ipsec的手工配置安全策略相关实验
一、实验设备：
3台PC，3台H3C SecPath F100-C防火墙，1台华为Quidway S3526交换机，网线若干。
二、实验拓扑：
三、 实验说明：
1、
要求在
FW-1
与
FW-2
、
FW-1
与
FW-3
之间建立
×××
，实现内网通讯（即
PC1
与
PC2
能通讯、
PC1
能与
PC3
通讯）。
四、 实验步骤具体配置：
FW-1
：
system-view
interface Ethernet0/1
ip add 1.1.1.1 24
interface Ethernet0/2
ip add 192.168.1.1 24
quit
firewall zone trust
add interface Ethernet0/2
quit
firewall zone untrust
add interface Ethernet0/1
quit
ip route-static 0.0.0.0 0 1.1.1.2
acl number 3000
rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 20 deny ip source any destination any
quit
acl number 3001
rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
rule 20 deny ip source any destination any
quit
ipsec proposal zhu-1
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
esp encryption-algorithm des
quit
ipsec proposal zhu-2
encapsulation-mode tunnel
transform esp
esp authentication-algorithm md5
esp encryption-algorithm des
display ipsec proposal
quit
ipsec policy policy1 10 manual
sec acl 3000
proposal zhu-1
tunnel local 1.1.1.1
tunnel remote 2.1.1.1
sa spi outbound esp 12345
sa spi inbound esp 54321
sa string-key outbound esp zzu
sa string-key inbound esp zzdx
quit
ipsec policy policy1 20 manual
sec acl 3001
proposal zhu-2
tunnel local 1.1.1.1
tunnel remote 3.1.1.1
sa spi outbound esp 123456
sa spi inbound esp 654321
sa string-key outbound esp abcbef
sa string-key inbound esp qazwsx
quit
interface Ethernet0/1
ipsec policy policy1
quit
FW-2
：
system-view
interface Ethernet0/1
ip add 2.1.1.1 24
interface Ethernet0/2
ip add 192.168.2.1 24
quit
firewall zone trust
add interface Ethernet0/2
quit
firewall zone untrust
add interface Ethernet0/1
quit
ip route-static 0.0.0.0 0 2.1.1.2
acl number 3000
rule 10 permit ip source 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255
rule 20 deny ip source any dest any
quit
ipsec propo zhu
enca tunnel
trans esp
es auth md5
esp enc des
quit
ipsec policy policy2 10 manual
sec acl 3000
propo zhu
tun lo 2.1.1.1
tun remo 1.1.1.1
sa spi inbo esp 12345
sa string inbo esp zzu
sa spi outbo esp 54321
sa str outbo esp zzdx
quit
inter Ethernet0/1
ipsec poli policy2
FW-3
：
system-view
firewall zone trust
add interface Ethernet0/2
quit
firewall zone untrust
add interface Ethernet0/1
interface Ethernet0/1
ip add 3.1.1.1 24
interface Ethernet0/2
ip add 192.168.3.1 24
quit
ip route-static 0.0.0.0 0 3.1.1.2
acl number 3001
rule 10 permit ip source 192.168.3.0 0.0.0.255 dest 192.168.1.0 0.0.0.255
rule 20 deny ip source any dest any
quit
ipsec propo zhu-11
enca tunnel
trans esp
es auth md5
esp enc des
quit
ipsec policy policy3 20 manual
sec acl 3001
propo zhu-11
tun lo 3.1.1.1
tun remo 1.1.1.1
sa spi inbo esp 123456
sa string inbo esp abcbef
sa spi outbo esp 654321
sa str outbo esp qazwsx
quit
inter Ethernet0/1
ipsec poli policy3
quit
SW
：
system-view
vlan 3
vlan 7
vlan 10
quit
interface Vlan-interface3
ip address 2.1.1.2 255.255.255.0
interface Vlan-interface7
ip address 3.1.1.2 255.255.255.0
interface Vlan-interface10
ip address 1.1.1.2 255.255.255.0
quit
interface Ethernet0/1
port access vlan 10
interface Ethernet0/3
port access vlan 3
interface Ethernet0/7
port access vlan 7
测试：
1、
PC1
与
PC2
之间：
2.、PC1与PC3之间
