214
Configuration guidelines
The IKE negotiation mode must be aggressive because Router B uses a dynamic IP address.
You must configure NAT traversal at both ends of the IPsec tunnel because one end of the tunnel
uses a public IP address but the other end uses a private IP address.
Configuration procedure
1. Configure Router A:
# Specify a name for the local security gateway.
<RouterA> system-view
[RouterA] ike local-name routera
# Configure an ACL.
[RouterA] acl number 3101
[RouterA-acl-adv-3101] rule 0 permit ip source 172.16.0.0 0.0.0.255 destination
192.168.0.0 0.0.0.255
[RouterA-acl-adv-3101] quit
# Configure an IKE proposal.
[RouterA] ike proposal 1
[RouterA-ike-proposal-1] authentication-algorithm sha
[RouterA-ike-proposal-1] authentication-method pre-share
[RouterA-ike-proposal-1] encryption-algorithm 3des-cbc
[RouterA-ike-proposal-1] dh group2
# Configure an IKE peer.
[RouterA] ike peer peer
[RouterA-ike-peer-peer] exchange-mode aggressive
[RouterA-ike-peer-peer] pre-shared-key abc
[RouterA-ike-peer-peer] id-type name
[RouterA-ike-peer-peer] remote-name routerb
[RouterA-ike-peer-peer] nat traversal
[RouterA-ike-peer-peer] quit
# Configure an IPsec transform set named tran1.
[RouterA] ipsec transform-set tran1
[RouterA-ipsec-transform-set-tran1] encapsulation-mode tunnel
[RouterA-ipsec-transform-set-tran1] transform esp
[RouterA-ipsec-transform-set-tran1] esp encryption-algorithm 3des
[RouterA-ipsec-transform-set-tran1] esp authentication-algorithm sha1
[RouterA-ipsec-transform-set-tran1] quit
# Create an IPsec policy, specifying to set up SAs through IKE negotiation.
[RouterA] ipsec policy policy 10 isakmp
# Configure the IPsec policy to reference the IKE peer.
[RouterA-ipsec-policy-isakmp-policy-10] ike-peer peer
# Configure the IPsec policy to reference ACL 3101.
[RouterA-ipsec-policy-isakmp-policy-10] security acl 3101
# Configure the IPsec policy to reference IPsec transform set tran1.
[RouterA-ipsec-policy-isakmp-policy-10] transform-set tran1
[RouterA-ipsec-policy-isakmp-policy-10] quit
# Configure the IP address of interface Serial 2/0 and apply the IPsec policy to the interface.
[RouterA] interface serial 2/0
[RouterA-Serial2/0] ip address 100.1.1.1 255.255.255.0
To Next Page
Loading...
Need help?
General
