h3csecpath防火墙综合组网中bims应用案例

BIMSServer：WindowsXP，BIMS1、BIMSServer2..PAGEPAGE5#sysnameB#l2tp #ikelocal-nameB #firewallpacket-filterfirewallpacket-filterdefaultpermitbims bimsdevice-idBeiJing_SecPath1000F_1 //配置BIMS设备标识符bimsipaddress00port80 bimsinterval10 //配置BIMS请求间隔时间bimssharekeycipher=W6JJ`N_LBKQ=^Q`MAF4<1!! //配置BIMS共享密钥#domain //配置L2TPippool11#local-user passwordcipher.]@USE=B,53Q=^Q`MAF4<1!!service-typetelnetlevellocal-user passwordcipher7-CZB#/YX]KQ=^Q`MAF4<1!!service-typeppp#iked #ikepeerl pre-shared-key123456id-typenamenattraversal#ikepeershanghai exchange-modeaggressiveid-typenamenattraversal#ikepeerw pre-shared-key123456id-typenamenattraversal#ipsecproposal espauthentication-algorithmsha1espencryption-algorithm3des#ipsecproposal //配置IPSECespauthentication-algorithmsha1espencryption-algorithm3des#ipsecproposal //配置IPSECespauthentication-algorithmsha1estion-algorithm3des#ipsecpolicy-template //创建IPSECike-peerlacproposal#ipsecpolicy-template ike-peershanghaiproposalshanghaiipsecpolicy-template ike-peerwuhanproposalwuhanipsecpolicypol11isakmptemplatew #ipsecpolicypol12isakmptemplates #ipsecpolicypol13isakmptemplatel #aclnumber rule2permitipsource155rule3denyi#interfaceVirtual-Template1 pppauthentication-modechapipaddressremoteaddresspool1#interfaceipaddress#interfaceipaddressnatoutboundnatserverprotocoltcpglobal00wwwinside00wwwnatserverprotocolicmpglobal00inside00ipsecpolicypol1 //启用IPSECPolicy#firewallzoneaddinterfaceGigabitEthernet0/0setpriority85#firewallzoneaddinterfaceaddinterfaceVirtual-Template1setpriority5#l2tp-group allowl2tpvirtual-templatetunnelpasswordcipher#iproute-static #user-interfacevty04protocolinboundtelnet##sysnameS#ikelocal-names #firewallpacket-filterfirewallpacket-filterdefaultpermit#bims //启用bimsdevice-idShangHai_SecPath100F_1 //配置BIMS设备标识符bimsipaddress2000port80 //配置BIMS服务器的IP地址bimsinterval10 //配置BIMS请求间隔时间bimsboot bimssharekeycipher BIMS#iked #ikepeerb pre-shared-key123456id-typenameremote-namebeijingnattraversal#ipsecproposal //配置IPSECespauthentication-algorithmespencryption-algorithm3#ipsecpolicypol11isakmpsecurityacl3001ike-peerbeijingproposal

#aclnumber rule1permitipsource155rule2denyiaclnumber rule0permitipsource55destinationrule1denyi#interfaceipaddresstcpmss1024ipaddressnatoutboundipsecpolicy #firewallzoneaddinterfaceEthernet0/0setpriority85#firewallzoneuntrustaddinterfaceEthernet1/0setpriority5#iproute-static ##sysnameW#ikelocal-namew #firewallpacket-filterfirewallpacket-filterdefaultpermitbims ..bimsdevice-idWuHan_SecPath10F_1 //配置BIMS设备标识符bimsipaddress2000port80 bimsinterval10 //配置BIMS请求间隔时间bimssharekeycipher=W6JJ`N_LBKQ=^Q`MAF4<1!!//配置BIMS共享密钥#iked #ikepeerb pre-shared-key123456id-typenameremote-namebeijingnattraversal#ipsecproposal espauthentication-algorithmsha1espencryption-algorithm3des#ipsecpolicypol11isakmp securityacl3001ike-peerbeijingproposal#aclnumber rule1permitipsource155rule2denyiaclnumber rule0permitipsource55destinationrule1denyi#interfaceipaddress#speed10duplexhalftcpmss1024ipaddressnatoutboundipsecpolicyp #firew