防火墙Ipsec vpn的配置

Posted 2023-04-09 干饭大王爱学习

拓补图

1.  IP地址的配置，略

2. 路由的配置

[FW1]ip route-static  0.0.0.0 0 100.1.1.1

[FW2]ip route-static 0.0.0.0 0 100.1.2.1

3. 防火墙划分区域

[FW1]firewall zone trust 

[FW1-zone-trust]add interface  g1/0/0

[FW1-zone-trust]add interface g1/0/2

[FW1]firewall zone  untrust

[FW1-zone-untrust]add interface  g1/0/1

[FW2]firewall zone  trust 

[FW2-zone-trust]add interface  g1/0/1

[FW2-zone-trust]add interface  g1/0/2

[FW2]firewall zone  untrust 

[FW2-zone-untrust]add interface  g1/0/0

4. 防火墙桥接物理网卡，开启网管界面，具体桥接的方式就不在介绍了，之前的文章有具体讲解ENSP怎么桥接物理网卡

[FW1]int g1/0/2

[FW1-GigabitEthernet1/0/2]service-manage https permit    //开启网管接界面

5. 进入防火墙的WEB页面配置Ipsec vpn

 ipsec的配置（FW2也一样）  

6. 创建自定义服务或服务组，并进入视图，必须要配置这个，不然在安全策略中调用这个策略会报错

[FW1]ip service-set ike type  object       //创建自定义服务或服务组，只能添加服务作为其成员

[FW1-object-service-set-ike]service  protocol  udp  destination-port 500   //添加IKE的服务，因为IKE的服务使用的事udp的500端口

7. 安全策略的配置

rule name untrust-local（双向访问，所以需要允许local访问untrust区域，也需要允许untrust访问local区域）
  source-zone local
  source-zone untrust
  destination-zone local
  destination-zone untrust
  source-address 100.1.1.10 mask 255.255.255.255
  source-address 100.1.2.10 mask 255.255.255.255
  destination-address 100.1.1.10 mask 255.255.255.255
  destination-address 100.1.2.10 mask 255.255.255.255
  service esp     //这个一定要配置，ipsec就是使用esp封装加密的
  service icmp
  service ike      //配置与预共享密钥
  action permit
 rule name trust-untrust（双向访问，所以需要允许trust访问untrust区域，也需要允许untrust访问trust区域）
  source-zone trust
  source-zone untrust
  destination-zone trust
  destination-zone untrust
  source-address 10.1.1.0 mask 255.255.255.0
  source-address 10.1.2.0 mask 255.255.255.0
  destination-address 10.1.1.0 mask 255.255.255.0
  destination-address 10.1.2.0 mask 255.255.255.0
  service esp                             
  service icmp                            
  service ike                             
  action permit

8. 验证（pc1跟pc2能互通）

9. 抓包查看（icmp的包被ESP加密了） 

华为防火墙网关间通过IKE方式协商IPSec VPN隧道（共享密钥认证）

组网需求

网络A和网络B分别通过FW_A和FW_B连接到Internet。网络环境描述如下：

• 网络A属于10.1.1.0/24子网，通过接口GigabitEthernet 1/0/3与FW_A连接。
• 网络B属于10.1.2.0/24子网，通过接口GigabitEthernet 1/0/3与FW_B连接。
• FW_A_B路由可达。

通过组网实现如下需求：在FW_A和FW_B之间建立IKE方式的IPSec隧道，使网络A和网络B的用户可通过IPSec隧道互相访问。

配置思路

对于FW_A和FW_B，配置思路相同。如下：

1. 完成接口基本配置。
2. 配置安全策略，允许私网指定网段进行报文交互。
3. 配置到对端内网的路由。
4. 配置IPSec策略。包括配置IPSec策略的基本信息、配置待加密的数据流、配置安全提议的协商参数。

eNSP拓扑

操作步骤

配置FW_A的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_A]interface GigabitEthernet 1/0/3
[FW_A-GigabitEthernet1/0/3]ip add 
[FW_A-GigabitEthernet1/0/3]ip address 10.1.1.1 24
[FW_A-GigabitEthernet1/0/3]quit.
[FW_A]interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1]ip address 1.1.3.1 24
[FW_A-GigabitEthernet1/0/1]quit 
[FW_A]firewall zone trust 
[FW_A-zone-trust]add interface GigabitEthernet 1/0/3
[FW_A-zone-trust]quit
[FW_A]firewall zone untrust 
[FW_A-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_A-zone-untrust]quit

[FW_A]security-policy 
[FW_A-policy-security]rule name policy1
[FW_A-policy-security-rule-policy1]source-zone trust 
[FW_A-policy-security-rule-policy1]destination-zone untrust 
[FW_A-policy-security-rule-policy1]source-address 10.1.1.0 24
[FW_A-policy-security-rule-policy1]destination-address 10.1.2.0 24
[FW_A-policy-security-rule-policy1]action permit 
[FW_A-policy-security-rule-policy1]quit
[FW_A-policy-security]rule name policy2
[FW_A-policy-security-rule-policy2]source-zone untrust 
[FW_A-policy-security-rule-policy2]destination-zone trust 
[FW_A-policy-security-rule-policy2]source-address 10.1.2.0 24
[FW_A-policy-security-rule-policy2]destination-address 10.1.1.0 24
[FW_A-policy-security-rule-policy2]action permit 
[FW_A-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_A-policy-security] rule name policy3
[FW_A-policy-security-rule-policy3] source-zone local
[FW_A-policy-security-rule-policy3] destination-zone untrust
[FW_A-policy-security-rule-policy3] source-address 1.1.3.1 32
[FW_A-policy-security-rule-policy3] destination-address 1.1.5.1 32
[FW_A-policy-security-rule-policy3] action permit
[FW_A-policy-security-rule-policy3] quit
[FW_A-policy-security] rule name policy4
[FW_A-policy-security-rule-policy4] source-zone untrust
[FW_A-policy-security-rule-policy4] destination-zone local
[FW_A-policy-security-rule-policy4] source-address 1.1.5.1 32
[FW_A-policy-security-rule-policy4] destination-address 1.1.3.1 32
[FW_A-policy-security-rule-policy4] action permit
[FW_A-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由，此处假设到达网络B的下一跳地址为1.1.3.254

[FW_A]ip route-static 10.1.2.0 255.255.255.0 1.1.3.254
[FW_A]ip route-static 1.1.5.0 255.255.255.0 1.1.3.254

在FW_A上配置IPSec策略，并在接口上应用此IPSec策略

[FW_A]acl 3000
[FW_A-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2
.0 0.0.0.255
[FW_A-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_A] ipsec proposal tran1
[FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_A-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_A] ike proposal 10
[FW_A-ike-proposal-10] authentication-method pre-share
[FW_A-ike-proposal-10] prf hmac-sha2-256
[FW_A-ike-proposal-10] encryption-algorithm aes-256
[FW_A-ike-proposal-10] dh group14
[FW_A-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_A-ike-proposal-10] quit

配置IKE peer。

[FW_A] ike peer b
[FW_A-ike-peer-b] ike-proposal 10
[FW_A-ike-peer-b] remote-address 1.1.5.1
[FW_A-ike-peer-b] pre-shared-key Test!1234
[FW_A-ike-peer-b] quit

配置IPSec策略

[FW_A] ipsec policy map1 10 isakmp
[FW_A-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_A-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_A-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_A-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit

配置FW_B的基础配置。包括配置接口IP地址、接口加入安全区域、域间安全策略和静态路由

[FW_B]interface GigabitEthernet 1/0/3
[FW_B-GigabitEthernet1/0/3]ip add  
[FW_B-GigabitEthernet1/0/3]ip address 10.1.2.1 24
[FW_B-GigabitEthernet1/0/3]quit.
[FW_B]interface GigabitEthernet 1/0/1
[FW_B-GigabitEthernet1/0/1]ip address 1.1.5.1 24
[FW_B-GigabitEthernet1/0/1]quit  
[FW_B]firewall zone trust  
[FW_B-zone-trust]add interface GigabitEthernet 1/0/3
[FW_B-zone-trust]quit
[FW_B]firewall zone untrust  
[FW_B-zone-untrust]add interface GigabitEthernet 1/0/1
[FW_B-zone-untrust]quit[FW_B]security-policy  
[FW_B-policy-security]rule name policy1
[FW_B-policy-security-rule-policy1]source-zone trust  
[FW_B-policy-security-rule-policy1]destination-zone untrust  
[FW_B-policy-security-rule-policy1]source-address 10.1.2.0 24
[FW_B-policy-security-rule-policy1]destination-address 10.1.1.0 24
[FW_B-policy-security-rule-policy1]action permit  
[FW_B-policy-security-rule-policy1]quit
[FW_B-policy-security]rule name policy2
[FW_B-policy-security-rule-policy2]source-zone untrust  
[FW_B-policy-security-rule-policy2]destination-zone trust  
[FW_B-policy-security-rule-policy2]source-address 10.1.1.0 24
[FW_B-policy-security-rule-policy2]destination-address 10.1.2.0 24
[FW_B-policy-security-rule-policy2]action permit  
[FW_B-policy-security-rule-policy2]quit

配置Local域与Untrust域之间的域间安全策略。

[FW_B-policy-security] rule name policy3
[FW_B-policy-security-rule-policy3] source-zone local
[FW_B-policy-security-rule-policy3] destination-zone untrust
[FW_B-policy-security-rule-policy3] source-address 1.1.5.1 32
[FW_B-policy-security-rule-policy3] destination-address 1.1.3.1 32
[FW_B-policy-security-rule-policy3] action permit
[FW_B-policy-security-rule-policy3] quit
[FW_B-policy-security] rule name policy4
[FW_B-policy-security-rule-policy4] source-zone untrust
[FW_B-policy-security-rule-policy4] destination-zone local
[FW_B-policy-security-rule-policy4] source-address 1.1.3.1 32
[FW_B-policy-security-rule-policy4] destination-address 1.1.5.1 32
[FW_B-policy-security-rule-policy4] action permit
[FW_B-policy-security-rule-policy4] quit

配置到达目的网络B的静态路由，此处假设到达网络B的下一跳地址为1.1.3.254

[FW_B]ip route-static 10.1.1.0 255.255.255.0 1.1.5.254
[FW_B]ip route-static 1.1.3.0 255.255.255.0 1.1.5.254

在FW_B上配置IPSec策略，并在接口上应用此IPSec策略

[FW_B]acl 3000
[FW_B-acl-adv-3000]rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[FW_B-acl-adv-3000]quit

配置IPSec安全提议。缺省参数可不配置

[FW_B] ipsec proposal tran1
[FW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[FW_B-ipsec-proposal-tran1] esp encryption-algorithm aes-256
[FW_B-ipsec-proposal-tran1] quit

配置IKE安全提议

[FW_B] ike proposal 10
[FW_B-ike-proposal-10] authentication-method pre-share
[FW_B-ike-proposal-10] prf hmac-sha2-256
[FW_B-ike-proposal-10] encryption-algorithm aes-256
[FW_B-ike-proposal-10] dh group14
[FW_B-ike-proposal-10] integrity-algorithm hmac-sha2-256  
[FW_B-ike-proposal-10] quit

配置IKE peer。

[FW_B] ike peer a 
[FW_B-ike-peer-a] ike-proposal 10 
[FW_B-ike-peer-a] remote-address 1.1.3.1 
[FW_B-ike-peer-a] pre-shared-key Test!1234 
[FW_B-ike-peer-a] quit

配置IPSec策略

[FW_B] ipsec policy map1 10 isakmp
[FW_B-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_B-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_B-ipsec-policy-isakmp-map1-10] ike-peer b
[FW_B-ipsec-policy-isakmp-map1-10] quit

在接口GigabitEthernet 1/0/1上应用IPSec策略组map1

[FW_A] interface GigabitEthernet 1/0/1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit

网关路由配置静态

[Huawei]ip route-static 10.1.1.0 255.255.255.0 1.1.3.1
[Huawei]ip route-static 10.1.2.0 255.255.255.0 1.1.5.1

结果验证

1. 配置完成后，在PC1执行ping命令，触发IKE协商。
   若IKE协商成功，隧道建立后可以ping通PC2。反之，IKE协商失败，隧道没有建立则PC1不能ping通PC2。

2. 分别在FW_A和FW_B上执行display ike sa、display ipsec sa会显示安全联盟的建立情况。以FW_B为例，出现以下显示说明IKE安全联盟、IPSec安全联盟建立成功。

FW_A

FW_B