H3C dhcp pool 1 quit 4 在 WAN 接口配置 NAT 实现内网地址上网进行源地址转换 H3C interface GigabitEthernet 0 0 H3C GigabitEthernet0 0 nat outbound 5 配置默认路由 H3C ip route static 0 0 0 0 0 0 0 0 119 57 73 65 下一跳地址配置运营商分配的 网关地址 Nat 一对一一对一 NAT system view H3C nat static outbound 192 168 1 248 119 57 73 70 H3C interface GigabitEthernet0 0 H3C GigabitEthernet0 0 ip address 119 57 73 70 255 255 255 248 sub H3C GigabitEthernet0 0 nat static enable H3C GigabitEthernet0 0 quit NAT 端口映射端口映射 system view H3C interface GigabitEthernet 0 0 进入设备公网接口 H3C GigabitEthernet0 0 nat server protocol tcp global 119 57 73 67 5366 inside 192 168 1 67 5366 nat server protocol tcp global 119 57 73 67 5367 inside 192 168 1 67 5367 nat server protocol tcp global 119 57 73 67 8081 inside 192 168 1 244 8081 nat server protocol tcp global 119 57 73 67 8123 inside 192 168 1 250 8443 nat server protocol tcp global 119 57 73 67 33890 inside 192 168 1 88 3389 L2TP over ipsec 1 开启 L2TP 功能 system view H3C l2tp enable 2 配置本地用户名和密码 可配置多个用户 H3C local user hnjb class network 配置拨号用户名 New local user added H3C luser network hnjb password simple hnjb8013 配置拨号密码 H3C luser network hnjb service type ppp H3C luser network hnjb quit 3 配置用户认证方式和 IP 地址池 H3C domain system H3C isp system authentication ppp local 配置 PPP 用户的认证方式为本地认证 H3C isp system quit H3C ip pool 10 10 1 1 10 10 1 1 100 配置为拨入终端分配的 IP 地址范围 4 创建虚拟模板接口 H3C interface Virtual Template0 H3C Virtual Template0 ppp authentication mode chap 配置本端 PPP 协议对终 端的验证方式为 CHAP H3C Virtual Template0 remote address pool 10 在虚模板视图下指定为用户分 配 IP 的地址池 H3C Virtual Template0 ip address 10 1 1 1 24 H3C Virtual Template0 ppp ipcp dns 219 141 140 10 114 114 114 114 配 置 DNS H3C Virtual Template0 quit 5 创建并配置 L2TP 组 H3C l2tp group 1 mode lns H3C l2tp1 undo tunnel authentication 取消 L2TP 隧道验证功能 因为很多终端 系统不支持隧道验证功能 H3C l2tp1 allow l2tp virtual template 0 H3C l2tp1 quit 配置 IPsec 功能 A 创建并进入一个 IKE keychain 视图 该视图用于配置 IKE 对等体的密钥信息 H3C ike keychain keychain1 H3C ike keychain keychain1 pre shared key address 0 0 0 0 0 0 0 0 key simple hnjb2017 配置预共享密钥 123456 H3C ike keychain keychain1 quit 配置 IKE 对等体 H3C ike profile profile1 H3C ike profile profile1 keychain keychain1 H3C ike profile profile1 local identity address 119 57 73 67 指定标识本端身 份的 IP 地址 H3C ike profile profile1 match remote identity address 0 0 0 0 0 0 0 0 指定 对端身份 FQDN 名称 H3C ike profile profile1 proposal 1 2 3 4 5 6 H3C ike profile profile1 quit 配置 IPsec 安全提议 H3C ipsec transform set tran1 H3C ipsec transform set tran1 esp encryption algorithm des cbc H3C ipsec transform set tran1 esp authentication algorithm md5 H3C ipsec transform set tran1 quit 配置 IPSec 安全策略模板 H3C ipsec policy template msr 1 H3C ipsec policy template msr 1 ike profile profile1 引用之前配置的 IKE 对 等体 H3C ipsec policy template msr 1 transform set 1 2 3 4 5 6 引用之前配置的 IPsec 安全提议 H3C ipsec policy template msr 1 quit 创建 IPSec 安全策略并引用安全策略模板 H3C ipsec policy 123 1 isakmp template msr 在公网接口上应用 IPsec 安全策略 H3C interface GigabitEthernet 0 0 H3C GigabitEthernet0 0 ipsec apply policy 123 ike proposal 1 encryption algorithm aes cbc 128 dh group2 authentication algorithm md5 ike proposal 2 encryption algorithm 3des cbc dh group2 authentication algorithm md5 ike proposal 3 encryption algorithm 3des cbc dh group2 ike proposal 4 encryption algorithm aes cbc 256 dh group2 ike proposal 5 dh group2 ike proposal 6 encryption algorithm aes cbc 192 dh group2 ipsec transform set 1 encapsulation mode transport esp encryption algorithm 3des cbc esp authentication algorithm md5 ipsec transform set 2 encapsulation mode transport esp encryption algorithm aes cbc 128 esp authentication algorithm sha1 ipsec transform set 3 encapsulation mode transport esp encryption algorithm aes cbc 256 esp authentication algorithm sha1 ipsec transform set 4 encapsulation mode transport esp encryption algorithm des cbc esp authentication algorithm sha1