华为防火墙网关间通过IKE方式协商IPSec VPN隧道（共享密钥认证）

Posted 2022-05-17 资本家的鱼

组网需求

网络A和网络B分别通过FW_A和FW_B连接到Internet。网络环境描述如下：

• 网络A属于10.1.1.0/24子网，通过接口GigabitEthernet 1/0/3与FW_A连接。
• 网络B属于10.1.2.0/24子网，通过接口GigabitEthernet 1/0/3与FW_B连接。
• FW_A_B路由可达。

通过组网实现如下需求：在FW_A和FW_B之间建立IKE方式的IPSec隧道，使网络A和网络B的用户可通过IPSec隧道互相访问。

配置思路

对于FW_A和FW_B，配置思路相同。如下：

1. 完成接口基本配置。
2. 配置安全策略，允许私网指定网段进行报文交互。
3. 配置到对端内网的路由。
4. 配置IPSec策略。包括配置IPSec策略的基本信息、配置待加密的数据流、配置安全提议的协商参数。

eNSP拓扑

操作步骤

配置FW_A的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_A]interface GigabitEthernet 1/0/3
[FW_A-GigabitEthernet1/0/3]ip add 
[FW_A-GigabitEthernet1/0/3]ip address 10.1.1.1 24
[FW_A-GigabitEthernet1/0/3]quit.
[FW_A]interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1]ip address 1.1.3.1 24
[FW_A-GigabitEthernet1/0/1]quit 
[FW_A]firewall zone trust 
[FW_A-zone-trust]add interface GigabitEthernet 1/0/3
[FW_A-zone-trust]quit
[FW_A]firewall zone untrust 
[FW_A-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_A-zone-untrust]quit

[FW_A]security-policy 
[FW_A-policy-security]rule name policy1
[FW_A-policy-security-rule-policy1]source-zone trust 
[FW_A-policy-security-rule-policy1]destination-zone untrust 
[FW_A-policy-security-rule-policy1]source-address 10.1.1.0 24
[FW_A-policy-security-rule-policy1]destination-address 10.1.2.0 24
[FW_A-policy-security-rule-policy1]action permit 
[FW_A-policy-security-rule-policy1]quit
[FW_A-policy-security]rule name policy2
[FW_A-policy-security-rule-policy2]source-zone untrust 
[FW_A-policy-security-rule-policy2]destination-zone trust 
[FW_A-policy-security-rule-policy2]source-address 10.1.2.0 24
[FW_A-policy-security-rule-policy2]destination-address 10.1.1.0 24
[FW_A-policy-security-rule-policy2]action permit 
[FW_A-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_A-policy-security] rule name policy3
[FW_A-policy-security-rule-policy3] source-zone local
[FW_A-policy-security-rule-policy3] destination-zone untrust
[FW_A-policy-security-rule-policy3] source-address 1.1.3.1 32
[FW_A-policy-security-rule-policy3] destination-address 1.1.5.1 32
[FW_A-policy-security-rule-policy3] action permit
[FW_A-policy-security-rule-policy3] quit
[FW_A-policy-security] rule name policy4
[FW_A-policy-security-rule-policy4] source-zone untrust
[FW_A-policy-security-rule-policy4] destination-zone local
[FW_A-policy-security-rule-policy4] source-address 1.1.5.1 32
[FW_A-policy-security-rule-policy4] destination-address 1.1.3.1 32
[FW_A-policy-security-rule-policy4] action permit
[FW_A-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由，此处假设到达网络B的下一跳地址为1.1.3.254

[FW_A]ip route-static 10.1.2.0 255.255.255.0 1.1.3.254
[FW_A]ip route-static 1.1.5.0 255.255.255.0 1.1.3.254

在FW_A上配置IPSec策略，并在接口上应用此IPSec策略

[FW_A]acl 3000
[FW_A-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2
.0 0.0.0.255
[FW_A-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_A] ipsec proposal tran1
[FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_A-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_A] ike proposal 10
[FW_A-ike-proposal-10] authentication-method pre-share
[FW_A-ike-proposal-10] prf hmac-sha2-256
[FW_A-ike-proposal-10] encryption-algorithm aes-256
[FW_A-ike-proposal-10] dh group14
[FW_A-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_A-ike-proposal-10] quit

配置IKE peer。

[FW_A] ike peer b
[FW_A-ike-peer-b] ike-proposal 10
[FW_A-ike-peer-b] remote-address 1.1.5.1
[FW_A-ike-peer-b] pre-shared-key Test!1234
[FW_A-ike-peer-b] quit

配置IPSec策略

[FW_A] ipsec policy map1 10 isakmp
[FW_A-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_A-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_A-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_A-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit

配置FW_B的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_B]interface GigabitEthernet 1/0/3
[FW_B-GigabitEthernet1/0/3]ip add  
[FW_B-GigabitEthernet1/0/3]ip address 10.1.2.1 24
[FW_B-GigabitEthernet1/0/3]quit.
[FW_B]interface GigabitEthernet 1/0/1
[FW_B-GigabitEthernet1/0/1]ip address 1.1.5.1 24
[FW_B-GigabitEthernet1/0/1]quit  
[FW_B]firewall zone trust  
[FW_B-zone-trust]add interface GigabitEthernet 1/0/3
[FW_B-zone-trust]quit
[FW_B]firewall zone untrust  
[FW_B-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_B-zone-untrust]quit[FW_B]security-policy  
[FW_B-policy-security]rule name policy1
[FW_B-policy-security-rule-policy1]source-zone trust  
[FW_B-policy-security-rule-policy1]destination-zone untrust  
[FW_B-policy-security-rule-policy1]source-address 10.1.2.0 24
[FW_B-policy-security-rule-policy1]destination-address 10.1.1.0 24
[FW_B-policy-security-rule-policy1]action permit  
[FW_B-policy-security-rule-policy1]quit
[FW_B-policy-security]rule name policy2
[FW_B-policy-security-rule-policy2]source-zone untrust  
[FW_B-policy-security-rule-policy2]destination-zone trust  
[FW_B-policy-security-rule-policy2]source-address 10.1.1.0 24
[FW_B-policy-security-rule-policy2]destination-address 10.1.2.0 24
[FW_B-policy-security-rule-policy2]action permit  
[FW_B-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_B-policy-security] rule name policy3
[FW_B-policy-security-rule-policy3] source-zone local
[FW_B-policy-security-rule-policy3] destination-zone untrust
[FW_B-policy-security-rule-policy3] source-address 1.1.5.1 32
[FW_B-policy-security-rule-policy3] destination-address 1.1.3.1 32
[FW_B-policy-security-rule-policy3] action permit
[FW_B-policy-security-rule-policy3] quit
[FW_B-policy-security] rule name policy4
[FW_B-policy-security-rule-policy4] source-zone untrust
[FW_B-policy-security-rule-policy4] destination-zone local
[FW_B-policy-security-rule-policy4] source-address 1.1.3.1 32
[FW_B-policy-security-rule-policy4] destination-address 1.1.5.1 32
[FW_B-policy-security-rule-policy4] action permit
[FW_B-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由，此处假设到达网络B的下一跳地址为1.1.3.254

[FW_B]ip route-static 10.1.1.0 255.255.255.0 1.1.5.254
[FW_B]ip route-static 1.1.3.0 255.255.255.0 1.1.5.254

在FW_B上配置IPSec策略，并在接口上应用此IPSec策略

[FW_B]acl 3000
[FW_B-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[FW_B-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_B] ipsec proposal tran1
[FW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_B-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_B-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_B] ike proposal 10
[FW_B-ike-proposal-10] authentication-method pre-share
[FW_B-ike-proposal-10] prf hmac-sha2-256
[FW_B-ike-proposal-10] encryption-algorithm aes-256
[FW_B-ike-proposal-10] dh group14
[FW_B-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_B-ike-proposal-10] quit

配置IKE peer。

[FW_B] ike peer a 
[FW_B-ike-peer-a] ike-proposal 10 
[FW_B-ike-peer-a] remote-address 1.1.3.1 
[FW_B-ike-peer-a] pre-shared-key Test!1234 
[FW_B-ike-peer-a] quit

配置IPSec策略

[FW_B] ipsec policy map1 10 isakmp
[FW_B-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_B-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_B-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_B-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit

网关路由配置静态

[Huawei]ip route-static 10.1.1.0 255.255.255.0 1.1.3.1
[Huawei]ip route-static 10.1.2.0 255.255.255.0 1.1.5.1

结果验证

1. 配置完成后，在PC1执行ping命令，触发IKE协商。
   若IKE协商成功，隧道建立后可以ping通PC2。反之，IKE协商失败，隧道没有建立则PC1不能ping通PC2。

2. 分别在FW_A和FW_B上执行display ike sa、display ipsec sa会显示安全联盟的建立情况。以FW_B为例，出现以下显示说明IKE安全联盟、IPSec安全联盟建立成功。

FW_A

FW_B