H3Cv7版本ipsecovergre配置指导

Ipsecovergre配置RT1和RT3用环回口来模拟私网上的接口。它们的封装方式是先封装ipsec，而后在进行gre的封装，因此在ipsec的ACL中要般配的事两端私网的地址。报文的封装格式：IP公|gre|ip头|esp头|ip私|date|esp尾RT1的主要配置：进入系统试图<H3C>system-view配置接口IP[H3C]interfaceGigabitEthernet0/0创立环回接口：[H3C-GigabitEthernet0/0]quit[H3C]interfaceLoopBack0创立Tunnel口：[H3C-LoopBack0]quit.[H3C]interfaceTunnel0modegre指定Tunnel口源接口地址指定Tunnel口目的端地址[H3C-Tunnel0]quit创立接见控制列表[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]quit创立ipsec安全建议tran1[H3C]ipsectransform-settran1指定安全协议的工作模式为地道模式[H3C-ipsec-transform-set-tran1]encapsulation-modetunnel选择安全协议为esp[H3C-ipsec-transform-set-tran1]protocolesp加密算法为des[H3C-ipsec-transform-set-tran1]espencryption-algorithmdes-cbc考据算法为md5[H3C-ipsec-transform-set-tran1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-tran1]quit配置ikekaychain，创立ike1[H3C]ikekeychainike1配置对端tunnel口的IP和使用的预共享秘钥[H3C-ike-keychain-ike1]quit.创立ikeprofile，名称为profile1[H3C]ikeprofileprofile1绑定ikekeychain[H3C-ike-profile-profile1]keychainike1配置当地封装的IP地址配置对端封装的IP地址[H3C-ike-profile-profile1]matchremoteidentityaddress100.1.1.224[H3C-ike-profile-profile1]quit创立一条ike协商方式的ipsec安全策略，序列号为1，名字为policy1[H3C]ipsecpolicypolicy11isakmp指定引用ACL3000[H3C-ipsec-policy-isakmp-policy1-1]securityacl3000指定引用的ikeprofile为profile1[H3C-ipsec-policy-isakmp-policy1-1]ike-profileprofile1指定引用的安全协议为tran1[H3C-ipsec-policy-isakmp-policy1-1]transform-settran1指定对端地道地址[H3C-ipsec-policy-isakmp-policy1-1]quit进入Tunnel0[H3C]interfaceTunnel0把ipsec策略在Tunnel口奏效[H3C-Tunnel0]ipsecapplypolicypolicy1在三个路由器之间使用rip路由协议[H3C]rip[H3C-rip-1]version2.[H3C-rip-1]undosummaryRT2的主要配置：<H3C>system-view[H3C]interfaceGigabitEthernet0/0[H3C-GigabitEthernet0/0]quit[H3C]interfaceGigabitEthernet0/1[H3C-GigabitEthernet0/1]quit配置rip路由协议[H3C]rip[H3C-rip-1]version2[H3C-rip-1]undosummaryRT3的主要配置：进入系统试图<H3C>system-view配置接口IP[H3C]interfaceGigabitEthernet0/0创立环回接口：[H3C-GigabitEthernet0/0]quit[H3C]interfaceLoopBack0.创立Tunnel口：[H3C-LoopBack0]quit[H3C]interfaceTunnel0modegre指定Tunnel口源接口地址指定Tunnel口目的端地址[H3C-Tunnel0]quit创立接见控制列表[H3C]acladvanced3000[H3C-acl-ipv4-adv-3000]quit创立ipsec安全建议tran1[H3C]ipsectransform-settran1指定安全协议的工作模式为地道模式[H3C-ipsec-transform-set-tran1]encapsulation-modetunnel选择安全协议为esp[H3C-ipsec-transform-set-tran1]protocolesp加密算法为des[H3C-ipsec-transform-set-tran1]espencryption-algorithmdes-cbc考据算法为md5[H3C-ipsec-transform-set-tran1]espauthentication-algorithmmd5[H3C-ipsec-transform-set-tran1]quit配置ikekaychain，创立ike1[H3C]ikekeychainike1.配置对端tunnel口的IP和使用的预共享秘钥[H3C-ike-keychain-ike1]quit创立ikeprofile，名称为profile1[H3C]ikeprofileprofile1绑定ikekeychain[H3C-ike-profile-profile1]keychainike1配置当地封装的IP地址配置对端封装的IP地址[H3C-ike-profile-profile1]matchremoteidentityaddress100.1.1.124[H3C-ike-profile-profile1]quit创立一条ike协商方式的ipsec安全策略，序列号为1，名字为policy1[H3C]ipsecpolicypolicy11isakmp指定引用ACL3000[H3C-ipsec-policy-isakmp-policy1-1]securityacl3000指定引用的ikeprofile为profile1[H3C-ipsec-policy-isakmp-policy1-1]ike-profileprofile1指定引用的安全协议为tran1[H3C-ipsec-policy-isakmp-policy1-1]transform-settran1指定对端地道地址[H3C-ipsec-policy-isakmp-policy1-1]quit进入Tunnel0[H3C]interfaceTunnel0把ipsec策略在Tunnel口奏效[H3C-Tunnel0]ipsecapplypolicypolicy1.配置rip路由协议[H3C]rip[H3C-rip-1]version2[H3C-rip-1]undosummary测试从RT1的环回口来pingRT3的环回口Ping192.168.2.1(192.168.2.1)from192.168.1.1:56databytes,pressCTRL_CtobreakRequesttimeout56bytesfrom192.168.2.1:icmp_seq=1ttl=255time=2.