拓展任务9-1 以手工方式协商IPSec VPN实现私网之间的隧道互访

手工从而实现总部和分支机构局域网之间安全互访。图9-1手工方式协商的点到点IPSec隧道组网示意【配置思路】防火墙A和防火墙B的配置思路相同。（1）配置接口IP地址、安全区域及路由，完成网络基本参数的配置。（2）配置安全策略，允许IPSec协商报文交互，以及允许私网指定网段进行报文交互。（3）定义被IPSec保护的数据流。（4）配置IKE安全提议的协商参数。（5）配置IKE对等体。（6）配置IPSec安全提议的协商参数。（7）配置IPSec安全策略。（8）在接口上引用IPSec安全策略。（9）验证和调试，检查能否满足任务需求。【配置步骤】配置防火墙A的网络基本参数（1）配置接口IP地址<FW_A>system-view[FW_A]interfaceGigabitEthernet1/0/1[FW_A-GigabitEthernet1/0/1]ipaddress1.1.1.124[FW_A-GigabitEthernet1/0/1]quit[FW_A]interfaceGigabitEthernet1/0/2[FW_A-GigabitEthernet1/0/2]ipaddress10.1.1.124[FW_A-GigabitEthernet1/0/2]quit（2）将接口加入安全区域[FW_A]firewallzonetrust[FW_A-zone-trust]addinterfaceGigabitEthernet1/0/2[FW_A-zone-trust]quit[FW_A]firewallzoneuntrust[FW_A-zone-untrust]addinterfaceGigabitEthernet1/0/1[FW_A-zone-untrust]quit（3）配置到达分支机构局域网和隧道对端的路由[FW_A]iproute-static10.1.2.0255.255.255.01.1.1.2[FW_A]iproute-static2.2.2.0255.255.255.01.1.1.2配置防火墙A的安全策略（1）配置Trust区域和Untrust区域互访的安全策略配置Trust区域和Untrust区域互访的安全策略，允许私网业务互访。[FW_A]security-policy[FW_A-policy-security]rulenamepolicy1[FW_A-policy-security-rule-policy1]source-zonetrustuntrust[FW_A-policy-security-rule-policy1]destination-zoneuntrusttrust[FW_A-policy-security-rule-policy1]source-address10.1.1.024[FW_A-policy-security-rule-policy1]source-address10.1.2.024[FW_A-policy-security-rule-policy1]destination-address10.1.2.024[FW_A-policy-security-rule-policy1]destination-address10.1.1.024[FW_A-policy-security-rule-policy1]actionpermit[FW_A-policy-security-rule-policy1]quit（2）配置Local区域和Untrust区域互访的安全策略配置Local区域和Untrust区域互访的安全策略，允许IPSec隧道两端设备通信，使其能够进行隧道协商。[FW_A-policy-security]rulenamepolicy2[FW_A-policy-security-rule-policy2]source-zonelocaluntrust[FW_A-policy-security-rule-policy2]destination-zoneuntrustlocal[FW_A-policy-security-rule-policy2]source-address1.1.1.132[FW_A-policy-security-rule-policy2]source-address2.2.2.132[FW_A-policy-security-rule-policy2]destination-address2.2.2.132[FW_A-policy-security-rule-policy2]destination-address1.1.1.132[FW_A-policy-security-rule-policy2]actionpermit[FW_A-policy-security-rule-policy2]quit在防火墙A上配置IPSec（1）定义被保护的数据流[FW_A]acl3000[F[FW_A-acl-adv-3000]quit（2）配置IPSec安全提议（防火墙A与防火墙B的配置必须相同）[FW_A]ipsecproposaltran1[FW_A-ipsec-proposal-tran1]espauthentication-algorithmsha2-256[FW_A-ipsec-proposal-tran1]espencryption-algorithmaes-256[FW_A-ipsec-proposal-tran1]quit（3）配置手工方式的IPSec安全策略[FW_A]ipsecpolicymap110manual[FW_A-ipsec-policy-manual-map1-10]securityacl3000[FW_A-ipsec-policy-manual-map1-10]proposaltran1[FW_A-ipsec-policy-manual-map1-10]tunnelremote2.2.2.1//配置隧道的对端地址[FW_A-ipsec-policy-manual-map1-10]tunnellocal1.1.1.1//配置隧道的本端地址[FW_A-ipsec-policy-manual-map1-10]saspiinboundesp12345678//配置IPSec

SA的入方向esp协议的安全参数索引SPI[FW_A-ipsec-policy-manual-map1-10]saspioutboundesp87654321//配置IPSec

SA的出方向esp协议的安全参数索引SPI[FW_A-ipsec-policy-manual-map1-10]sastring-keyinboundespabcdefg//配置IPSec

SA的入方向esp协议的认证密钥[FW_A-ipsec-policy-manual-map1-10]sastring-keyoutboundespgfedcba//配置IPSec

SA的出方向esp协议的认证密钥[FW_A-ipsec-policy-manual-map1-10]quit（4）在接口上应用IPSec安全策略[FW_A]interfaceGigabitEthernet1/0/1[FW_A-GigabitEthernet1/0/1]ipsecpolicymap1//在当前接口上应用IPSec安全策略组[FW_A-GigabitEthernet1/0/1]quit配置防火墙B（1）配置接口IP地址<[FW_B]>system-view[FW_B]interfaceGigabitEthernet1/0/1[FW_B-GigabitEthernet1/0/1]ipaddress2.2.2.124[FW_B-GigabitEthernet1/0/1]quit[FW_B]interfaceGigabitEthernet1/0/2[FW_B-GigabitEthernet1/0/2]ipaddress10.1.2.124[FW_B-GigabitEthernet1/0/2]quit（2）将接口加入安全区域[FW_B]firewallzonetrust[FW_B-zone-trust]addinterfaceGigabitEthernet1/0/2[FW_B-zone-trust]quit[FW_B]firewallzoneuntrust[FW_B-zone-untrust]addinterfaceGigabitEthernet1/0/1[FW_B-zone-untrust]quit（3）配置到达总部局域网和隧道对端的路由[FW_B]iproute-static10.1.1.0255.255.255.02.2.2.2[FW_B]iproute-static1.1.1.0255.255.255.02.2.2.2（4）配置安全策略[FW_B]security-policy[FW_B-policy-security]rulenamepolicy1[FW_B-policy-security-rule-policy1]source-zonetrustuntrust[FW_B-policy-security-rule-policy1]destination-zoneuntrusttrust[FW_B-policy-security-rule-policy1]source-address10.1.1.024[FW_B-policy-security-rule-policy1]source-address10.1.2.024[FW_B-policy-security-rule-policy1]destination-address10.1.2.024[FW_B-policy-security-rule-policy1]destination-address10.1.1.024[FW_B-policy-security-rule-policy1]actionpermit[FW_B-policy-security-rule-policy1]quit[FW_B-policy-security]rulenamepolicy2[FW_B-policy-security-rule-policy2]source-zonelocaluntrust[FW_B-policy-security-rule-policy2]destination-zoneuntrustlocal[FW_B-policy-security-rule-policy2]source-address1.1.1.132[FW_B-policy-security-rule-policy2]source-address2.2.2.132[FW_B-policy-security-rule-policy2]destination-address2.2.2.132[FW_B-policy-security-rule-policy2]destination-address1.1.1.132[FW_B]-policy-security-rule-policy2]actionpermit[FW_B-policy-security-rule-policy2]quit（5）配置IPSec相关信息[FW_B]acl3000[F[FW_B-acl-adv-3000]quit[FW_B]ipsecproposaltran1[FW_B-ipsec-proposal-tran1]espauthentication-algorithmsha2-256[FW_B-ipsec-proposal-tran1]espencryption-algorithmaes-256[FW_B-ipsec-proposal-tran1]quit[FW_B]ipsecpolicymap110manual[FW_B-ipsec-policy-manual-map1-10]securityacl3000[FW_B-ipsec-policy-manual-map1-10]proposaltran1[FW_B-ipsec-policy-manual-map1-10]tunnelremote1.1.1.1[FW_B-ipsec-policy-manual-map1-10]tunnellocal2.2.2.1[FW_B-ipsec-policy-manual-map1-10]saspiinboundesp87654321[FW_B-ipsec-policy-manual-map1-10]saspioutboundesp12345678[FW_B-ipsec-policy-manual-map1-10]sastring-keyinboundespgfedcba[FW_B-ipsec-policy-manual-map1-10]sastring-keyoutboundespabcdefg[FW_B-ipsec-policy-manual-map1-10]quit[FW_B]interfaceGigabitEthernet1/0/1[FW_B-GigabitEthernet1/0/1]ipsecpolicymap1[FW_B-GigabitEthernet1/0/1]quit配置路由器<R1>system-view[R1]interfaceGigabitEthernet0/0/1[R1-GigabitEthernet0/0/1]ipaddress1.1.1.224[R1-GigabitEthernet0/0/1]quit[R1]interfaceGigabitEthernet0/0/2[R1-GigabitEthernet0/0/2]ipaddress2.2.2.224[R1-GigabitEthernet0/0/2]quit验证和调试（1）查看IPSecSA分别在防火墙A和防火墙B上查看IPSec安全联盟的建立情况，这里仅列出防火墙B上的输出信息。<FW_B>displayipsecsa2025-02-2409:37:36.940ipsecsainformation:===============================Interface:GigabitEthernet1/0/1===============================-----------------------------IPSecpolicyname:"map1"Sequencenumber:10Aclgroup:3000Aclrule:-Mode:Manual-----------------------------Encapsulationmode:TunnelTunnellocal:2.2.2.1:0Tunnelremote:1.1.1.1:0[OutboundESPSAs]SPI:12345678(0xbc614e)Proposal:ESP-ENCRYPT-AES-256ESP-AUTH-SHA2-256-128SAencryptedpackets(number/bytes):0/0NodurationlimitforthisSA[InboundESPSAs]SPI:87654321(0x5397fb1)Proposal:ESP-ENCRYPT-AES-256ESP-AUTH-SHA2-256-128SAdecryptedpackets(number/bytes):0/0NodurationlimitforthisSAAnti-replay:Disable以上输出信息显示，IPSec安全联盟已成功建立。（2）查看被加密的数据在公司总部局域网终端上执行ping操作可以ping通分支机构局域网终端，执行命令displayipsecstatistics可以查看被加密的数据。这里仅列出防火墙B上的输出信息。<FW_B>displayipsecstatistics2025-02-2410:03:21.780IPSecstatisticsinformation:NumberofIPSectunnels:1NumberofstandbyIPSectunnels:0thesecuritypacketstatistics:input/outputsecuritypackets:4/8input/outputsecuritybytes:240/480input/outputdroppedsecuritypackets:0/5theencryptpacketstatistics:sendchip:8