H3C與思科動(dòng)態(tài)的IPSEC

1.2AR28-11作為野蠻IPSec隧道發(fā)起方【組網(wǎng)圖】AR29-11 Cisco1721【需求】AR28-11通過(guò)ADSL撥號(hào)訪問(wèn)Internet,ip地址不固定；Cisco1721則通過(guò)固定ip地址接入InternetoIPSec隧道保護(hù)的數(shù)據(jù)流：中心AR28-11局域網(wǎng)段為/24；分支Cisco1721局域網(wǎng)段為/24?！九渲媚_本】AR28-11配置腳本#sysnameQuidway#ikelocal-namehnnytgoodstart //創(chuàng)建ike協(xié)商本端網(wǎng)關(guān)的名字#radiusschemesystem#domainsystem#ikeproposal2 //創(chuàng)建ike安全提議authentication-algorithmmd5#ikepeerhnnytset //創(chuàng)建ike對(duì)等體exchange-modeaggressivepre-shared-keyhnnytgoodstartid-typenameremote-namedingannyjremote-address#ipsecproposalpl //創(chuàng)建IPSec安全提議espencryption-algorithm3des#ipsecpolicypolicy11isakmp//創(chuàng)建IPSec策略securityacl3000ike-peerhnnytsetproposalp1#aclnumber3000 //建立匹配被保護(hù)數(shù)據(jù)流的ACL規(guī)則rule0permitipsource55destination55rule1denyip#interfaceAux0asyncmodeflow#interfaceEthernet0/0ipaddress#interfaceDialer0link-protocolpppipaddressppp-negotiatemtu1450dialerenable-circulardialer-group1ipsecpolicypolicy1 //在接口上應(yīng)用IPSec策略#interfaceNULL0#FTPserverenable#iproute-staticdialer0preference60Cisco1721配置腳本version12.3!hostnamedingannyj!enablepasswordcisco!cryptoisakmppolicy100hashmd5authenticationpre-share //配置isakmp策略!cryptoisakmpkeyhuaweihostnamehnnytgoodstart//Cisco作響應(yīng)方必須配置cryptoisakmpidentityhostnamecryptoipsectransform-sethnnytsetesp-3desesp-md5-hmac//創(chuàng)建IPSec安全提議!cryptodynamic-mapdyna1settransform-sethnnytsetmatchaddress115cryptomaphnnyttrans10ipsec-isakmpdynamicdyna //創(chuàng)建IPSec策略!interfaceFastEthernet0ipaddressiptcpadjust-mss1452speedauto!interfaceFastEthernet1ipaddress48iptcpadjust-mss1452speedautocryptomaphnnyttrans //在接口上應(yīng)用IPSec策略!iprouteFastEthernet1iprouteFastEthernet0access-list115permitip5555access-list115denyipanyany 〃建立匹配被保護(hù)數(shù)據(jù)流的訪問(wèn)歹【I表【配置關(guān)鍵點(diǎn)】采用野蠻模式和Cisco互通時(shí)，Cisco作為隧道發(fā)起方和響應(yīng)方的配置是有區(qū)別的。Cisco作為隧道發(fā)起方：cryptoisakmppeeraddress //Cisco作為發(fā)起方必須配置setaggressive-modepasswordhnnytgoodstartsetaggressive-modeclient-endpointfqdndingannyjCisco作為隧道響應(yīng)方：cryptoisakmpkeyhuaweihostnamehnnytgoodstart //Cisco作為響應(yīng)方必須配置cryptoisakmpidentityhostname【提示】1、 cisco不區(qū)分aggressive模式和main模式。2、 ciscoisakmppolicy提供多種驗(yàn)證策略（pre-share、rsa-encr、rsa-sig）Quidway的ike僅支持pre-shared-key方式。3、 cisco路由器上isakmppolicy必須配置，由于需要指定pre-share驗(yàn)證策略，兩者必須匹配。Quidway的ikeproposal可以不配，默認(rèn)方式也能滿足協(xié)商的要求。4、在cisco的isakmppolicy環(huán)境下和Quidway的ikeproposal環(huán)境下，支持的加密算法會(huì)有一定的區(qū)別。5、 ikesakeepalive不是RFC標(biāo)準(zhǔn)，因此各廠商