Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Establishing IPSec Tunnels in Virtual Tunnel Interface Mode Between HUAWEI Firewalls and HUAWEI AR Routers
Chapter Contents
Networking Requirements
As shown in Figure1, the HUAWEI firewall serves as the gateway for connecting to the Internet at the headquarters, and the HUAWEI AR router as that at the branch. It is required that the headquarters divert all traffic transmitted through the IPSec tunnel to the tunnel interface for ease of management over such traffic.
Data Plan
Configuration Item |
HUAWEI USG Firewall |
HUAWEI AR Router |
|
|---|---|---|---|
IPSec proposal |
Encapsulation mode |
Tunnel mode |
Tunnel mode |
Security protocol |
ESP |
ESP |
|
ESP authentication algorithm |
SHA2-256 |
SHA2-256 |
|
ESP encryption algorithm |
AES-128 |
AES-128 |
|
DH Group |
GROUP2 |
GROUP2 |
|
IKE peer |
Negotiation mode |
Main mode |
Main mode |
Encryption algorithm |
AES-128 |
AES-128 |
|
Authentication algorithm |
SHA2-256 |
SHA2-256 |
|
Pre-shared key |
Key123 |
Key123 |
|
Identity type |
IP address |
IP address |
|
IKE Version |
V1 |
V1 |
|
Configuration Roadmap
- Configure the HUAWEI firewall:
- Set IP addresses for interfaces and assign the interfaces to security zones.
- Configure a route to the branch intranet and the default route from the HUAWEI firewall to the Internet.
- Configure an interzone security policy to allow IKE negotiation packets, original IPSec packets, and decapsulated IPSec packets to pass through the HUAWEI firewall.
- Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, and configuring an IKE peer.
- Apply the IPSec policies to the tunnel interface.
- Configure the HUAWEI AR:
- Set IP addresses for interfaces.
- Configure a default route from the HUAWEI AR to the Internet.
- Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, and configuring an IKE peer.
- Apply the IPSec policy to an interface.
Configuration Precautions
- In this example, IPSec shall be applied to the tunnel interface. The tunnel interface can borrow the IP address of the outbound interface of the public network or has its IP address manually set.
- In the creation of the tunnel interface, you must set its encapsulation protocol to IPSec but not GRE. Otherwise, a traffic forwarding anomaly may occur.
Configuration Procedure
- Configure the HUAWEI firewall.
- Set IP addresses for interfaces and assign them to security zones.
[HUAWEI] interface GigabitEthernet 1/0/1 [HUAWEI-GigabitEthernet1/0/1] ip address 10.1.1.1 24 [HUAWEI-GigabitEthernet1/0/1] quit [HUAWEI] interface GigabitEthernet 1/0/2 [HUAWEI-GigabitEthernet1/0/2] ip address 1.1.3.1 24 [HUAWEI-GigabitEthernet1/0/2] quit [HUAWEI] interface tunnel 1 [HUAWEI-Tunnel1] ip address unnumbered interface GigabitEthernet1/0/2 [HUAWEI-Tunnel1] tunnel-protocol ipsec [HUAWEI-Tunnel1] quit [HUAWEI] firewall zone trust [HUAWEI-zone-trust] add interface GigabitEthernet 1/0/1 [HUAWEI-zone-trust] quit [HUAWEI] firewall zone untrust [HUAWEI-zone-untrust] add interface GigabitEthernet 1/0/2 [HUAWEI-zone-untrust] add interface tunnel 1 [HUAWEI-zone-untrust] quit
- Configure routes.
# Configure a route to the branch intranet to divert the traffic to the tunnel interface.
[HUAWEI] ip route-static 10.1.3.0 24 tunnel 1
# Configure a default route from the HUAWEI firewall to the Internet. In the example, the next-hop IP address is 1.1.3.2.
[HUAWEI] ip route-static 0.0.0.0 0.0.0.0 1.1.3.2
- Configure interzone security policies.
- Configure security policies for the Trust-Untrust interzone to allow the unencapsulated and decapsulated packets to pass through the HUAWEI firewall.
[HUAWEI] security-policy [HUAWEI-policy-security] rule name 1 [HUAWEI-policy-security-rule-1] source-zone untrust [HUAWEI-policy-security-rule-1] destination-zone trust [HUAWEI-policy-security-rule-1] source-address 10.1.3.0 24 [HUAWEI-policy-security-rule-1] destination-address 10.1.1.0 24 [HUAWEI-policy-security-rule-1] action permit [HUAWEI-policy-security-rule-1] quit [HUAWEI-policy-security] rule name 2 [HUAWEI-policy-security-rule-2] source-zone trust [HUAWEI-policy-security-rule-2] destination-zone untrust [HUAWEI-policy-security-rule-2] source-address 10.1.1.0 24 [HUAWEI-policy-security-rule-2] destination-address 10.1.3.0 24 [HUAWEI-policy-security-rule-2] action permit [HUAWEI-policy-security-rule-2] quit
- Configure security policies for the Local-Untrust interzone to allow IKE negotiation packets to pass through the HUAWEI firewall.
[HUAWEI-policy-security] rule name 3 [HUAWEI-policy-security-rule-3] source-zone local [HUAWEI-policy-security-rule-3] destination-zone untrust [HUAWEI-policy-security-rule-3] source-address 1.1.3.1 32 [HUAWEI-policy-security-rule-3] destination-address 1.1.5.1 32 [HUAWEI-policy-security-rule-3] action permit [HUAWEI-policy-security-rule-3] quit [HUAWEI-policy-security] rule name 4 [HUAWEI-policy-security-rule-4] source-zone untrust [HUAWEI-policy-security-rule-4] destination-zone local [HUAWEI-policy-security-rule-4] source-address 1.1.5.1 32 [HUAWEI-policy-security-rule-4] destination-address 1.1.3.1 32 [HUAWEI-policy-security-rule-4] action permit [HUAWEI-policy-security-rule-4] quit
- Configure security policies for the Trust-Untrust interzone to allow the unencapsulated and decapsulated packets to pass through the HUAWEI firewall.
- Configure an IPSec policy.
- Configure an ACL to define the data flow to be protected.
[HUAWEI] acl 3000 [HUAWEI-acl-adv-3000] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 [HUAWEI-acl-adv-3000] quit
- Configure an IPSec proposal.
[HUAWEI] ipsec proposal tran1 [HUAWEI-ipsec-proposal-tran1] transform esp [HUAWEI-ipsec-proposal-tran1] encapsulation-mode tunnel [HUAWEI-ipsec-proposal-tran1] esp authentication-algorithm sha2-256 [HUAWEI-ipsec-proposal-tran1] esp encryption-algorithm aes-128 [HUAWEI-ipsec-proposal-tran1] quit
- Create an IKE proposal.
[HUAWEI] ike proposal 1 [HUAWEI-ike-proposal-1] encryption-algorithm aes-128 [HUAWEI-ike-proposal-1] authentication-algorithm sha2-256 [HUAWEI-ike-proposal-1] dh group2 [HUAWEI-ike-proposal-1] quit
- Configure an IKE peer.
[HUAWEI] ike peer ar [HUAWEI-ike-peer-ar] undo version 2 [HUAWEI-ike-peer-ar] exchange-mode main [HUAWEI-ike-peer-ar] ike-proposal 1 [HUAWEI-ike-peer-ar] remote-address 1.1.5.1 [HUAWEI-ike-peer-ar] pre-shared-key Key123 [HUAWEI-ike-peer-ar] quit
- Configure an IPSec policy.
[HUAWEI] ipsec policy map1 1 isakmp [HUAWEI-ipsec-policy-isakmp-map1-1] security acl 3000 [HUAWEI-ipsec-policy-isakmp-map1-1] proposal tran1 [HUAWEI-ipsec-policy-isakmp-map1-1] ike-peer ar [HUAWEI-ipsec-policy-isakmp-map1-1] quit
- Apply the IPSec policies to the tunnel interfaces.
[HUAWEI] interface Tunnel 1 [HUAWEI-Tunnel1] ipsec policy map1 [HUAWEI-Tunnel1] quit
- Configure an ACL to define the data flow to be protected.
- Set IP addresses for interfaces and assign them to security zones.
- Configure the HUAWEI AR router.
- Set interface IP addresses for the HUAWEI AR router.
[AR] interface GigabitEthernet 0/0/1 [AR-GigabitEthernet0/0/1] ip address 10.1.3.1 24 [AR-GigabitEthernet0/0/1] quit [AR] interface GigabitEthernet 0/0/2 [AR-GigabitEthernet0/0/2] ip address 1.1.5.1 24 [AR-GigabitEthernet0/0/2] quit
- Configure a default route from the HUAWEI AR router to the Internet. In the example, the next-hop IP address is 1.1.5.2.
[AR] ip route-static 0.0.0.0 0.0.0.0 1.1.5.2
- Configure an IPSec policy.
- Configure an ACL to define the data flow to be protected.
[AR] acl 3000 [AR-acl-adv-3000] rule permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 [AR-acl-adv-3000] quit
- Configure an IPSec proposal.
[AR] ipsec proposal tran1 [AR-ipsec-proposal-tran1] transform esp [AR-ipsec-proposal-tran1] encapsulation-mode tunnel [AR-ipsec-proposal-tran1] esp authentication-algorithm sha2-256 [AR-ipsec-proposal-tran1] esp encryption-algorithm aes-128 [AR-ipsec-proposal-tran1] quit
- Create an IKE proposal.
[AR] ike proposal 1 [AR-ike-proposal-1] encryption-algorithm aes-cbc-128 [AR-ike-proposal-1] authentication-algorithm sha2-256 [AR-ike-proposal-1] dh group2 [AR-ike-proposal-1] quit
- Set the SHA2 encryption and decryption modes to be the same as those on the peer end.
[AR] ipsec authentication sha2 compatible enable
- Configure an IKE peer.
[AR] ike peer firewall v1 /* Parameter v1 indicates that IKEv1 is used for negotiation./ [AR-ike-peer-firewall] exchange-mode main [AR-ike-peer-firewall] ike-proposal 1 [AR-ike-peer-firewall] pre-shared-key cipher Key123 [AR-ike-peer-firewall] remote-address 1.1.3.1 [AR-ike-peer-firewall] quit
- Configure an ISAKMP IPSec policy.
[AR] ipsec policy map1 1 isakmp [AR-ipsec-policy-isakmp-map1-1] ike-peer firewall [AR-ipsec-policy-isakmp-map1-1] proposal tran1 [AR-ipsec-policy-isakmp-map1-1] security acl 3000 [AR-ipsec-policy-isakmp-map1-1] quit
- Apply the IPSec policy to interface GigabitEthernet 0/0/2.
[AR] interface GigabitEthernet 0/0/2 [AR-GigabitEthernet0/0/2] ipsec policy map1 [AR-GigabitEthernet0/0/2] quit
- Configure an ACL to define the data flow to be protected.
- Set interface IP addresses for the HUAWEI AR router.
Verification
- Ping a user on the headquarters network from the branch network.
- In normal cases, the data flows from the branch to the headquarters trigger the gateways to establish an IPSec tunnel. On the HUAWEI firewall, check whether an IKE SA is established. If the following information is displayed, an IKE SA has been established.
<HUAWEI> display ike sa current ike sa number: 2 -------------------------------------------------------------------------------------------------- conn-id peer flag phase vpn -------------------------------------------------------------------------------------------------- 84071 1.1.5.1 RD|A v1:2 public 84058 1.1.5.1 RD|D|A v1:1 public flag meaning RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT TD--DELETING NEG--NEGOTIATING D--DPD M--ACTIVE S--STANDBY A--ALONE - Run the display ipsec sa command to check whether an IPSec SA is established. If the following information is displayed, an IPSec SA is established.
<HUAWEI> display ipsec sa =============================== Interface: Tunnel1 path MTU: 1500 =============================== ----------------------------- IPSec policy name: "map1" sequence number: 1 mode: isakmp vpn: public ----------------------------- connection id: 84071 rule number: 5 encapsulation mode: tunnel holding time: 0d 1h 25m 22s tunnel local : 1.1.3.1 tunnel remote: 1.1.5.1 flow source: 10.1.1.0/255.255.255.0 0/0 flow destination: 10.1.3.0/255.255.255.0 0/0 [inbound ESP SAs] spi: 3214035036 (0xbf92485c) vpn: public said: 2524 cpuid: 0x0000 proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256 sa remaining key duration (kilobytes/sec): 1843200/3516 max received sequence-number: 5 udp encapsulation used for nat traversal: N [outbound ESP SAs] spi: 1299326462 (0x4d7225fe) vpn: public said: 2525 cpuid: 0x0000 proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256 sa remaining key duration (kilobytes/sec): 1843200/3516 max sent sequence-number: 6 udp encapsulation used for nat traversal: N
Configuration Files
# sysname HUAWEI # interface GigabitEthernet 1/0/1 ip address 10.1.1.1 24 # interface GigabitEthernet 1/0/2 ip address 1.1.3.1 24 # interface tunnel 1 ip address unnumbered interface GigabitEthernet1/0/2 tunnel-protocol ipsec ipsec policy map1 # firewall zone trust add interface GigabitEthernet 1/0/1 # firewall zone untrust add interface GigabitEthernet 1/0/2 add interface tunnel 1 # ip route-static 10.1.3.0 24 tunnel 1 ip route-static 0.0.0.0 0.0.0.0 1.1.3.2 # security-policy rule name 1 source-zone untrust destination-zone trust source-address 10.1.3.0 24 destination-address 10.1.1.0 24 action permit rule name 2 source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address 10.1.3.0 24 action permit rule name 3 source-zone local destination-zone untrust source-address 1.1.3.1 32 destination-address 1.1.5.1 32 action permit rule name 4 source-zone untrust destination-zone local source-address 1.1.5.1 32 destination-address 1.1.3.1 32 action permit # acl 3000 rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 # ipsec proposal tran1 transform esp encapsulation-mode tunnel esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 1 encryption-algorithm aes-128 authentication-algorithm sha2-256 dh group2 # ike peer ar undo version 2 exchange-mode main ike-proposal 1 remote-address 1.1.5.1 pre-shared-key Key123 # ipsec policy map1 1 isakmp security acl 3000 proposal tran1 ike-peer ar # return