当前位置： 首页 > news >正文

IPSec 虚拟专用网实验拓扑图（完整命令）

news 2026/8/22 0:33:39

配置命令和基本参数

路由器配置命令

[AR1]int g0/0/1

[AR1-GigabitEthernet0/0/1]ip add 1.1.3.2 255.255.255.0

[AR1-GigabitEthernet0/0/1]int g0/0/2

[AR1-GigabitEthernet0/0/2]ip add 1.1.5.2 255.255.255.0

防火墙1配置命令

[FW_A]int g 1/0/1

[FW_A-GigabitEthernet1/0/1]ip add 1.1.3.1 255.255.255.0

[FW_A-GigabitEthernet1/0/1]int g1/0/3

[FW_A-GigabitEthernet1/0/3]ip add 10.1.1.1 255.255.255.0

[FW_A-GigabitEthernet1/0/3]q

[FW_A]firewall zone trust

[FW_A-zone-trust]add int g1/0/3

[FW_A-zone-trust]fir

[FW_A-zone-trust]firewall zone untrust

[FW_A-zone-untrust]add int g1/0/1

[FW_A-zone-untrust]q

[FW_A]ip rout

[FW_A]ip route-s

[FW_A]ip route-static 1.1.5.0 255.255.255.0 1.1.3.2

[FW_A]ip route-static 10.1.2.0 255.255.255.0 1.1.3.2

[FW_A]security-policy

[FW_A-policy-security]rule name policy1

[FW_A-policy-security-rule-policy1]source-zone trust

[FW_A-policy-security-rule-policy1]destination-zone untrust

[FW_A-policy-security-rule-policy1]source-address 10.1.1.0 mask 255.255.255.0

[FW_A-policy-security-rule-policy1]destination-address 10.1.2.0 mask 255.255.255

.0

[FW_A-policy-security-rule-policy1]action permit

[FW_A-policy-security-rule-policy1]q

[FW_A-policy-security]rule name policy2

[FW_A-policy-security-rule-policy2]source-zone local

[FW_A-policy-security-rule-policy2]destination-zone untrust

[FW_A-policy-security-rule-policy2]source-address 1.1.3.1 mask 255.255.255.255

[FW_A-policy-security-rule-policy2]destination-address 1.1.5.1 mask 255.255.255.

255

[FW_A-policy-security-rule-policy2]action permit

[FW_A-policy-security-rule-policy2]q

[FW_A-policy-security]rul

[FW_A-policy-security]rule name policy3

[FW_A-policy-security-rule-policy3]source-zone untrust

[FW_A-policy-security-rule-policy3]destination-zone trust

[FW_A-policy-security-rule-policy3]source-address 10.1.2.0 mask 255.255.255.0

[FW_A-policy-security-rule-policy3]destination-address 10.1.1.0 mask 255.255.255

.0

[FW_A-policy-security-rule-policy3]action permit

[FW_A-policy-security-rule-policy3]q

[FW_A-policy-security]rule name policy4

[FW_A-policy-security-rule-policy4]source-zone untrust

[FW_A-policy-security-rule-policy4]destination-zone local

[FW_A-policy-security-rule-policy4]source-address 1.1.5.1 mask 255.255.255.255

[FW_A-policy-security-rule-policy4]destination-address 1.1.3.1 mask 255.255.255.

255

[FW_A-policy-security-rule-policy4]action permit

[FW_A-policy-security-rule-policy4]q

[FW_A-policy-security]q

[FW_A]acl 3000

[FW_A-acl-adv-3000]rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2

.0 0.0.0.255

[FW_A-acl-adv-3000]q

[FW_A]ipsec proposal tran1这个是数字1️⃣，不要敲成字母了

[FW_A-ipsec-proposal-tran1]q

[FW_A]ike proposal 10

[FW_A-ike-proposal-10]q

[FW_A]ike peer b

[FW_A-ike-peer-b]ike-proposal 10

[FW_A-ike-peer-b]remote-add

[FW_A-ike-peer-b]remote-address 1.1.5.1

[FW_A-ike-peer-b]pre-shared-key Test!1234 ⚠️!后面没有空格，前后要保持一致

[FW_A-ike-peer-b]q

[FW_A]ipsec policy map1 10 isakmp这个是数字1️⃣，不要敲成字母了

Info: The ISAKMP policy sequence number should be smaller than the template poli

cy sequence number in the policy group. Otherwise, the ISAKMP policy does not ta

ke effect.

[FW_A-ipsec-policy-isakmp-map1-10]security acl 3000

[FW_A-ipsec-policy-isakmp-map1-10]proposal tran1这个是数字1️⃣，不要敲成字母了

[FW_A-ipsec-policy-isakmp-map1-10]ike-peer b

[FW_A-ipsec-policy-isakmp-map1-10]q

[FW_A]int g1/0/1

[FW_A-GigabitEthernet1/0/1]ipsec policy map1这个map1是数字1️⃣，不要敲成字母了

[FW_A-GigabitEthernet1/0/1]q

防火墙2配置命令

[FW_B]int g 1/0/1

[FW_B-GigabitEthernet1/0/1]ip add 1.1.5.1 255.255.255.0

[FW_B-GigabitEthernet1/0/1]int g1/0/3

[FW_B-GigabitEthernet1/0/3]ip add 10.1.2.1 255.255.255.0

[FW_B-GigabitEthernet1/0/3]q

[FW_B]firewall zone trust

[FW_B-zone-trust]add int g1/0/3

[FW_B-zone-trust]firewall zone untrust

[FW_B-zone-untrust]add int g1/0/1

[FW_B-zone-untrust]q

[FW_B]ip route-static 1.1.3.0 255.255.255.0 1.1.5.2

[FW_B]ip route-static 10.1.1.0 255.255.255.0 1.1.5.2

[FW_B]security-policy

[FW_B-policy-security]rule name policy

[FW_B-policy-security-rule-policy]source-zone trust

[FW_B-policy-security-rule-policy]destination-zone untrust

[FW_B-policy-security-rule-policy]source-address 10.1.2.0 mask 255.255.255.0

[FW_B-policy-security-rule-policy]destination-address 10.1.1.0 mask 255.255.255.

0

[FW_B-policy-security-rule-policy]action permit

[FW_B-policy-security-rule-policy]q

[FW_B-policy-security]rule name policy2

[FW_B-policy-security-rule-policy2]source-zone local

[FW_B-policy-security-rule-policy2]destination-zone untrust

[FW_B-policy-security-rule-policy2]source-address 1.1.5.1 mask 255.255.255.255

[FW_B-policy-security-rule-policy2]destination-address 1.1.3.1 mask 255.255.255.

255

[FW_B-policy-security-rule-policy2]action permit

[FW_B-policy-security-rule-policy2]q

[FW_B-policy-security]rule name policy3

[FW_B-policy-security-rule-policy3]source-zone untrust

[FW_B-policy-security-rule-policy3]destination-zone trust

[FW_B-policy-security-rule-policy3]source-address 10.1.1.0 mask 255.255.255.0

[FW_B-policy-security-rule-policy3]destination-address 10.1.2.0 mask 255.255.255

.0

[FW_B-policy-security-rule-policy3]action permit

[FW_B-policy-security-rule-policy3]q

[FW_B-policy-security]rule name policy4

[FW_B-policy-security-rule-policy4]source-zone untrust

[FW_B-policy-security-rule-policy4]destination-zone local

[FW_B-policy-security-rule-policy4]source-address 1.1.3.1 mask 255.255.255.255

[FW_B-policy-security-rule-policy4]destination-address 1.1.5.1 mask 255.255.255.

255

[FW_B-policy-security-rule-policy4]action permit

[FW_B-policy-security-rule-policy4]q

[FW_B-policy-security]q

[FW_B]acl 3000

[FW_B-acl-adv-3000]rule permit ip source 10.1.2.0 0.0.0.255 des

[FW_B-acl-adv-3000]rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.

1.0 0.0.0.255

[FW_B-acl-adv-3000]q

[FW_B]ipsec proposal tran1这个是数字1️⃣，不要敲成字母了

[FW_B-ipsec-proposal-tran1]q

[FW_B]ike pro

[FW_B]ike proposal 10

[FW_B-ike-proposal-10]q

[FW_B-ike-peer-a]ike-proposal 10

[FW_B-ike-peer-a]remote-address 1.1.3.1

[FW_B-ike-peer-a]pre-shared-key Test!1234⚠️ 前后保持一致

[FW_B-ike-peer-a]q

[FW_B]ipsec policy map1 10 isakmp这个map1是数字1️⃣，不要敲成字母了

Info: The ISAKMP policy sequence number should be smaller than the template poli

cy sequence number in the policy group. Otherwise, the ISAKMP policy does not ta

ke effect.

[FW_B-ipsec-policy-isakmp-map1-10]security acl 3000

[FW_B-ipsec-policy-isakmp-map1-10]proposal tran1这个map1是数字1️⃣，不要敲成字母了

[FW_B-ipsec-policy-isakmp-map1-10]ike-peer a

[FW_B-ipsec-policy-isakmp-map1-10]q

[FW_B]int g1/0/1

[FW_B-GigabitEthernet1/0/1]ipsec policy map1

[FW_B-GigabitEthernet1/0/1]q

验证

隧道建立成功！

http://www.cnnetsun.cn/news/1459697.html

相关文章：

  • JavaScript——异常处理
  • Windows Cleaner终极指南：5分钟彻底解决C盘爆红问题！
  • 全球灌溉控制器：未来几年，年复合增长率（CAGR）高达14.0%
  • 3种方法实现跨设备控制 开源键鼠共享工具Lan Mouse全攻略
  • 预售易货实操拆解：中小商家轻成本拓客，合规落地不踩坑
  • CoPaw模型服务监控与告警体系搭建教程
  • OCR文字识别镜像实测：复杂背景、手写体都能准确识别，效果惊艳
  • 别再只会重启了！手把手教你用BlueScreenView和WhoCrashed精准定位Windows蓝屏元凶
  • 基于拓展卡尔曼滤波的车辆质量与道路坡度估计探索
  • Halcon印字缺陷检测实战：从模板匹配到区域作差的全流程解析
  • Transformer的‘记忆’短板怎么破？从Titans论文看大模型长上下文优化的三个新方向
  • SEO_中小企业必备的SEO优化入门方法指南
  • 避开这3个坑，你的CST FSS仿真结果才准确（周期边界/背景设置/端口校准）
  • 模拟电路小白必看：集成运放10种经典电路实战解析（附电路图）
  • 119K+英语语音资源一键获取：开源批量下载工具让发音数据库构建效率提升10倍
  • 图图的嗨丝造相-Z-Image-Turbo实战教程：结合IP-Adapter实现指定人物形象+渔网袜风格融合
  • ChatGPT vs 文心一言：开发者视角下的5个真实代码测试对比
  • Python 生产代码避坑指南：为什么彻底告别 print()？日志等级、上下文、链路追踪与采样全解析 + 10分钟定位线上支付失败实战
  • Qwen3-ASR-1.7B多语言落地：一带一路项目多语种会议纪要生成
  • SmartPing网络监控实战：从零配置到拓扑图可视化（含常见报错解决）
  • LongAdder为什么那么快？
  • 纯 C# 中使用 FParsec 的高级组合器示例代码
  • 别再被MOS管炸机搞懵了！手把手教你分析米勒平台波形（附实测图）
  • Go项目实战：用Swagger自动生成API文档，告别手写接口说明的烦恼
  • MOS管与三极管的驱动特性对比及选型指南
  • XYC-ALS21C-K1环境光传感器驱动开发与低功耗嵌入式实践
  • 【63页PPT】数字乡村智慧农业顶层设计方案：顶层规划设计、农业大数据、物联网、党建信息化、电商平台、质量追溯、智慧旅游
  • 2025年IDM激活终极指南：简单三步实现永久免费使用
  • ESP32 C3 vs S3开发板功耗实测：如何为你的IoT项目选择更省电的方案？
  • 优化Docker镜像拉取：解决pull错误与加速下载的实用指南