CLI: Example for Configuring IPSec Tunnels Between the Headquarters Using IPSec Policy Groups in ISAKMP Mode and Branches
Networking Requirements
As shown in Figure 1, the headquarters is connected to two branches. The networking requirements are as follows:
- FW_B connects Branch 1 to the Internet, and FW_C connects Branch 2 to the Internet.
FW_A and FW_B are reachable to each other; and FW_A and FW_C are reachable to each other.
- FW_A, FW_B, and FW_C use fixed public IP addresses.
The purposes of this networking are as follows:
- PC 2 and PC 3 in the branches can securely communicate with PC 1 in the headquarters.
- IPSec tunnels can be set up between FW_A and FW_B, and between FW_A and FW_C. However, FW_B and FW_C cannot establish an IPSec tunnel with each other.
Data Plan
Item |
Data |
|---|---|
FW_A |
Interface number: GigabitEthernet 0/0/3 IP address: 10.1.1.1/24 Security zone: Trust |
Interface number: GigabitEthernet 0/0/1 IP address: 1.1.3.1/24 Security zone: Untrust |
|
IPSec configuration Peer IP address: 1.1.5.1 (FW_B), 1.1.6.254 (FW_C) Authentication type: pre-shared key Pre-shared key: Test!1234 Local ID type: IP address Peer ID type: any |
|
FW_B |
Interface number: GigabitEthernet 0/0/1 IP address: 1.1.5.1/24 Security zone: Untrust |
Interface number: GigabitEthernet 0/0/3 IP address: 10.1.2.1/24 Security zone: Trust |
|
IPSec configuration Peer IP address: 1.1.3.1 Authentication type: pre-shared key Pre-shared key: Test!1234 Local ID type: IP address Peer ID type: IP address |
|
FW_C |
Interface number: GigabitEthernet 0/0/1 IP address: 1.1.6.254/24 Security zone: Untrust |
Interface number: GigabitEthernet 0/0/3 IP address: 10.1.3.1/24 Security zone: Trust |
|
IPSec configuration Peer IP address: 1.1.3.1 Authentication type: pre-shared key Pre-shared key: Test!1234 Local ID type: IP address Peer ID type: IP address |
Procedure
- Perform basic configurations on FW_A, including setting the interface IP addresses, adding interfaces to security zones, and configuring interzone security policies and a static route.
-
<sysname> system-view [sysname] sysname FW_A [FW_A] interface GigabitEthernet 0/0/3 [FW_A-GigabitEthernet0/0/3] ip address 10.1.1.1 24 [FW_A-GigabitEthernet0/0/3] quit [FW_A] interface GigabitEthernet 0/0/1 [FW_A-GigabitEthernet0/0/1] ip address 1.1.3.1 24 [FW_A-GigabitEthernet0/0/1] quit
Add interfaces to corresponding security zones.
[FW_A] firewall zone trust [FW_A-zone-trust] add interface GigabitEthernet 0/0/3 [FW_A-zone-trust] quit [FW_A] firewall zone untrust [FW_A-zone-untrust] add interface GigabitEthernet 0/0/1 [FW_A-zone-untrust] quit
Configure the security policies between the Trust and Untrust zones.
[FW_A] security-policy [FW_A-policy-security] rule name policy1 [FW_A-policy-security-rule-policy1] source-zone trust [FW_A-policy-security-rule-policy1] destination-zone untrust [FW_A-policy-security-rule-policy1] source-address 10.1.1.0 24 [FW_A-policy-security-rule-policy1] destination-address 10.1.2.0 24 [FW_A-policy-security-rule-policy1] destination-address 10.1.3.0 24 [FW_A-policy-security-rule-policy1] action permit [FW_A-policy-security-rule-policy1] quit [FW_A-policy-security] rule name policy2 [FW_A-policy-security-rule-policy2] source-zone untrust [FW_A-policy-security-rule-policy2] destination-zone trust [FW_A-policy-security-rule-policy2] source-address 10.1.2.0 24 [FW_A-policy-security-rule-policy2] source-address 10.1.3.0 24 [FW_A-policy-security-rule-policy2] destination-address 10.1.1.0 24 [FW_A-policy-security-rule-policy2] action permit [FW_A-policy-security-rule-policy2] quit
Configure the security policies between the Local and Untrust zones.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_A-policy-security] rule name policy3 [FW_A-policy-security-rule-policy3] source-zone local [FW_A-policy-security-rule-policy3] destination-zone untrust [FW_A-policy-security-rule-policy3] source-address 1.1.3.1 32 [FW_A-policy-security-rule-policy3] action permit [FW_A-policy-security-rule-policy3] quit [FW_A-policy-security] rule name policy4 [FW_A-policy-security-rule-policy4] source-zone untrust [FW_A-policy-security-rule-policy4] destination-zone local [FW_A-policy-security-rule-policy4] destination-address 1.1.3.1 32 [FW_A-policy-security-rule-policy4] action permit [FW_A-policy-security-rule-policy4] quit [FW_A-policy-security] quit
Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.
Configure a static route to reach branches. Assume that the next hop of the route is 1.1.3.2.
[FW_A] ip route-static 0.0.0.0 0.0.0.0 1.1.3.2
-
- Configure an IPSec policy and apply the policy to the corresponding interface on FW_A.
- Perform basic configurations on FW_B.
- Configure interzone security policies.
Configure the security policies between the Trust and Untrust zones.
[FW_B] security-policy [FW_B-policy-security] rule name policy1 [FW_B-policy-security-rule-policy1] source-zone trust [FW_B-policy-security-rule-policy1] destination-zone untrust [FW_B-policy-security-rule-policy1] source-address 10.1.2.0 24 [FW_B-policy-security-rule-policy1] destination-address 10.1.1.0 24 [FW_B-policy-security-rule-policy1] action permit [FW_B-policy-security-rule-policy1] quit [FW_B-policy-security] rule name policy2 [FW_B-policy-security-rule-policy2] source-zone untrust [FW_B-policy-security-rule-policy2] destination-zone trust [FW_B-policy-security-rule-policy2] source-address 10.1.1.0 24 [FW_B-policy-security-rule-policy2] destination-address 10.1.2.0 24 [FW_B-policy-security-rule-policy2] action permit [FW_B-policy-security-rule-policy2] quit
Configure the security policies between the Local and Untrust zones.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_B-policy-security] rule name policy3 [FW_B-policy-security-rule-policy3] source-zone local [FW_B-policy-security-rule-policy3] destination-zone untrust [FW_B-policy-security-rule-policy3] source-address 1.1.5.1 32 [FW_B-policy-security-rule-policy3] destination-address 1.1.3.1 32 [FW_B-policy-security-rule-policy3] action permit [FW_B-policy-security-rule-policy3] quit [FW_B-policy-security] rule name policy4 [FW_B-policy-security-rule-policy4] source-zone untrust [FW_B-policy-security-rule-policy4] destination-zone local [FW_B-policy-security-rule-policy4] source-address 1.1.3.1 32 [FW_B-policy-security-rule-policy4] destination-address 1.1.5.1 32 [FW_B-policy-security-rule-policy4] action permit [FW_B-policy-security-rule-policy4] quit [FW_B-policy-security] quit
Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.
- Configure interzone security policies.
- Configure an IPSec policy and apply the policy to the corresponding interface on FW_B.
- Perform basic configurations on FW_C.
- Configure interzone security policies.
Configure the security policies between the Trust and Untrust zones.
[FW_C] security-policy [FW_C-policy-security] rule name policy1 [FW_C-policy-security-rule-policy1] source-zone trust [FW_C-policy-security-rule-policy1] destination-zone untrust [FW_C-policy-security-rule-policy1] source-address 10.1.3.0 24 [FW_C-policy-security-rule-policy1] destination-address 10.1.1.0 24 [FW_C-policy-security-rule-policy1] action permit [FW_C-policy-security-rule-policy1] quit [FW_C-policy-security] rule name policy2 [FW_C-policy-security-rule-policy2] source-zone untrust [FW_C-policy-security-rule-policy2] destination-zone trust [FW_C-policy-security-rule-policy2] source-address 10.1.1.0 24 [FW_C-policy-security-rule-policy2] destination-address 10.1.3.0 24 [FW_C-policy-security-rule-policy2] action permit [FW_C-policy-security-rule-policy2] quit
Configure the security policies between the Local and Untrust zones.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_C-policy-security] rule name policy3 [FW_C-policy-security-rule-policy3] source-zone local [FW_C-policy-security-rule-policy3] destination-zone untrust FW_C-policy-security-rule-policy3] destination-address 1.1.3.1 32 [FW_C-policy-security-rule-policy3] action permit [FW_C-policy-security-rule-policy3] quit [FW_C-policy-security] rule name policy4 [FW_C-policy-security-rule-policy4] source-zone untrust [FW_C-policy-security-rule-policy4] destination-zone local [FW_C-policy-security-rule-policy4] source-address 1.1.3.1 32 [FW_C-policy-security-rule-policy4] action permit [FW_C-policy-security-rule-policy4] quit [FW_C-policy-security] quit
Configure the security policies between the Local and Untrust zones to permit the interzone traffic for the negotiation between the tunnel endpoints.
- Configure interzone security policies.
- Configure an IPSec policy and apply the policy to the corresponding interface on FW_C.
Verification
- After the configuration is complete, PC1 and PC2, PC1 and PC3 can access each other, and PC2 and PC3 cannot access each other.
On FW_A, you can view two pairs of IKE SAs.
<FW_A> display ike sa IKE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ------------------------------------------------------------------------------ 50336907 1.1.5.1:500 RD|ST|A v2:2 IP 1.1.5.1 50336906 1.1.5.1:500 RD|ST|A v2:1 IP 1.1.5.1 33554436 1.1.6.254:500 RD|A v2:2 IP 1.1.6.254 33554435 1.1.6.254:500 RD|A v2:1 IP 1.1.6.254 Number of IKE SA : 4 ------------------------------------------------------------------------------ Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATINGOn FW_B and FW_C, you can view the IKE SAs whose peer ends are the headquarters. The following takes the information displayed on FW_B as an example.
<FW_B> display ike sa IKE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ------------------------------------------------------------------------------ 16782416 1.1.3.1:500 RD|A v2:2 IP 1.1.3.1 16782415 1.1.3.1:500 RD|A v2:1 IP 1.1.3.1 Number of IKE SA : 2 ------------------------------------------------------------------------------ Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING- On FW_A, you can view two pairs of IPSec SAs, corresponding to FW_B and FW_C respectively.
<FW_A> display ipsec sa brief Current ipsec sa num:4 Number of SAs:4 Src address Dst address SPI VPN Protocol Algorithm ------------------------------------------------------------------------------- 1.1.6.254 1.1.3.1 4001819557 ESP E:AES-256 A:SHA2-256-128 1.1.5.1 1.1.3.1 3923280450 ESP E:AES-256 A:SHA2-256-128 1.1.3.1 1.1.6.254 4249128694 ESP E:AES-256 A:SHA2-256-128 1.1.3.1 1.1.5.1 787858613 ESP E:AES-256 A:SHA2-256-128 - On FW_B and FW_C, you can view a pair of reverse IPSec SAs of FW_A. The following takes the information displayed on FW_B as an example.
<FW_B> display ipsec sa brief Current ipsec sa num:2 Number of SAs:2 Src address Dst address SPI VPN Protocol Algorithm ------------------------------------------------------------------------------- 1.1.5.1 1.1.3.1 3923280450 ESP E:AES-256 A:SHA2-256-128 1.1.3.1 1.1.5.1 787858613 ESP E:AES-256 A:SHA2-256-128
Configuration Files
-
# sysname FW_A # acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 acl number 3001 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer b pre-shared-key %$%$c([VET@941t/q_4tS-f7,ri/%$%$ ike-proposal 10 remote-address 1.1.5.1 # ike peer c pre-shared-key %$%$d([VET@941t/q_56S-f7,ra/%$%$ ike-proposal 10 remote-address 1.1.6.254 # ipsec policy map1 9 isakmp security acl 3001 ike-peer c proposal tran1 # ipsec policy map1 10 isakmp security acl 3000 ike-peer b proposal tran1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.3.1 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 1.1.3.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address 10.1.2.0 24 destination-address 10.1.3.0 24 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.2.0 24 source-address 10.1.3.0 24 destination-address 10.1.1.0 24 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.3.1 32 action permit rule name policy4 source-zone untrust destination-zone local destination-address 1.1.3.1 32 action permit # return
-
# sysname FW_B # acl number 3000 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a pre-shared-key %@%@TI"2Gr[*D9KS1Z0-#3v'xT;d%@%@ ike-proposal 10 remote-address 1.1.3.1 # ipsec policy map1 10 isakmp security acl 3000 ike-peer a proposal tran1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.2.1 255.255.255.0 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.5.1 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 1.1.5.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.2.0 24 destination-address 10.1.1.0 24 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 24 destination-address 10.1.2.0 24 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.5.1 32 destination-address 1.1.3.1 32 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.3.1 32 destination-address 1.1.5.1 32 action permit # return
-
# sysname FW_C # acl number 3000 rule 5 permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a pre-shared-key %@%@8O:JW`kDBG.O9Y(h6>YK\=,T%@%@ ike-proposal 10 remote-address 1.1.3.1 # ipsec policy map1 10 isakmp security acl 3000 ike-peer a proposal tran1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.3.1 255.255.255.0 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.6.254 255.255.255.0 ipsec policy map1 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 1.1.6.2 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.3.0 24 destination-address 10.1.1.0 24 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 24 destination-address 10.1.3.0 24 action permit rule name policy3 source-zone local destination-zone untrust destination-address 1.1.3.1 32 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.3.1 32 action permit # return