CLI: Example for Configuring an IPSec Tunnel Between Two Gateways Manually
Networking Requirements
As shown in Figure 1, network A and network B connect to the Internet through FW_A and FW_B respectively. The network environment is as follows:
Data Plan
To complete the configuration, you need the following data:
IP addresses of interfaces on the FW
Figure 1 shows the interfaces and IP addresses of this example.
Security protocols, and encryption and authentication algorithms adopted by security protocols
In this example, ESP is adopted as the security protocol. The encryption algorithm and authentication algorithm adopted by ESP are AES-256 and SHA2-256 respectively.
Inbound and outbound Security Parameter Indexes (SPIs)
In this example, the SPIs of the inbound and outbound SAs adopted by FW_A are 12345678 and 87654321 respectively. The SPIs of the inbound and outbound SAs adopted by FW_B are 87654321 and 12345678 respectively.
-
In this example, the inbound and outbound authentication keys of ESP adopted by FW_A are abcdefg and gfedcba respectively. The inbound and outbound authentication keys of ESP adopted by FW_B are gfedcba and abcdefg respectively.
Verification
- On FW_A and FW_B, run the display ipsec sa command to check whether SAs are established. Take FW_B as an example. If the following information is displayed, the IKE SA and IPSec SA are successfully established.
<FW_B> display ipsec sa ipsec sa information: =============================== Interface: GigabitEthernet0/0/1 =============================== ----------------------------- IPSec policy name: "map1" Sequence number : 10 Acl group : 3000 Acl rule : - Mode : Manual ----------------------------- Encapsulation mode: Tunnel Tunnel local : 1.1.5.1 Tunnel remote : 1.1.3.1 [Outbound ESP SAs] SPI: 12345678 (0xbc614e) Proposal: ESP-ENCRYPT-AES-256 SHA2-256-128 SA encrypted packets (number/bytes): 0/0 No duration limit for this SA [Inbound ESP SAs] SPI: 87654321 (0x5397fb1) Proposal: ESP-ENCRYPT-AES-256 SHA2-256-128 SA decrypted packets (number/bytes): 0/0 No duration limit for this SA Anti-replay : Disable
- If the configurations are correct, network A can ping network B, and you can check the encrypted data using the display ipsec statistics command.
<FW_B> display ipsec statistics IPSec statistics information: the security packet statistics: input/output security packets: 20/20 input/output security bytes: 2000/2000 input/output dropped security packets: 0/0 the encrypt packet statistics: send chip: 63, recv chip: 63, send err: 0 local cpu: 63, other cpu: 0, recv other cpu: 0 intact packet: 63, first slice: 0, after slice: 0 the decrypt packet statistics: send chip: 244, recv chip: 244, send err: 0 local cpu: 244, other cpu: 0, recv other cpu: 0 reass first slice: 0, after slice: 0 dropped security packet detail: can't find SA: 0, wrong SA: 0 authentication: 0, replay: 0 front recheck: 0, after recheck: 0 change cpu enc: 0, dec change cpu: 0 fib search: 0, output l3: 0 flow err: 0, slice err: 0, byte limit: 0 negotiate about packet statistics: IKE fwd packet ok: 93, err: 0 IKE ctrl packet inbound ok: 92, outbound ok: 58 SoftExpr: 0, HardExpr: 0, DPDOper: 0 trigger ok: 0, switch sa: 35684, sync sa: 0 recv IKE nat keepalive: 114731, IKE input: 0
Configuration Files
-
# sysname FW_A # acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ipsec policy map1 10 manual security acl 3000 proposal tran1 tunnel local 1.1.3.1 tunnel remote 1.1.5.1 sa spi inbound esp 12345678 sa string-key inbound esp %@%@PI\K*_pjr==.uM$HIkP#Vt8(%@%@ sa spi outbound esp 87654321 sa string-key outbound esp %@%@2Lbc"4d3cNnt"LWd5I=#\P1t%@%@ # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.3.1 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 1.1.5.0 255.255.255.0 1.1.3.2 ip route-static 10.1.2.0 255.255.255.0 1.1.3.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.1.2.0 mask 255.255.255.0 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.2.0 mask 255.255.255.0 destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.3.1 mask 255.255.255.255 destination-address 1.1.5.1 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.5.1 mask 255.255.255.255 destination-address 1.1.3.1 mask 255.255.255.255 action permit # return
-
# sysname FW_B # acl number 3000 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ipsec policy map1 10 manual security acl 3000 proposal tran1 tunnel local 1.1.5.1 tunnel remote 1.1.3.1 sa spi inbound esp 87654321 sa string-key inbound esp %@%@>#!MN;yT<0M|RK7`Wu3K-cTy%@%@ sa spi outbound esp 12345678 sa string-key outbound esp %@%@};BD7G!>+.=sRN(/)Ab>-]Yl%@%@ # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.2.1 255.255.255.0 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.5.1 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 1.1.3.0 255.255.255.0 1.1.5.2 ip route-static 10.1.1.0 255.255.255.0 1.1.5.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.2.0 mask 255.255.255.0 destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.1.2.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.5.1 mask 255.255.255.255 destination-address 1.1.3.1 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.3.1 mask 255.255.255.255 destination-address 1.1.5.1 mask 255.255.255.255 action permit # return