實(shí)驗(yàn)過(guò)程：
1、建立如圖拓?fù)浣Y(jié)構(gòu)
網(wǎng)絡(luò)拓?fù)鋱D
2、為主機(jī)配置地址
R1接口配置
sys
sysn R1
int g0/0/0
ip add 192.168.12.3 24
int g0/0/1
ip add 192.168.1.254 24
undo shu
#
R2接口配置
sys
sysn R2
int g0/0/0
ip add 192.168.12.2 24
int g0/0/1
ip add 192.168.23.1 24
undo shu
#
R3接口配置
sys
sysn R3
int g0/0/0
ip add 192.168.2.254 24
int g0/0/1
ip add 192.168.23.3 24
undo shu
#
然后配置VPN
公司總部路由器R3配置：
[R3]acl number 3000 //創(chuàng)建ACl
[R3-acl-adv-3000]rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 //配置允許192.168.2.0 網(wǎng)段訪問192.168.1.0網(wǎng)段
[R3-acl-adv-3000]ipsec proposal huawei //新建安全提議，名字為huawei
[R3-ipsec-proposal-huawei]esp authentication-algorithm sha1 //設(shè)置加密方式sha1，默認(rèn)MD5
[R3-ipsec-proposal-huawei]q
[R3]ipsec policy huawei 10 manual
//配置ipsec策略，策略名為huawei，編號(hào)為10，模式為手動(dòng)配置模式
[R3-ipsec-policy-manual-huawei-10]security acl 3000
//匹配acl，就是讓這個(gè)數(shù)據(jù)（192.168.1.0訪問192.168.2.0的數(shù)據(jù)）走VPN
[
R3-ipsec-policy-manual-huawei-10]proposal huawei //引用名為huawei的提議
[
R3-ipsec-policy-manual-huawei-10]tunnel local 192.168.23.3 //本地隧道地址
[
R3-ipsec-policy-manual-huawei-10]tunnel remote 192.168.12.3 //對(duì)端隧道地址
[R3-ipsec-policy-manual-huawei-10]sa spi inbound esp 54321
//安全聯(lián)盟入方向，SPI為54321，本端入方向SPI必須和對(duì)端出方向SPI一致
[
R3-ipsec-policy-manual-huawei-10]sa string-key inbound esp cipher huawei //安全聯(lián)盟密鑰，入方向?yàn)榧用艿膆uawei，本端入方向密鑰必須和對(duì)端出方向密鑰一致
[R3-ipsec-policy-manual-huawei-10]sa spi outbound esp 12345
//安全聯(lián)盟出方向，SPI為12345，本端出方向SPI必須和對(duì)端入方向SPI一致
[R3-ipsec-policy-manual-huawei-10]sa string-key outbound esp cipher huawei000
//安全聯(lián)盟密鑰，出方向?yàn)榧用艿膆uawei，本端入方向密鑰必須和對(duì)端出方向密鑰一致
[R3]int g0/0/1 //進(jìn)入端口g0/0/1
[R3-GigabitEthe.NET0/0/1]ipsec policy huawei //在端口上應(yīng)用
在R3上配置靜態(tài)路由
[R3]ip route-static 0.0.0.0 0 192.168.23.1
分公司路由器R1配置：
[R1]acl number 3000
[R1-acl-adv-3000]rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.1
68.2.0 0.0.0.255
[R1-acl-adv-3000]ipsec proposal huawei
[R1-ipsec-proposal-huawei]esp authentication-algorithm sha1
[R1-ipsec-proposal-huawei]q
[R1]ipsec policy huawei 10 manual
[R1-ipsec-policy-manual-huawei-10]security acl 3000
[R1-ipsec-policy-manual-huawei-10]proposal huawei
[R1-ipsec-policy-manual-huawei-10]tunnel local 192.168.12.3
[R1-ipsec-policy-manual-huawei-10]tunnel remote 192.168.23.3
[R1-ipsec-policy-manual-huawei-10]sa spi inbound esp 12345
[R1-ipsec-policy-manual-huawei-10]sa string-key inbound esp cipher huawei000
[R1-ipsec-policy-manual-huawei-10]sa spi outbound esp 54321
[R1-ipsec-policy-manual-huawei-10]sa string-key outbound esp cipher huawei
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ipsec policy huawei
在R1上配置靜態(tài)路由
[R1]ip route-static 0.0.0.0 0 192.168.12.2
最終效果：PC1ping通PC2
最終效果：PC2pingPC1
在R1的g0/0/0接口抓包
在R3的g0/0/1接口抓包
