H3CS9500交換機(jī)IPSec功能的配置

1、h3c s9500交換機(jī)ipsec功能的配置一、組網(wǎng)需求：在網(wǎng)絡(luò)中，當(dāng)發(fā)送方和接收方都對數(shù)據(jù)的安全性和完整性有較高的要求時使用。通過將需要發(fā)送的流量轉(zhuǎn)到ipsec板進(jìn)行相應(yīng)的處理來實(shí)現(xiàn)。二、組網(wǎng)圖：ipsec組網(wǎng)組網(wǎng)圖以上組網(wǎng)圖中vlan 76和vlan 77之間的私網(wǎng)報文通過s9505上所連接的ipsec單板的加密處理實(shí)現(xiàn)了安全通信三、配置步驟：軟件版本：s9500交換機(jī)r1327版本及以后的升級版本硬件版本：需要s9500 lsb1ipsec8db0單板按照上面的組網(wǎng)圖，要實(shí)現(xiàn)pc_a和pc_b之間進(jìn)行互相訪問時采用ipsec協(xié)議族對其數(shù)據(jù)進(jìn)行加密，需要對網(wǎng)絡(luò)進(jìn)行如下配置：1s9505_1

2、設(shè)備上的配置過程# 配置vlan，并將連接pc的接口以及s9505之間互連的接口加入到各自的vlan當(dāng)中s9505_1 vlan 50s9505_1-vlan50 port ethernet 2/1/1s9505_1-vlan50 quits9505_1 vlan 77s9505_1-vlan77 port ethernet 2/1/2s9505_1-vlan77 quit# 配置secblade的module，并將vlan 50和vlan 77配置為security-vlan，同時將配置好的module和插入的ipsec單板關(guān)聯(lián)起來s9505_1 secblade module tests9

3、505_1-secblade-test security-vlan 50s9505_1-secblade-test security-vlan 77s9505_1-secblade-test map to slot 32s9505_1設(shè)備上的secblade的配置過程# 配置接口ip地址secblade_vpn interface gigabitethernet 0/0.50secblade_vpn-gigabitethernet0/0 ip address 172.16.50.2 24secblade_vpn-gigabitethernet0/0 vlan-type dot1q vid 50

4、secblade_vpn-gigabitethernet0/0 quitsecblade_vpn interface gigabitethernet 0/0.77secblade_vpn -gigabitethernet0/0 ip address 10.13.77.2 24secblade_vpn -gigabitethernet0/0 vlan-type dot1q vid 77secblade_vpn -gigabitethernet0/0 quit# 配置acl規(guī)則secblade_vpn acl number 3000secblade_vpn -acl-adv-3000 rule p

5、ermit ip source 10.13.77.0 0.0.0.255 destination 10.13.76.0 0.0.0.255 secblade_vpn -acl-adv-3000 quit# 配置ipsec ikesecblade_vpn ike peer peersecblade_vpn-ike-peer-peer pre-shared-key vpnsecblade_vpn-ike-peer-peer remote-address 172.16.50.1secblade_vpn quit# 配置ipsec提議secblade_vpn router ipsec proposal

6、 h3csecblade_vpn router-ipsec-proposal-tran encapsulation-mode tunnelsecblade_vpn router-ipsec-proposal-tran transform ah-espsecblade_vpn router-ipsec-proposal-tran ah authentication-algorithm sha1secblade_vpn router-ipsec-proposal-tran esp encryption-algorithm 3dessecblade_vpn router-ipsec-proposal

7、-tran esp authentication-algorithm sha1# 配置ipsec策略secblade_vpn ipsec policy h3cpolicy 10 isakmpsecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 ike-peer peersecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 proposal h3csecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 security acl 3000secblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 quit# 在外網(wǎng)子接口上應(yīng)用安全策略secblade_vpn interface gigabitethernet 0/0.50secblade_vpn-gigabitethernet0/0.50 ipsec policy h3cpolicysecblade_vpn-gigabitethernet0/0.50 quit# 配置靜態(tài)路由secblade_vpn ip route-static 10.13.76.0 255.255.255.0 172.16.50.13s9505_2設(shè)備上的配置