< Home

CLI: Example for Establishing IPSec Tunnels for Branch Access to the Headquarters Using Different Pre-shared Keys

Networking Requirements

As shown in Figure 1, the headquarters is connected to two branches. The networking requirements are as follows:

  • FW_B connects Branch 1 to the Internet, and FW_C connects Branch 2 to the Internet.

  • FW_A and FW_B are reachable to each other; and FW_A and FW_C are reachable to each other.

  • FW_A, FW_B, and FW_C use fixed public IP addresses.

The purposes of this networking are as follows:

  • PC 2 and PC 3 in the branches can securely communicate with PC 1 in the headquarters.
  • The branches establish IPSec tunnels with the headquarters. For security purposes, the headquarters requires the branches to use different pre-shared keys for access.
Figure 1 Establishing IPSec tunnels for branch access to the headquarters using different pre-shared keys

Data Plan

Item

Data

FW_A

Interface number: GigabitEthernet 0/0/3

IP address: 10.1.1.1/24

Security zone: Trust

Interface number: GigabitEthernet 0/0/1

IP address: 1.1.3.1/24

Security zone: Untrust

IPSec configuration

Peer IP address: 1.1.5.1 (FW_B), 1.1.6.254 (FW_C)

Authentication type: pre-shared key

Pre-shared key: Test!1234 and Test!1235

FW_B

Interface number: GigabitEthernet 0/0/1

IP address: 1.1.5.1/24

Security zone: Untrust

Interface number: GigabitEthernet 0/0/3

IP address: 10.1.2.1/24

Security zone: Trust

IPSec configuration

Peer IP address: 1.1.3.1

Authentication type: pre-shared key

Pre-shared key: Test!1234

FW_C

Interface number: GigabitEthernet 0/0/1

IP address: 1.1.6.254/24

Security zone: Untrust

Interface number: GigabitEthernet 0/0/3

IP address: 10.1.3.1/24

Security zone: Trust

IPSec configuration

Peer IP address: 1.1.3.1

Authentication type: pre-shared key

Pre-shared key: Test!1235

Configuration Roadmap

  1. Configure interfaces and routes, and enable security policies.

  2. Configure the IPSec policy in ISAKMP Mode, including basic IPSec policy information, data flow to be protected by IPSec, and proposal parameters for security association (SA) negotiation.

    The headquarters gateway can only respond to IPSec negotiation requests initiated by branch gateways because it is difficult to specify IP addresses for branch gateways on the headquarters gateway. As a result, you can deploy a policy template on FW_A and reference this template in an IPSec policy. To allow branch gateways to connect to the headquarters using different pre-shared keys, configure an IKE user table on FW_A to allocate pre-shared keys for branches. The branches initiate IPSec negotiation using allocated pre-shared keys to establish IPSec tunnels.

Procedure

  1. Perform basic configurations on FW_A, including setting the interface IP addresses, adding interfaces to security zones, and configuring interzone security policies and a static route.

    1. Set interface IP addresses.

      <sysname> system-view
[sysname] sysname FW_A
[FW_A] interface GigabitEthernet 0/0/3
[FW_A-GigabitEthernet0/0/3] ip address 10.1.1.1 24
[FW_A-GigabitEthernet0/0/3] quit
[FW_A] interface GigabitEthernet 0/0/1
[FW_A-GigabitEthernet0/0/1] ip address 1.1.3.1 24
[FW_A-GigabitEthernet0/0/1] quit

    2. Add interfaces to corresponding security zones.

      [FW_A] firewall zone trust
[FW_A-zone-trust] add interface GigabitEthernet 0/0/3
[FW_A-zone-trust] quit
[FW_A] firewall zone untrust
[FW_A-zone-untrust] add interface GigabitEthernet 0/0/1
[FW_A-zone-untrust] quit

    3. Configure the security policies between the Trust and Untrust zones.

      [FW_A] security-policy
[FW_A-policy-security] rule name policy1
[FW_A-policy-security-rule-policy1] source-zone trust
[FW_A-policy-security-rule-policy1] destination-zone untrust
[FW_A-policy-security-rule-policy1] source-address 10.1.1.0 24
[FW_A-policy-security-rule-policy1] destination-address 10.1.2.0 24
[FW_A-policy-security-rule-policy1] destination-address 10.1.3.0 24
[FW_A-policy-security-rule-policy1] action permit
[FW_A-policy-security-rule-policy1] quit
[FW_A-policy-security] rule name policy2
[FW_A-policy-security-rule-policy2] source-zone untrust
[FW_A-policy-security-rule-policy2] destination-zone trust
[FW_A-policy-security-rule-policy2] source-address 10.1.2.0 24
[FW_A-policy-security-rule-policy2] source-address 10.1.3.0 24
[FW_A-policy-security-rule-policy2] destination-address 10.1.1.0 24
[FW_A-policy-security-rule-policy2] action permit
[FW_A-policy-security-rule-policy2] quit

    4. Configure the security policies between the Local and Untrust zones.

      The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).

      [FW_A-policy-security] rule name policy3
[FW_A-policy-security-rule-policy3] source-zone local
[FW_A-policy-security-rule-policy3] destination-zone untrust
[FW_A-policy-security-rule-policy3] source-address 1.1.3.1 32
[FW_A-policy-security-rule-policy3] action permit
[FW_A-policy-security-rule-policy3] quit
[FW_A-policy-security] rule name policy4
[FW_A-policy-security-rule-policy4] source-zone untrust
[FW_A-policy-security-rule-policy4] destination-zone local
[FW_A-policy-security-rule-policy4] destination-address 1.1.3.1 32
[FW_A-policy-security-rule-policy4] action permit
[FW_A-policy-security-rule-policy4] quit
[FW_A-policy-security] quit

      Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.

    5. Configure a static route to reach branches. Assume that the next hop of the route is 1.1.3.2.

      [FW_A] ip route-static 0.0.0.0 0.0.0.0 1.1.3.2

  2. Configure an IPSec policy and apply the policy to the corresponding interface on FW_A.
    1. Configure an IPSec proposal.

      [FW_A] ipsec proposal tran1
[FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_A-ipsec-proposal-tran1] quit

    2. Configure an IKE proposal.

      [FW_A] ike proposal 10
[FW_A-ike-proposal-10] authentication-method pre-share
[FW_A-ike-proposal-10] prf hmac-sha2-256
[FW_A-ike-proposal-10] encryption-algorithm aes-256
[FW_A-ike-proposal-10] dh group14
[FW_A-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_A-ike-proposal-10] quit

    3. Configure an IKE user table to allocate pre-shared keys for branches.

      When the IKEv1 main mode and pre-shared key authentication are used, id-type can only be set to ip, and in NAT traversal scenarios, the IP address must be set to the post-NAT address. If a branch dynamically obtains an IP address, you must use the IKEv1 aggressive mode or IKEv2 and advised to set id-type to fqdn.

      [FW_A] ike user-table 10
[FW_A-ike-user-table-10] user fwb
[FW_A-ike-user-table-10-fwb] id-type ip 1.1.5.1
[FW_A-ike-user-table-10-fwb] pre-shared-key Test!1234
[FW_A-ike-user-table-10-fwb] quit
[FW_A-ike-user-table-10] user fwc
[FW_A-ike-user-table-10-fwc] id-type ip 1.1.6.254
[FW_A-ike-user-table-10-fwc] pre-shared-key Test!1235
[FW_A-ike-user-table-10-fwc] quit

    4. Configure IKE peers.

      [FW_A] ike peer b
[FW_A-ike-peer-b] ike-proposal 10
[FW_A-ike-peer-b] user-table 10
[FW_A-ike-peer-b] quit

    5. Create a policy template and apply the policy template to an IPSec policy.

      [FW_A] ipsec policy-template use1 10
[FW_A-ipsec-policy-templet-use1-10] proposal tran1
[FW_A-ipsec-policy-templet-use1-10] ike-peer b
[FW_A-ipsec-policy-templet-use1-10] quit
[FW_A] ipsec policy map1 10 isakmp template use1

    6. Apply IPSec policy group map1 to GigabitEthernet 0/0/1.

      [FW_A] interface GigabitEthernet 0/0/1
[FW_A-GigabitEthernet0/0/1] ipsec policy map1
[FW_A-GigabitEthernet0/0/1] quit

  3. Perform basic configurations on FW_B.
    1. Set interface IP addresses and add the interfaces to security zones.

      1. Set interface IP addresses.

        <sysname> system-view
[sysname] sysname FW_B
[FW_B] interface GigabitEthernet 0/0/3
[FW_B-GigabitEthernet0/0/3] ip address 10.1.2.1 24
[FW_B-GigabitEthernet0/0/3] quit
[FW_B] interface GigabitEthernet 0/0/1
[FW_B-GigabitEthernet0/0/1] ip address 1.1.5.1 24
[FW_B-GigabitEthernet0/0/1] quit

      2. Add GigabitEthernet 0/0/3 to the Trust zone and GigabitEthernet 0/0/1 to the Untrust zone.

        [FW_B] firewall zone trust
[FW_B-zone-trust] add interface GigabitEthernet 0/0/3
[FW_B-zone-trust] quit
[FW_B] firewall zone untrust
[FW_B-zone-untrust] add interface GigabitEthernet 0/0/1
[FW_B-zone-untrust] quit

    2. Configure interzone security policies.

      1. Configure the security policies between the Trust and Untrust zones.

        [FW_B] security-policy
[FW_B-policy-security] rule name policy1
[FW_B-policy-security-rule-policy1] source-zone trust
[FW_B-policy-security-rule-policy1] destination-zone untrust
[FW_B-policy-security-rule-policy1] source-address 10.1.2.0 24
[FW_B-policy-security-rule-policy1] destination-address 10.1.1.0 24
[FW_B-policy-security-rule-policy1] action permit
[FW_B-policy-security-rule-policy1] quit
[FW_B-policy-security] rule name policy2
[FW_B-policy-security-rule-policy2] source-zone untrust
[FW_B-policy-security-rule-policy2] destination-zone trust
[FW_B-policy-security-rule-policy2] source-address 10.1.1.0 24
[FW_B-policy-security-rule-policy2] destination-address 10.1.2.0 24
[FW_B-policy-security-rule-policy2] action permit
[FW_B-policy-security-rule-policy2] quit

      2. Configure the security policies between the Local and Untrust zones.

        The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).

        [FW_B-policy-security] rule name policy3
[FW_B-policy-security-rule-policy3] source-zone local
[FW_B-policy-security-rule-policy3] destination-zone untrust
[FW_B-policy-security-rule-policy3] source-address 1.1.5.1 32
[FW_B-policy-security-rule-policy3] destination-address 1.1.3.1 32
[FW_B-policy-security-rule-policy3] action permit
[FW_B-policy-security-rule-policy3] quit
[FW_B-policy-security] rule name policy4
[FW_B-policy-security-rule-policy4] source-zone untrust
[FW_B-policy-security-rule-policy4] destination-zone local
[FW_B-policy-security-rule-policy4] source-address 1.1.3.1 32
[FW_B-policy-security-rule-policy4] destination-address 1.1.5.1 32
[FW_B-policy-security-rule-policy4] action permit
[FW_B-policy-security-rule-policy4] quit
[FW_B-policy-security] quit

      Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.

    3. Configure a static route to the headquarters. Assume that the next hop is 1.1.5.2.

      [FW_B] ip route-static 0.0.0.0 0.0.0.0 1.1.5.2

  4. Configure an IPSec policy and apply the policy to the corresponding interface on FW_B.
    1. Configure an ACL to define data flows that need to be protected.

      [FW_B] acl 3000
[FW_B-acl-adv-3000] rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
[FW_B-acl-adv-3000] quit

    2. Configure an IPSec proposal.

      [FW_B] ipsec proposal tran1
[FW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_B-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_B-ipsec-proposal-tran1] quit

    3. Configure an IKE proposal.

      [FW_B] ike proposal 10
[FW_B-ike-proposal-10] authentication-method pre-share
[FW_B-ike-proposal-10] prf hmac-sha2-256
[FW_B-ike-proposal-10] encryption-algorithm aes-256
[FW_B-ike-proposal-10] dh group14
[FW_B-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_B-ike-proposal-10] quit

    4. Configure an IKE peer.

      [FW_B] ike peer a
[FW_B-ike-peer-a] ike-proposal 10
[FW_B-ike-peer-a] remote-address 1.1.3.1
[FW_B-ike-peer-a] pre-shared-key Test!1234
[FW_B-ike-peer-a] quit

    5. Configure an IPSec policy with the name map1 and number 10.

      [FW_B] ipsec policy map1 10 isakmp
[FW_B-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_B-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_B-ipsec-policy-isakmp-map1-10] ike-peer a
[FW_B-ipsec-policy-isakmp-map1-10] quit

    6. Apply security policy map1 to GigabitEthernet 0/0/1.

      [FW_B] interface GigabitEthernet 0/0/1
[FW_B-GigabitEthernet0/0/1] ipsec policy map1
[FW_B-GigabitEthernet0/0/1] quit

  5. Perform basic configurations on FW_C.
    1. Set interface IP addresses and add them to the corresponding security zones.

      1. Set the IP address of GigabitEthernet 0/0/3 to 10.1.3.1/24, and set the IP address of GigabitEthernet 0/0/1 to 1.1.6.254/24.

        <sysname> system-view
[sysname] sysname FW_C
[FW_C] interface GigabitEthernet 0/0/3
[FW_C-GigabitEthernet0/0/3] ip address 10.1.3.1 24
[FW_C-GigabitEthernet0/0/3] quit
[FW_C] interface GigabitEthernet 0/0/1
[FW_C-GigabitEthernet0/0/1] ip address 1.1.6.254 24
[FW_C-GigabitEthernet0/0/1] quit

      2. Add GigabitEthernet 0/0/3 to the Trust zone and GigabitEthernet 0/0/1 to the Untrust zone.

        [FW_C] firewall zone trust
[FW_C-zone-trust] add interface GigabitEthernet 0/0/3
[FW_C-zone-trust] quit
[FW_C] firewall zone untrust
[FW_C-zone-untrust] add interface GigabitEthernet 0/0/1
[FW_C-zone-untrust] quit

    2. Configure interzone security policies.

      1. Configure the security policies between the Trust and Untrust zones.

        [FW_C] security-policy
[FW_C-policy-security] rule name policy1
[FW_C-policy-security-rule-policy1] source-zone trust
[FW_C-policy-security-rule-policy1] destination-zone untrust
[FW_C-policy-security-rule-policy1] source-address 10.1.3.0 24
[FW_C-policy-security-rule-policy1] destination-address 10.1.1.0 24
[FW_C-policy-security-rule-policy1] action permit
[FW_C-policy-security-rule-policy1] quit
[FW_C-policy-security] rule name policy2
[FW_C-policy-security-rule-policy2] source-zone untrust
[FW_C-policy-security-rule-policy2] destination-zone trust
[FW_C-policy-security-rule-policy2] source-address 10.1.1.0 24
[FW_C-policy-security-rule-policy2] destination-address 10.1.3.0 24
[FW_C-policy-security-rule-policy2] action permit
[FW_C-policy-security-rule-policy2] quit

      2. Configure the security policies between the Local and Untrust zones.

        The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).

        [FW_C-policy-security] rule name policy3
[FW_C-policy-security-rule-policy3] source-zone local
[FW_C-policy-security-rule-policy3] destination-zone untrust
FW_C-policy-security-rule-policy3] destination-address 1.1.3.1 32
[FW_C-policy-security-rule-policy3] action permit
[FW_C-policy-security-rule-policy3] quit
[FW_C-policy-security] rule name policy4
[FW_C-policy-security-rule-policy4] source-zone untrust
[FW_C-policy-security-rule-policy4] destination-zone local
[FW_C-policy-security-rule-policy4] source-address 1.1.3.1 32
[FW_C-policy-security-rule-policy4] action permit
[FW_C-policy-security-rule-policy4] quit
[FW_C-policy-security] quit

      Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.

    3. Configure a static route to the headquarters. Assume that the next hop is 1.1.6.2.

      [FW_C] ip route-static 0.0.0.0 0.0.0.0 1.1.6.2

  6. Configure an IPSec policy and apply the policy to the corresponding interface on FW_C.
    1. Configure an ACL to define data flows that need to be protected.

      [FW_C] acl 3000
[FW_C-acl-adv-3000] rule 5 permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
[FW_C-acl-adv-3000] quit

    2. Configure an IPSec proposal.

      [FW_C] ipsec proposal tran1
[FW_C-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_C-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_C-ipsec-proposal-tran1] quit

    3. Configure an IKE proposal.

      [FW_C] ike proposal 10
[FW_C-ike-proposal-10] authentication-method pre-share
[FW_C-ike-proposal-10] prf hmac-sha2-256
[FW_C-ike-proposal-10] encryption-algorithm aes-256
[FW_C-ike-proposal-10] dh group14
[FW_C-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_C-ike-proposal-10] quit

    4. Configure an IKE peer.

      [FW_C] ike peer a
[FW_C-ike-peer-a] ike-proposal 10
[FW_C-ike-peer-a] remote-address 1.1.3.1
[FW_C-ike-peer-a] pre-shared-key Test!1235
[FW_C-ike-peer-a] quit

    5. Configure an IPSec policy with the name map1 and number 10.

      [FW_C] ipsec policy map1 10 isakmp
[FW_C-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_C-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_C-ipsec-policy-isakmp-map1-10] ike-peer a
[FW_C-ipsec-policy-isakmp-map1-10] quit

    6. Apply ISPec policy map1 to GigabitEthernet 0/0/1.

      [FW_C] interface GigabitEthernet 0/0/1
[FW_C-GigabitEthernet0/0/1] ipsec policy map1
[FW_C-GigabitEthernet0/0/1] quit

Verification

  1. After the configuration is complete, PC1 and PC2, PC1 and PC3 can access each other, and PC2 and PC3 cannot access each other.

  2. On FW_A, you can view two pairs of IKE SAs.

    <FW_A> display ike sa       
                                                                                
Ike sa information :                                                            
    Conn-ID       Peer            VPN             Flag(s)                Phase
  ------------------------------------------------------------------------------
    50336907      1.1.5.1                         RD|ST|A                v2:2 
    50336906      1.1.5.1                         RD|ST|A                v2:1
    33554436      1.1.6.254                       RD|A                   v2:2
    33554435      1.1.6.254                       RD|A                   v2:1
                                   
  Number of IKE SA : 4     
  ------------------------------------------------------------------------------

  Flag Description:           
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
  M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

  3. On FW_B and FW_C, you can view the IKE SAs whose peer ends are the headquarters. The following takes the information displayed on FW_B as an example.

    <FW_B> display ike sa      
                                                                                
Ike sa information :                                                            
    Conn-ID       Peer            VPN             Flag(s)                Phase
  ------------------------------------------------------------------------------
    16782416      1.1.3.1                         RD|A                   v2:2
    16782415      1.1.3.1                         RD|A                   v2:1
                                   
  Number of IKE SA : 2     
  ------------------------------------------------------------------------------

  Flag Description:           
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
  M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

Configuration Files

  • FW_A configuration file

    #
 sysname FW_A
#
ipsec proposal tran1                                                            
 esp authentication-algorithm sha2-256                                          
 esp encryption-algorithm aes-256
#
ike proposal 10
  encryption-algorithm aes-256                                                   
  dh group14                                                                      
  authentication-algorithm sha2-256                                              
  authentication-method pre-share                                                
  integrity-algorithm hmac-sha2-256                                              
  prf hmac-sha2-256 
#
ike user-table 10                                                               
 user routerb
  id-type ip 1.1.5.1
  pre-shared-key %^%#W)04NhZ:bP=~"=KQu\CN6KcK#NE5:(Os2L57]r5I%^%#
 user routera
  id-type ip 1.1.6.254
  pre-shared-key %^%#Z"m.4U|TGN$'4c7~m'7FFo\A9q-smXqS8B"w;=w~%^%#
#
ike peer b
  ike-proposal 10
   user-table 10  
#
ipsec policy-template use1 10
 ike-peer b
 proposal tran1
#
ipsec policy map1 10 isakmp template use1
#
interface GigabitEthernet0/0/3
 undo shutdown
 ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.3.1 255.255.255.0
 ipsec policy map1
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/3
#
firewall zone untrust 
 set priority 5 
 add interface GigabitEthernet0/0/1
#
ip route-static 0.0.0.0 0.0.0.0 1.1.3.2
#
security-policy
  rule name policy1
    source-zone trust
    destination-zone untrust
    source-address 10.1.1.0 24
    destination-address 10.1.2.0 24
    destination-address 10.1.3.0 24
    action permit
  rule name policy2
    source-zone untrust
    destination-zone trust
    source-address 10.1.2.0 24
    source-address 10.1.3.0 24
    destination-address 10.1.1.0 24
    action permit
  rule name policy3
    source-zone local
    destination-zone untrust
    source-address 1.1.3.1 32
    action permit
  rule name policy4
    source-zone untrust
    destination-zone local
    destination-address 1.1.3.1 32
    action permit
#
return

  • FW_B configuration file

    #
 sysname FW_B
#
acl number 3000
 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#                                                                               
ipsec proposal tran1                                                            
 esp authentication-algorithm sha2-256                                          
 esp encryption-algorithm aes-256
#
ike proposal 10
  encryption-algorithm aes-256                                                   
  dh group14                                                                      
  authentication-algorithm sha2-256                                              
  authentication-method pre-share                                                
  integrity-algorithm hmac-sha2-256                                              
  prf hmac-sha2-256 
#
ike peer a
 pre-shared-key %^%#W)04NhZ:bP=~"=KQu\CN6KcK#NE5:(Os2L57]r5I%^%#
 ike-proposal 10
 remote-address 1.1.3.1
#
ipsec policy map1 10 isakmp
 security acl 3000
 ike-peer a
 proposal tran1
#
interface GigabitEthernet0/0/3
 undo shutdown
 ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.5.1 255.255.255.0
 ipsec policy map1
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/3
#
firewall zone untrust 
 set priority 5 
 add interface GigabitEthernet0/0/1
#
ip route-static 0.0.0.0 0.0.0.0 1.1.5.2
#
security-policy
  rule name policy1
    source-zone trust
    destination-zone untrust
    source-address 10.1.2.0 24
    destination-address 10.1.1.0 24
    action permit
  rule name policy2
    source-zone untrust
    destination-zone trust
    source-address 10.1.1.0 24
    destination-address 10.1.2.0 24
    action permit
  rule name policy3
    source-zone local
    destination-zone untrust
    source-address 1.1.5.1 32
    destination-address 1.1.3.1 32
    action permit
  rule name policy4
    source-zone untrust
    destination-zone local
    source-address 1.1.3.1 32
    destination-address 1.1.5.1 32
    action permit
#
return

  • FW_C configuration file

    #
 sysname FW_C
#
acl number 3000
 rule 5 permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#                                                                               
ipsec proposal tran1                                                            
 esp authentication-algorithm sha2-256                                          
 esp encryption-algorithm aes-256
#
ike proposal 10
  encryption-algorithm aes-256                                                   
  dh group14                                                                      
  authentication-algorithm sha2-256                                              
  authentication-method pre-share                                                
  integrity-algorithm hmac-sha2-256                                              
  prf hmac-sha2-256 
#
ike peer a
 pre-shared-key %^%#Z"m.4U|TGN$'4c7~m'7FFo\A9q-smXqS8B"w;=w~%^%#
 ike-proposal 10
 remote-address 1.1.3.1
#
ipsec policy map1 10 isakmp
 security acl 3000
 ike-peer a
 proposal tran1
#
interface GigabitEthernet0/0/3
 undo shutdown
 ip address 10.1.3.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.6.254 255.255.255.0
 ipsec policy map1
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/3
#
firewall zone untrust 
 set priority 5 
 add interface GigabitEthernet0/0/1
#
ip route-static 0.0.0.0 0.0.0.0 1.1.6.2
#
security-policy
  rule name policy1
    source-zone trust
    destination-zone untrust
    source-address 10.1.3.0 24
    destination-address 10.1.1.0 24
    action permit
  rule name policy2
    source-zone untrust
    destination-zone trust
    source-address 10.1.1.0 24
    destination-address 10.1.3.0 24
    action permit
  rule name policy3
    source-zone local
    destination-zone untrust
    destination-address 1.1.3.1 32
    action permit
  rule name policy4
    source-zone untrust
    destination-zone local
    source-address 1.1.3.1 32
    action permit
#
return
Parent Topic: Communication Between LANs Through an IPSec Tunnel
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >