ipsec两端内网同网段实现访问(本端进行源网段转换) |
您所在的位置:网站首页 › 双内网怎么互相通用 › ipsec两端内网同网段实现访问(本端进行源网段转换) |
3.关键配置 FWA # nat address-group 0 address 10.1.2.1 10.1.2.1 # policy-based-route huqi permit node 0 if-match acl 3003 apply next-hop 2.2.2.2 # interface GigabitEthernet1/0/1 description LAN port link-mode route combo enable copper ip address 10.1.1.1 255.255.255.0 nat inbound 3002 address-group 0 nat server global 10.1.3.1 inside 10.1.1.3 //将流量从外网口扔出去,不然做完转换后会发到内网,无法触发隧道建立 ip policy-based-route huqi # interface GigabitEthernet1/0/2 description WAN port link-mode route combo enable copper ip address 2.2.2.1 255.255.255.0 nat outbound 3001 ipsec apply policy map1 # security-zone name Trust import interface GigabitEthernet1/0/1 # security-zone name Untrust import interface GigabitEthernet1/0/2 # ip route-static 0.0.0.0 0 2.2.2.2 //将返回的流量扔到内网,用来触发在内网接口进行源和目的地址转换 ip route-static 10.1.2.0 24 10.1.1.2 # acl advanced 3000 rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # acl advanced 3001 rule 0 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 rule 5 permit ip # acl advanced 3002 rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 # acl advanced 3003 rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec transform-set tran1 esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 # ipsec policy map1 10 isakmp transform-set tran1 security acl 3000 remote-address 2.2.3.1 ike-profile profile1 # ike logging negotiation enable # ike profile profile1 keychain keychain1 local-identity address 2.2.2.1 match remote identity address 2.2.3.1 255.255.255.255 proposal 1 # ike proposal 1 encryption-algorithm 3des-cbc authentication-algorithm md5 # ike keychain keychain1 pre-shared-key address 2.2.3.1 255.255.255.0 key cipher $c$3$LXO7Pf3k1FxL1jfkO3moC7K747FDXR8fSg== # security-policy ip rule 0 name AllPass action pass # Return
FWB # interface GigabitEthernet1/0/1 description LAN port link-mode route combo enable copper ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet1/0/2 description WAN port link-mode route combo enable copper ip address 2.2.3.1 255.255.255.0 nat outbound 3001 ipsec apply policy use1 # security-zone name Trust import interface GigabitEthernet1/0/1 # security-zone name Untrust import interface GigabitEthernet1/0/2 # ip route-static 0.0.0.0 0 2.2.3.2 # acl advanced 3000 rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 # acl advanced 3001 rule 0 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 rule 5 permit # ipsec transform-set tran1 esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 # ipsec policy use1 10 isakmp transform-set tran1 security acl 3000 local-address 2.2.3.1 remote-address 2.2.2.1 ike-profile profile1 # ike profile profile1 keychain keychain1 local-identity address 2.2.3.1 match remote identity address 2.2.2.1 255.255.255.255 proposal 1 # ike proposal 1 encryption-algorithm 3des-cbc authentication-algorithm md5 # ike keychain keychain1 pre-shared-key address 2.2.2.1 255.255.255.0 key cipher $c$3$ENS6gWDmdnktKQfRKaaMhCy7tBTExUQLzA== # security-policy ip rule 0 name allpass action pass #
return 4.测试A端可以访问B端
在A端查看: [H3C]dis ike sa Connection-ID Remote Flag DOI ------------------------------------------------------------------ 1 2.2.3.1 RD IPsec Flags: RD--READY RL--REPLACED FD-FADING RK-REKEY [H3C]dis ipsec sa ------------------------------- Interface: GigabitEthernet1/0/2 -------------------------------
----------------------------- IPsec policy: map1 Sequence number: 10 Mode: ISAKMP ----------------------------- Tunnel id: 0 Encapsulation mode: tunnel Perfect Forward Secrecy: Inside VPN: Extended Sequence Numbers enable: N Traffic Flow Confidentiality enable: N Path MTU: 1444 Tunnel: local address: 2.2.2.1 remote address: 2.2.3.1 Flow: sour addr: 10.1.2.0/255.255.255.0 port: 0 protocol: ip dest addr: 10.1.1.0/255.255.255.0 port: 0 protocol: ip
[Inbound ESP SAs] SPI: 906099782 (0x3601fc46) Connection ID: 4294967296 Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843196/1681 Max received sequence-number: 37 Anti-replay check enable: Y Anti-replay window size: 64 UDP encapsulation used for NAT traversal: N Status: Active
[Outbound ESP SAs] SPI: 446997740 (0x1aa4a4ec) Connection ID: 4294967297 Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843197/1681 Max sent sequence-number: 24 UDP encapsulation used for NAT traversal: N Status: Active
Ipsec建立过程中防火墙的debug信息: *Dec 24 19:34:31:636 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1; Receiving, interface = GigabitEthernet1/0/1 version = 4, headlen = 20, tos = 0 pktlen = 84, pktid = 48, offset = 0, ttl = 255, protocol = 1 checksum = 41844, s = 10.1.1.2, d = 10.1.3.1 channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0. prompt: Receiving IP packet from interface GigabitEthernet1/0/1. Payload: ICMP type = 8, code = 0, checksum = 0x151c. //先在内网接口进行源地址和目的地址的转换 *Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP 10.1.1.2: 176 - 10.1.3.1: 2048(VPN: 0) ------> 10.1.2.1: 23 - 10.1.3.1: 2048(VPN: 0) *Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP 10.1.2.1: 23 - 10.1.3.1: 2048(VPN: 0) ------> 10.1.2.1: 23 - 10.1.1.3: 2048(VPN: 0) //转换完成匹配PBR,将流量扔到公网 *Dec 24 19:34:31:636 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; Policy: huqi, Node: 0, match succeeded.
*Dec 24 19:34:31:637 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; apply next-hop 2.2.2.2.
*Dec 24 19:34:31:637 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1; Sending, interface = GigabitEthernet1/0/2 version = 4, headlen = 20, tos = 252 pktlen = 224, pktid = 52, offset = 0, ttl = 255, protocol = 17 checksum = 45271, s = 2.2.2.1, d = 2.2.3.1 channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0. //触发ipsec协商 prompt: Sending IP packet from local at interface GigabitEthernet1/0/2. Payload: UDP source port = 500, destination port = 500 checksum = 0x0f40, length = 204.
//收到对端的回包 *Dec 24 19:34:31:639 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1; Receiving, interface = GigabitEthernet1/0/2 version = 4, headlen = 20, tos = 252 pktlen = 164, pktid = 64, offset = 0, ttl = 254, protocol = 17 checksum = 45575, s = 2.2.3.1, d = 2.2.2.1 channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0. prompt: Receiving IP packet from interface GigabitEthernet1/0/2. Payload: UDP source port = 500, destination port = 500 checksum = 0xf4cb, length = 144.
…(后面的协商过程的debug信息省略)
隧道建立后ping对端内网的NAT转换信息: [H3C]*Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP 10.1.1.2: 173 - 10.1.3.1: 2048(VPN: 0) ------> 10.1.2.1: 20 - 10.1.3.1: 2048(VPN: 0) *Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP 10.1.2.1: 20 - 10.1.3.1: 2048(VPN: 0) ------> 10.1.2.1: 20 - 10.1.1.3: 2048(VPN: 0) //要写这条路由ip route-static 10.1.2.0 24 10.1.1.2,才会进行下面的转换 *Dec 24 19:21:12:934 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP 10.1.1.3: 20 - 10.1.2.1: 0(VPN: 0) ------> 10.1.3.1: 173 - 10.1.2.1: 0(VPN: 0) *Dec 24 19:21:12:935 2019 H3C NAT/7/COMMON: -COntext=1; PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP 10.1.3.1: 173 - 10.1.2.1: 0(VPN: 0) ------>
10.1.3.1: 173 - 10.1.1.2: 0(VPN: 0) |
今日新闻 |
点击排行 |
|
推荐新闻 |
图片新闻 |
|
专题文章 |
CopyRight 2018-2019 实验室设备网 版权所有 win10的实时保护怎么永久关闭 |