华为防火墙基础自学系列 | Hub Spoke IPsec VdPdNd

视频来源：B站《乾颐堂HCIP-HCIE-security安全 2019年录制》

一边学习一边整理老师的课程内容及试验笔记，并与大家分享，侵权即删，谢谢支持！

附上汇总贴：华为防火墙基础自学系列 | 汇总_COCOgsta的博客-CSDN博客

Hub Spke IPSec VPN组网

本组网尝试使用IKE安全策略模板来建立IPSec VPN，策略模板适用于中心站点固定地址，分支站点较多并且使用动态地址的工程环境。

删除S2SVPN环境

FW1和FW2删除IPsec策略。

FW1和FW2删除安全策略。

配置流程图

交换机底层桥接

Hub（FW1）网络配置

修改g0/0/2接口地址

修改默认网关

Spoke1（FW2）网络配置

修改g0/0/2接口地址

修改默认网关

Internet（AR1）网络配置

配置Internet底层网络

Spoke（AR2）网络配置

配置Spoke2底层网络

Hub配置IPsec（Web）

Hub新建IPsec策略

场景为【点到多点】，对端接入类型为【分支网关】，不填写对端IP地址。

配置感兴趣流，接受对方的安全提议。

Hub配置安全策略（Web）

配置地址组，匹配感兴趣的IP地址。

放行安全策略

Hub配置IPsec（CLI）

Hub配置ACL

Hub配置IKE Proposal

Hub配置IKE Peer

Hub配置IPsec proposal

Hub配置IPsec模板

Hub配置IPsec policy

Hub调用IPsec policy

Hub配置地址组

Hub配置安全策略（CLI）

Hub配置安全策略

Spoke1配置IPsec（Web）

Spoke配置IPsec策略方式，和配置点到点场景没有区别。

配置感兴趣流

Spoke1配置安全策略（Web）

放行安全策略

Spoke2配置IPsec

配置ACL

配置IKE proposal

配置IKE peer

配置IPsec proposal

配置IPsec policy

接口下调用ipsec policy

Hub查看IPse状态

在Hub上查看IPsec的状态，和两个Spoke协商成功。

IPsec连通性测试

使用PC1测试到PC2和PC3的连通性。

Hub查看IKE SA

Hub查看IPsec SA

Spoke2查看IPsec SA

实验

SW1

vlan batch 10 11 16 20 30 40 41
interface Ethernet0/0/2description Link_Hub_G0/0/2port link-type accessport default vlan 11
interface Ethernet0/0/10description Link_Internet_G0/0/0port link-type accessport default vlan 11
interface Ethernet0/0/11description Link_Internet_G0/0/1port link-type accessport default vlan 41
interface Ethernet0/0/14description Link_Spoke2_G0/0/1port link-type accessport default vlan 41
interface Ethernet0/0/12description Link_Internet_G0/0/2port link-type accessport default vlan 40
interface Ethernet0/0/6description Link_Spoke1_G0/0/2port link-type accessport default vlan 40
interface Ethernet0/0/13description Link_Spoke2_G0/0/0port link-type accessport default vlan 30
interface Ethernet0/0/22description Link_HCNP_Spoke(PC3)port link-type accessport default vlan 30
复制代码

FW1(Hub)

interface g0/0/1ip address 10.1.1.10 24
interface g0/0/2ip address 202.100.10.10 24
undo ip route-static 0.0.0.0 0.0.0.0 202.100.1.11
ip route-static 0.0.0.0 0.0.0.0 202.100.10.254
// 用图形化界面配置后的结果
acl number 3000rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255rule 10 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255
ike proposal 1authentication-algorithm sha2-256integrity-algorithm aes-xcbc-96 hmac-sha2-256
ike peer ike48143238157exchange-mode autopre-shared-key Huawei@123ike negotiate compatibleike-proposal 1remote-id-type none
ipsec proposal prop48143238157encapsulation-mode autoesp authentication-algorithm sha2-256
ipsec policy-template tpl48143238157 1security acl 3000ike-peer ike48143238157alias hub_ipsecproposal prop48143238157local-address applied-interfacesa duration traffic-based 200000000sa duration time-based 3600
ipsec policy ipsec4814323820 10000 isakmp template tpl48143238157
interface GigabitEthernet0/0/2ipsec policy ipsec4814323820 auto-neg
ip service-set ISAKMP type objectservice 0 protocol udp source-port 0 to 65535 destination-port 5000
security-policyrule name ipsec1source-zone localdestination-zone untrustsource-address 202.100.10.10 mask 255.255.255.255service ISAKMPservice espaction permitrule name ipsec2source-zone untrustdestination-zone localdestination-address 202.100.10.10 mask 255.255.255.255service ISAKMPservice espaction permitrule name ipsec3source-zone trustsource-zone untrustdestination-zone trustdestination-zone untrustsource-address address-set ipsecdestination-address address-set ipsecaction permit
复制代码

FW2(Spoke1)

interface g0/0/1ip address 10.1.2.10 24
interface g0/0/2ip address 202.100.1.10 24
undo ip route-static 0.0.0.0 0.0.0.0 202.100.1.10
ip route-static 0.0.0.0 0.0.0.0 202.100.1.254
复制代码

AR1(Internet)

interface g0/0/0undo portswitchip address 202.100.10.254 24
interface g0/0/1undo portswitchip address 202.100.2.254 24
interface g0/0/2undo portswitchip address 202.100.1.254 24
复制代码

AR2(Spoke2)

interface g0/0/1undo portswitchip address 202.100.2.10 24
interface g0/0/0undo portswitchip address 10.1.3.10 24
ip route-static 0.0.0.0 0.0.0.0 202.100.2.254
ike proposal 10encryption-algorithm aes-cbc-128authentication-algorithm sha2-256
ike peer hub v1exchange-mode mainpre-shared-key simple Huawei@123ike-proposal 10remote-address 202.100.10.10
acl 3000rule permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.00.255
ipsec proposal 10esp encryption-algorithm aes-128esp authentication-algorithm sha1
ipsec policy ipsec_policy 10 isakmpsecurity acl 3000ike-peer hubproposal 10
interface g0/0/1ipsec policy ipsec_policy