华为AR系列路由器使用策略模板建立ipsec v*n专用线路
display current-configuration
[V200R003C00]
sysname ZB
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
clock timezone China-Standard-Time minus 08:00:00
portal local-server load portalpage.zip
drop illegal-mac alarm
set cpu-usage threshold 80 restore 75
acl number 3000
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
rule 10 deny ip
ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128
ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96
ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name FA
remote-address 1.1.1.1
ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %K8m.Nt84DZ}e#<0`8bmE3Uw}%
local-user admin service-type http
firewall zone Local
priority 15
interface GigabitEthernet0/0/0
ip address 192.168.2.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 2.2.2.1 255.255.255.0
ipsec policy 1
interface GigabitEthernet0/0/2
interface NULL0
ip route-static 0.0.0.0 0.0.0.0 2.2.2.2
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
wlan ac
return
##上边是总部路由器配置
[FA]display current-configuration
[V200R003C00]
sysname FA
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
clock timezone China-Standard-Time minus 08:00:00
portal local-server load portalpage.zip
drop illegal-mac alarm
set cpu-usage threshold 80 restore 75
acl number 3000
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 10 deny ip
ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128
ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96
ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name ZB
remote-address 2.2.2.1
ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %K8m.Nt84DZ}e#<0`8bmE3Uw}%
local-user admin service-type http
firewall zone Local
priority 15
interface GigabitEthernet0/0/0
ip address 1.1.1.1 255.255.255.0
ipsec policy 1
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
interface GigabitEthernet0/0/2
interface NULL0
ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
wlan ac
return
[FA]
[FA]
Please check whether system data has been changed, and save data in time
Configuration console time out, please press any key to log on
dis display cu display current-configuration [V200R003C00] # sysname FA # snmp-agent local-engineid 800007DB03000000000000 snmp-agent # clock timezone China-Standard-Time minus 08:00:00 # portal local-server load portalpage.zip # drop illegal-mac alarm # set cpu-usage threshold 80 restore 75 # acl number 3000 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255rule 10 deny ip
ipsec proposal 1
esp authentication-algorithm sha1
esp encryption-algorithm aes-128
ike proposal 5
encryption-algorithm aes-cbc-128
dh group14
authentication-algorithm aes-xcbc-mac-96
ike peer 1 v2
pre-shared-key simple 12345
ike-proposal 5
remote-name ZB
remote-address 2.2.2.1
ipsec policy 1 1 isakmp
security acl 3000
ike-peer 1
proposal 1
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %K8m.Nt84DZ}e#<0`8bmE3Uw}%
local-user admin service-type http
firewall zone Local
priority 15
interface GigabitEthernet0/0/0
ip address 1.1.1.1 255.255.255.0
ipsec policy 1
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
interface GigabitEthernet0/0/2
interface NULL0
ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
wlan ac
return
上边是分支路由器配置
display current-configuration
[V200R003C00]
sysname inter
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
clock timezone China-Standard-Time minus 08:00:00
portal local-server load portalpage.zip
drop illegal-mac alarm
set cpu-usage threshold 80 restore 75
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %K8m.Nt84DZ}e#<0`8bmE3Uw}%
local-user admin service-type http
firewall zone Local
priority 15
interface GigabitEthernet0/0/0
ip address 1.1.1.2 255.255.255.0
interface GigabitEthernet0/0/1
ip address 2.2.2.2 255.255.255.0
interface GigabitEthernet0/0/2
interface NULL0
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
wlan ac
return
上边上互联网配置