企业官网建设流程全解析

一 组网说明

 

左侧为总部设备，右侧为分支设备，总部和分支设备建立IPSEC VPN，但是分支IPSEC设备在NAT设备内部，即ZB-R设备和FZ-VPN设备建立IPSEC VPN。

二 设备配置

2.1 ZB-R设备配置

sysname ZB-R

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 202.1.1.1 255.255.255.0

nat outbound 3000

ipsec apply policy 1

#

ip route-static 0.0.0.0 0 202.1.1.2

ip route-static 10.1.1.0 24 192.168.1.2

#

acl advanced 3000

description NAT

rule 0 deny ip source 10.1.1.1 0 destination 10.2.1.1 0

rule 100 permit ip

#

acl advanced 3001

description ipsec

rule 0 permit ip source 10.1.1.1 0 destination 10.2.1.1 0

#

ike keychain 1

match local address 202.1.1.1

pre-shared-key hostname fenzhi key simple 123

#

ike proposal 1

encryption-algorithm 3des-cbc

authentication-algorithm md5

#

ike profile 1

keychain 1

exchange-mode aggressive

match remote identity fqdn fenzhi

match local address 202.1.1.1

proposal 1 

#

ipsec transform-set 1

esp encryption-algorithm 3des-cbc 

esp authentication-algorithm md5 

#

ipsec policy 1 1 isakmp

transform-set 1 

security acl 3001 

local-address 202.1.1.1

remote-address fenzhi

remote-address 203.1.1.1

ike-profile 1

#

2.2 FZ-VPN设备配置

sysname FZ-VPN

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 192.168.2.5 255.255.255.252

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 192.168.2.2 255.255.255.252

ipsec apply policy 1

#

ip route-static 0.0.0.0 0 192.168.2.1

ip route-static 10.2.1.0 24 192.168.2.6

#

acl advanced 3001

description ipsec

rule 0 permit ip source 10.2.1.1 0 destination 10.1.1.1 0

# 

ipsec transform-set 1

esp encryption-algorithm 3des-cbc 

esp authentication-algorithm md5 

#

ipsec policy 1 1 isakmp

transform-set 1 

security acl 3001 

remote-address 202.1.1.1

ike-profile 1

#

ike identity fqdn fenzhi

#

ike keychain 1 

pre-shared-key address 202.1.1.1 255.255.255.255 key simple 123

#

ike proposal 1

encryption-algorithm 3des-cbc

<