多厂商系列之十五usg防火墙实现ipsec的实验模拟器可做

系列之十五：USG实现interfaceipaddress220.163.100.1255.255.255.0interfaceipaddress220.163.200.1255.255.255.0interfaceipaddress192.168.10.1255.255.255.0interfaceipaddress220.163.100.2firewallzonetrustfirewallzoneaddinterfacefirewallpacket-filterdefaultpermitiproute-static0.0.0.00.0.0.0aclnumber3000rule5permitipsource192.168.10.00.0.0.255destination192.168.20.0ipsecproposaltran1espencryption-algorithmaesikeproposalauthentication-algorithmsha1ikepeercike-proposalremote-address9、配置IPSec安全策略。ipsecmap110isakmpsecurityacl3000ike-peerc10、在接口GigabitEthernet0/0/1IPSecmap1。interfaceGigabitEthernet0/0/1ipaddress220.163.100.2ipsecIPSecnat-interzonetrustuntrustoutbound1actionno-source192.168.10.00.0.0.255destination192.168.20.00.0.0.2552actionsource-easy-ipinterfaceipaddress192.168.20.1255.255.255.0interfaceipaddress220.163.200.2firewallzonetrustfirewallzoneaddinterfacefirewallpacket-filterdefaultpermitiproute-static0.0.0.00.0.0.0aclnumber3000rule5permitipsource192.168.20.00.0.0.255destination192.168.10.0ipsecproposaltran1espencryption-algorithmaesikeproposalauthentication-algorithmsha1ikepeercike-proposalremote-address9、配置IPSec安全策略。ipsecmap110isakmpsecurityacl3000ike-peerc10、在接口GigabitEthernet0/0/1IPSecmap1。interfaceGigabitEthernet0/0/1ipaddress220.163.200.2ipsecIPSecnat-interzonetrustuntrustoutbound1actionno-source192.168.20.00.0.0.255destination192.168.10.00.0.0.2552actionsource-easy-ip<FW1>disikesa23:30:222014/03/19currentikesanumber: v2:2 v2:1flag ST--STAYALIVERL--RE TO--TIMEOUTTD--DELETING NEG--NEGOTIATINGD--DPD<FW2>disikesa23:31:102014/03/19currentikesanumber: v2:2 v2:1flag ST--STAYALIVERL--RE TO--TIMEOUTTD-- NEG--NEGOTIATINGD—3、FW1IPSECSA<FW1>disipsecsa23:33:032014/03/19pathMTU:1500IPsecname:"map1"sequencenumber:10mode:isakmp:connectionid:rulenumber:5encapsulationmode:tunnelholdingtime:0d0h23m33stunnellocal:220.163.100.2 source:192.168.10.0-192.168.10.2550-655350flowdestination:192.168.20.0-192.168.20.2550-65535[inboundESP :publicsaid:0cpuid:proposal:ESP-ENCRYPT-AESESP-AUTH-saremainingkeyduration(bytes/sec): maxreceivedsequence-number:2659udpencapsulationusedfornattraversal:N[outboundESPSAs] :publicsaid:1cpuid:proposal:ESP-ENCRYPT-AESESP-AUTH-saremainingkeyduration(bytes/sec): maxsentsequence-number:2661udpencapsulationusedfornattraversal:4、FW2IPSECSA<FW2>disipsecsa23:34:062014/03/19pathMTU:1500IPsecname:"map1"sequencenumber:10mode:isakmp:connectionid:rulenumber:5encapsulationmode:tunnelholdingtime:0d0h24m36stunnellocal:220.163.200.2 source:192.168.20.0-192.168.20.2550-655350flowdestination:192.168.10.0-192.168.10.2550-65535[inboundESP :publicsaid:0cpuid:proposal:ESP-ENCRYPT-AESESP-AUTH-saremainingkeyduration(bytes/sec): maxreceivedsequence-number:2780udpencapsulationusedfornattraversal:N[outboundESPSAs] :publicsaid:1cpuid:proposal:ESP-ENCRYPT-AESESP-AUTH-saremainingkeyduration(bytes/sec): maxsentsequence-number:2780udpencapsulationusedfornattraversal:5、二台PC的互的情况PC>192.168.20.20:32databytes,PressCtrl_CtobreakFrom192.168.20.20:bytes=32seq=1ttl=126time=31msFrom192.168.20.20:bytes=32seq=2ttl=126time=31msFrom192.168.20.20:bytes=32seq=3ttl=126time=32msFrom192.168.20.20:bytes=32seq=4ttl=126time=78msFrom192.168.20.20:bytes=32seq=5ttl=126time=94---192.168.20.20statistics---5packet(s)transmitted5packet(s)0.00%packetround-tripmin/avg/max=31/53/94PC>192.168.10.10:32databytes,PressCtrl_CtobreakFrom192.168.10.10:bytes=32seq=1ttl=126time=32msFrom192.168.10.10:bytes=32seq=2ttl=126time=62msFrom192.168.10.10:bytes=32seq=3ttl=126time=63msFrom1