ipsec ***_第1张图片 

简单需求:

上海作为总部，分别与苏州、成都、广州各个分部用H3C路由设备建立IKE ***隧道，但出差的移动用户不能访问公司内网，想在上海总部架设***服务器供移动用户拨入使用

总部的配置：
sys
sys R1
ike local-name zongbu
int e1/0/1
ip addr 192.168.1.1 24
quit
ike peer chengdu
exchange-mode aggressive
per-shared-key cipher chengdu
id-type name
remote-name chengdu
nat traversal 
quit
ike peer suzhou
exchange-mode aggressive
per-shared-key cipher suzhou
id-type name
remote-name suzhou
nat traversal
quit
ike peer guangzhou
exchange-mode aggressive
per-shared-key cipher guangzhou
id-type name
remote-name guangzhou
nat traversal
quit
ipsec proposal default
quit
ipsec policy-template chengd 1
ike-peer chengdu
proposal default
quit
ipsec policy-template suz 1
ike-peer suz
proposal default
quit
ipsec policy-template guangz 1
ike-peer guangz
proposal default
quit
ipsec policy zongbu 10 isakmp template chengd
ipsec policy zongbu 20 isakmp template suz
ipsec policy zongbu 30 isakmp template guangz
int loopback 0
ip addr 10.10.10.1 32
quit
int tunnel 0
ip addr 1.1.1.1 24
source loopback0
destination 20.20.20.1
quit
int tunnel 1
ip addr 2.2.2.1 24
source loopback 0
destination 30.30.30.1
quit
int tunnel 2
ip addr 3.3.3.1 24
source loopback 0
destination 40.40.40.1
quit
int e1/0/21
ip addr 212.2.2.214 24
ipsec policy zongbu
quit

成都分部
sys
ike local-name chengdu
int e1/0/1
ip addr 192.168.2.1 24
quit
ike peer zongbu
exchange-mode aggressive
per-shared-key cipher zongbu
id-type name
remote-name zongbu
remote-address 212.2.2.214
nat traversal
quit
acl number 3001
rule 0 permit ip source 20.20.20.1 0 destination 10.10.10.1 0
quit
ipsec proposal default
int loopback 0
ip addr 20.20.20.1 32
quit
ipsec policy chengdu isakmp 10
security acl 3001
ike-peer zongbu
proposal default
quit
int e1/0/21
ip addr 213.1.1.1 24
ipsec policy chengdu
quit

苏州分部

sys
ike local-name suzhou
int e1/0/1
ip addr 192.168.2.1 24
quit
ike peer zongbu
exchange-mode aggressive
per-shared-key cipher zongbu
id-type name
remote-name zongbu
remote-address 212.2.2.214
nat traversal
quit
acl number 3001
rule 0 permit ip source 30.30.30.1 0 destination 10.10.10.1 0
quit
ipsec proposal default
ipsec policy suzhou isakmp 10
security acl 3001
ike-peer zongbu
proposal default
quit
int tunnel 0
ip addr 2.2.2.2 24
source loopback 0
destination 10.10.10.1
quit
int loopback 0
ip addr 30.30.30.1 32
quit
int e1/0/21
ip addr 213.1.1.1 24
ipsec policy suzhou
quit


广州分部

sys
ike local-name suzhou
int e1/0/1
ip addr 192.168.2.1 24
quit
ike peer zongbu
exchange-mode aggressive
per-shared-key cipher zongbu
id-type name
remote-name zongbu
remote-address 212.2.2.214
nat traversal
quit
acl number 3001
rule 0 permit ip source 40.40.40.1 0 destination 10.10.10.1 0
quit
ipsec proposal default
ipsec policy guangzhou isakmp 10
security acl 3001
ike-peer zongbu
proposal default
quit
int e1/0/21
ip addr 214.1.1.1 24
ipsec policy guangzhou
quit
int loopback 0
ip addr 40.40.40.1 32
quit
int tunnel 0
ip addr 3.3.3.2 24
source loopback 0
destination 10.10.10.1
quit