一 组网说明
如上图：防火墙1和防火墙2建立IPSEC vpn，使用ikev1协议，并且防火墙侧放通明细的防火墙策略
二 设备配置
2.1 FW1设备配置
sysname FW1
#
ip unreachables enable
ip ttl-expires enable
#
lldp global enable
#
acl advanced 3000 //NAT转换数据流
description NAT
rule 0 deny ip source 192.168.10.1 0 destination 192.168.20.1 0
rule 100 permit ip
#
acl advanced 3001 //IPSEC数据流
description IPSEC
rule 0 permit ip source 192.168.10.1 0 destination 192.168.20.1 0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 202.1.1.1 255.255.255.0
nat outbound 3000 //出接口调用nat和ipsec
ipsec apply policy 1
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
ip address 192.168.1.254 255.255.255.0
#
ike keychain FW2 //ipsec第一阶段配置
pre-shared-key address 203.1.1.1 255.255.255.255 key simple 123
#
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
#
ike profile FW2
keychain FW2
match remote identity address 203.1.1.1 255.255.255.255
proposal 1
#
ipsec transform-set 1 //ipsec第二阶段配置
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#
ipsec policy 1 1 isakmp
transform-set 1
security acl 3001
remote-address 203.1.1.1
ike-profile FW2 //调用ikev1-profile
#
security-zone name Trust //接口加入安全域
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/0
#
ip route-static 0.0.0.0 0 202.1.1.2
ip route-static 192.168.10.1 32 192.168.1.1
#
security-policy ip
rule 0 name trust-to-untrust //snat内网访问外网的策略
action pass
source-zone trust
destination-zone untrust
rule 1 name local-to-untrust //互联网接口建立ipsec，协议ike、esp、ah等
action pass
source-zone local
destination-zone untrust
service ike
service ipsec-esp
service ipsec-ah
rule 2 name untrust-to-local
action pass
source-zone untrust
destination-zone local
service ike
service ipsec-esp
service ipsec-ah
rule 3 name untrust-to-trust//配置最终业务互访策略，内网访问外网（前面rule 0已经配置），外网访问内网的rule 3策略
action pass
source-zone untrust
