华为USG防火墙 IPsec ***配置

实验拓扑

使用华为ensp 1.2.00.370模拟器

实验需求

USG-1和USG-2模拟企业边缘设备，分别在2台设备上配置NAT和IPsec ×××实现2边私网可以通过×××互相通信

实验配置

R1 IP地址配置省略

USG-1配置

[USG-1]firewall zone trust          //配置trust区域

[USG-1-zone-trust]add interface g0/0/0    //将接口加入trust区域

[USG-1-zone-trust]quit

[USG-1]firewall zone untrust           //配置untrust区域

[USG-1-zone-untrust]add int g0/0/1          //将接口加入untrust区域

[USG-1-zone-untrust]quit

[USG-1]int g0/0/0

[USG-1-GigabitEthernet0/0/0]ip add 192.168.10.1 24

[USG-1-GigabitEthernet0/0/0]int g0/0/1

[USG-1-GigabitEthernet0/0/1]ip add 11.0.0.2 24

[USG-1-GigabitEthernet0/0/1]quit

[USG-1]ip route-static 0.0.0.0 0.0.0.0 11.0.0.1   //配置默认路由上公网

[USG-1]nat-policy interzone trust untrust outbound 

//进入trust到untrust区域out方向的策略视图

[USG-1-nat-policy-interzone-trust-untrust-outbound]policy 1     //创建一个策略

[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.10.0 0.0.0.255

[USG-1-nat-policy-interzone-trust-untrust-outbound-1]policy destination 192.168.20.0 0.0.0.255

[USG-1-nat-policy-interzone-trust-untrust-outbound-1]action no-nat 

//以上三条命令意思是不允许将源为192.168.10.0/24网段目标为192.168.20.0/24网段的数据包进行NAT

[USG-1-nat-policy-interzone-trust-untrust-outbound-1]quit

[USG-1-nat-policy-interzone-trust-untrust-outbound]policy 2  //创建策略2

[USG-1-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

//允许对源IP进行NAT

[USG-1-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/1

//对接口G0/0/1地址复用

[USG-1-nat-policy-interzone-trust-untrust-outbound-2]quit

[USG-1-nat-policy-interzone-trust-untrust-outbound]quit

---------------------------阶段一-----------------------------------------------------

[USG-1]ike proposal 1     //配置一个安全提议

[USG-1-ike-proposal-1]authentication-method pre-share   //配置IKE认证方式为预共享密钥

[USG-1-ike-proposal-1]authentication-algorithm sha1   //配置IKE认证算法为sha1

[USG-1-ike-proposal-1]integrity-algorithm aes-xcbc-96  //配置IKE完整性算法

[USG-1-ike-proposal-1]dh group2  //配置IKE密钥协商DH组

[USG-1-ike-proposal-1]quit

[USG-1]ike peer USG-2             //创建一个IKE对等体名字为USG-2

[USG-1-ike-peer-usg-2]pre-shared-key abc123    //配置预共享密钥

[USG-1-ike-peer-usg-2]remote-address 12.0.0.2  //配置对等体IP地址

[USG-1-ike-peer-usg-2]ike-proposal 1       //调用ike安全提议

[USG-1-ike-peer-usg-2]quit

----------------------------阶段二-----------------------------------------------------

[USG-1]ipsec proposal test        //配置一个ipsec安全提议

[USG-1-ipsec-proposal-test]encapsulation-mode tunnel    //封装方式采用隧道

[USG-1-ipsec-proposal-test]transform esp    //配置IPSEC安全协议为ESP

[USG-1-ipsec-proposal-test]esp encryption-algorithm aes   //配置ESP协议加密算法为aes

[USG-1-ipsec-proposal-test]esp authentication-algorithm sha1  //配置ESP协议认证算法

[USG-1-ipsec-proposal-test]quit

[USG-1]acl 3000         //创建一个ACL定义感兴趣流

[USG-1-acl-adv-3000]rule permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

[USG-1]ipsec policy map 1 isakmp    //创建一个安全策略，名称为map

[USG-1-ipsec-policy-isakmp-map-1]ike-peer USG-2    //调用ike对等体

[USG-1-ipsec-policy-isakmp-map-1]proposal test     //调用IPsec安全提议

[USG-1-ipsec-policy-isakmp-map-1]security acl 3000   //配置感兴趣流

[USG-1-ipsec-policy-isakmp-map-1]quit

[USG-1]int g0/0/1

[USG-1-GigabitEthernet0/0/1]ipsec policy map     //在外网口上调用安全策略

区域间策略配置

[USG-1]policy interzone trust untrust outbound .

//进入trust到untrust区域out方向策略视图

[USG-1-policy-interzone-trust-untrust-outbound]policy 1    //创建策略

[USG-1-policy-interzone-trust-untrust-outbound-1]action permit  

//允许trust区域所有主机访问untrust区域 

[USG-1-policy-interzone-trust-untrust-outbound-1]quit

[USG-1-policy-interzone-trust-untrust-outbound]quit

[USG-1]policy interzone trust untrust inbound 

//进入trust区域到untrust区域的in方向策略视图

[USG-1-policy-interzone-trust-untrust-inbound]policy 1

[USG-1-policy-interzone-trust-untrust-inbound-1]policy source 192.168.20.0 0.0.0.255

[USG-1-policy-interzone-trust-untrust-inbound-1]policy destination 192.168.10.0 0.0.0.255

[USG-1-policy-interzone-trust-untrust-inbound-1]action permit 

//以上命令为允许数据包源地址为192.168.20.0/24网段和目标地址为192.168.10.0/24网段的流量过

[USG-1-policy-interzone-trust-untrust-inbound-1]quit

[USG-1-policy-interzone-trust-untrust-inbound]quit

[USG-1]policy interzone local untrust inbound

//进入local区域到untrust区域的in方向策略视图

[USG-1-policy-interzone-local-untrust-inbound]policy 1

[USG-1-policy-interzone-local-untrust-inbound-1]policy source 12.0.0.2 0

[USG-1-policy-interzone-local-untrust-inbound-1]policy destination 11.0.0.2 0

[USG-1-policy-interzone-local-untrust-inbound-1]action permit 

//允许源地址是12.0.0.2目标地址是11.0.0.2的数据包访问

USG-2配置

[USG-2]firewall zone trust 

[USG-2-zone-trust]add int g0/0/0

[USG-2-zone-trust]quit

[USG-2]firewall zone untrust 

[USG-2-zone-untrust]add int g0/0/1

[USG-2-zone-untrust]quit

[USG-2]int g0/0/0

[USG-2-GigabitEthernet0/0/0]ip add 192.168.20.1 24

[USG-2-GigabitEthernet0/0/0]int g0/0/1

[USG-2-GigabitEthernet0/0/1]ip add 12.0.0.2 24

[USG-2-GigabitEthernet0/0/1]quit

[USG-2]ip route-static 0.0.0.0 0.0.0.0 12.0.0.1

[USG-2]nat-policy interzone trust untrust outbound 

[USG-2-nat-policy-interzone-trust-untrust-outbound]policy 1

[USG-2-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.20.0 0.0.0.255

[USG-2-nat-policy-interzone-trust-untrust-outbound-1]policy destination 192.168.10.0 0.0.0.255

[USG-2-nat-policy-interzone-trust-untrust-outbound-1]action no-nat 

[USG-2-nat-policy-interzone-trust-untrust-outbound-1]quit

[USG-2-nat-policy-interzone-trust-untrust-outbound]policy 2

[USG-2-nat-policy-interzone-trust-untrust-outbound-2]action source-nat 

[USG-2-nat-policy-interzone-trust-untrust-outbound-2]easy-ip GigabitEthernet0/0/1

[USG-2-nat-policy-interzone-trust-untrust-outbound-2]quit

[USG-2-nat-policy-interzone-trust-untrust-outbound]quit

[USG-2]ike proposal 1

[USG-2-ike-proposal-1]authentication-method pre-share 

[USG-2-ike-proposal-1]authentication-algorithm sha1 

[USG-2-ike-proposal-1]integrity-algorithm aes-xcbc-96 

[USG-2-ike-proposal-1]dh group2

[USG-2-ike-proposal-1]quit

[USG-2]ike peer USG-A

[USG-2-ike-peer-usg-a]pre-shared-key abc123

[USG-2-ike-peer-usg-a]ike-proposal 1

[USG-2-ike-peer-usg-a]remote-address 11.0.0.2

[USG-2-ike-peer-usg-a]quit

[USG-2]ipsec proposal test

[USG-2-ipsec-proposal-test]encapsulation-mode tunnel 

[USG-2-ipsec-proposal-test]transform esp 

[USG-2-ipsec-proposal-test]esp encryption-algorithm aes

[USG-2-ipsec-proposal-test]esp authentication-algorithm sha1 

[USG-2-ipsec-proposal-test]quit

[USG-2]acl 3000

[USG-2-acl-adv-3000]rule permit ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

[USG-2-acl-adv-3000]quit

[USG-2]ipsec policy map 1 isakmp 

[USG-2-ipsec-policy-isakmp-map-1]ike-peer USG-A

[USG-2-ipsec-policy-isakmp-map-1]proposal test

[USG-2-ipsec-policy-isakmp-map-1]security acl 3000

[USG-2-ipsec-policy-isakmp-map-1]quit

[USG-2]int g0/0/1

[USG-2-GigabitEthernet0/0/1]ipsec policy map

[USG-2-GigabitEthernet0/0/1]quit

[USG-2]policy interzone trust untrust outbound 

[USG-2-policy-interzone-trust-untrust-outbound]policy 1

[USG-2-policy-interzone-trust-untrust-outbound-1]action permit 

[USG-2-policy-interzone-trust-untrust-outbound-1]quit

[USG-2-policy-interzone-trust-untrust-outbound]quit

[USG-2]policy interzone trust untrust inbound 

[USG-2-policy-interzone-trust-untrust-inbound]policy 1

[USG-2-policy-interzone-trust-untrust-inbound-1]policy source 192.168.10.0 0.0.0.255

[USG-2-policy-interzone-trust-untrust-inbound-1]policy destination 192.168.20.0 0.0.0.255

[USG-2-policy-interzone-trust-untrust-inbound-1]action permit 

[USG-2-policy-interzone-trust-untrust-inbound-1]quit

[USG-2-policy-interzone-trust-untrust-inbound]quit

[USG-2]policy interzone local untrust inbound 

[USG-2-policy-interzone-local-untrust-inbound]policy 1

[USG-2-policy-interzone-local-untrust-inbound-1]policy source 11.0.0.2 0

[USG-2-policy-interzone-local-untrust-inbound-1]policy destination 12.0.0.2 0

[USG-2-policy-interzone-local-untrust-inbound-1]action permit 

使用C1(192.168.10.10)去ping C2(192.168.20.10)

使用dispaly ike sa和display ipsec sa来查看邻居建立情况

转载于:https://blog.51cto.com/sunjie123/1742580