Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Establishing GRE over IPSec Tunnels Between HUAWEI Firewalls and HUAWEI AR Routers
Chapter Contents
Networking Requirements
As shown in Figure1, an enterprise requires that the headquarters and branch can securely access each other and that multicast data be transmitted between them (such as multicast packet interaction during dynamic routing interaction in a scenario where the enterprise network has dynamic routing deployed). Considering that an IPSec tunnel alone cannot transmit multicast data but a GRE tunnel can, a GRE over IPSec tunnel shall be established between the HUAWEI firewall and HUAWEI AR router device to satisfy user needs.
Data Plan
Configuration Item |
HUAWEI fierwall |
HUAWEI AR router |
|
|---|---|---|---|
IPSec proposal |
Encapsulation mode |
Tunnel mode |
Tunnel mode |
Security protocol |
ESP |
ESP |
|
ESP authentication algorithm |
SHA2-256 |
SHA2-256 |
|
ESP encryption algorithm |
AES-128 |
AES-128 |
|
DH Group |
GROUP2 |
GROUP2 |
|
IKE peer |
Negotiation mode |
Main mode |
Main mode |
Encryption algorithm |
AES-128 |
AES-128 |
|
Authentication algorithm |
SHA2-256 |
SHA2-256 |
|
Pre-shared key |
Key123 |
Key123 |
|
Identity type |
IP address |
IP address |
|
IKE Version |
V1 |
V1 |
|
Configuration Roadmap
- Configure the HUAWEI firewall:
- Set IP addresses for interfaces and assign the interfaces to security zones.
- Configure the default route from the HUAWEI firewall to the Internet.
- Configure an interzone security policy to allow IKE negotiation packets, original IPSec packets, and decapsulated IPSec packets to pass through the HUAWEI firewall.
- A GRE tunnel is configured.
- Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, and configuring an IKE peer.
- Apply the IPSec policy to an interface.
- Configure the HUAWEI AR:
- Set IP addresses for interfaces.
- A GRE tunnel is configured.
- Configure the default route from the HUAWEI AR to the Internet and the route to the HQ intranet.
- Configure an IPSec policy, including defining the data flow to be protected, configuring an IPSec proposal, creating an IKE proposal, configuring the SHA2 encryption/decryption mode same as the peer, and configuring an IKE peer.
- Apply the IPSec policy to an interface.
Configuration Precautions
- In a GRE over IPSec scenario, the GRE tunnel and IPSec use a public interface for tunnel establishment. Therefore, the source address of the GRE tunnel is the IP address of the public interface used to establish the IPSec tunnel.
- In this example, the software version of the HUAWEI AR router is V200R007C00. In IPSec interconnection between this version and the HUAWEI firewall through the SHA2 authentication algorithm, SHA2 algorithm inconsistency may occur. SHA2 algorithm inconsistency may result in packet encryption and decryption failures, interrupting services. Therefore, in this example, you must run the ipsec authentication sha2 compatible enable command.
Configuration Procedure
- Configure the HUAWEI firewall.
- Set IP addresses for interfaces and assign them to security zones.
[HUAWEI] interface GigabitEthernet 1/0/1 [HUAWEI-GigabitEthernet1/0/1] ip address 10.1.1.1 24 [HUAWEI-GigabitEthernet1/0/1] quit [HUAWEI] interface GigabitEthernet 1/0/2 [HUAWEI-GigabitEthernet1/0/2] ip address 1.1.3.1 24 [HUAWEI-GigabitEthernet1/0/2] quit [HUAWEI] firewall zone trust [HUAWEI-zone-trust] add interface GigabitEthernet 1/0/1 [HUAWEI-zone-trust] quit [HUAWEI] firewall zone untrust [HUAWEI-zone-untrust] add interface GigabitEthernet 1/0/2 [HUAWEI-zone-untrust] quit
- Configure a default route from the HUAWEI firewall to the Internet. In the example, the next-hop IP address is 1.1.3.2.
[HUAWEI] ip route-static 0.0.0.0 0.0.0.0 1.1.3.2
- Configure interzone security policies.
- Configure security policies for the Trust-Untrust interzone to allow the unencapsulated and decapsulated packets to pass through the HUAWEI firewall.
[HUAWEI] security-policy [HUAWEI-policy-security] rule name 1 [HUAWEI-policy-security-rule-1] source-zone untrust [HUAWEI-policy-security-rule-1] destination-zone trust [HUAWEI-policy-security-rule-1] source-address 10.1.3.0 24 [HUAWEI-policy-security-rule-1] destination-address 10.1.1.0 24 [HUAWEI-policy-security-rule-1] action permit [HUAWEI-policy-security-rule-1] quit [HUAWEI-policy-security] rule name 2 [HUAWEI-policy-security-rule-2] source-zone trust [HUAWEI-policy-security-rule-2] destination-zone untrust [HUAWEI-policy-security-rule-2] source-address 10.1.1.0 24 [HUAWEI-policy-security-rule-2] destination-address 10.1.3.0 24 [HUAWEI-policy-security-rule-2] action permit [HUAWEI-policy-security-rule-2] quit
- Configure security policies for the Local-Untrust interzone to allow IKE negotiation packets to pass through the HUAWEI firewall.
[HUAWEI-policy-security] rule name 3 [HUAWEI-policy-security-rule-3] source-zone local [HUAWEI-policy-security-rule-3] destination-zone untrust [HUAWEI-policy-security-rule-3] source-address 1.1.3.1 32 [HUAWEI-policy-security-rule-3] destination-address 1.1.5.1 32 [HUAWEI-policy-security-rule-3] action permit [HUAWEI-policy-security-rule-3] quit [HUAWEI-policy-security] rule name 4 [HUAWEI-policy-security-rule-4] source-zone untrust [HUAWEI-policy-security-rule-4] destination-zone local [HUAWEI-policy-security-rule-4] source-address 1.1.5.1 32 [HUAWEI-policy-security-rule-4] destination-address 1.1.3.1 32 [HUAWEI-policy-security-rule-4] action permit [HUAWEI-policy-security-rule-4] quit
- Configure security policies for the Trust-Untrust interzone to allow the unencapsulated and decapsulated packets to pass through the HUAWEI firewall.
- Configure a GRE tunnel.
[HUAWEI] interface tunnel 1 [HUAWEI-Tunnel1] tunnel-protocol gre [HUAWEI-Tunnel1] ip address 172.16.1.1 24 [HUAWEI-Tunnel1] source 1.1.3.1 [HUAWEI-Tunnel1] destination 1.1.5.1 [HUAWEI-Tunnel1] quit [HUAWEI] firewall zone untrust [HUAWEI-zone-untrust] add interface tunnel 1 [HUAWEI-zone-untrust] quit
- Configure an IPSec policy.
- Configure an ACL to define the data flow to be protected.
[HUAWEI] acl 3000 [HUAWEI-acl-adv-3000] rule permit ip source 1.1.3.1 0 destination 1.1.5.1 0 [HUAWEI-acl-adv-3000] quit
- Configure an IPSec proposal.
[HUAWEI] ipsec proposal tran1 [HUAWEI-ipsec-proposal-tran1] transform esp [HUAWEI-ipsec-proposal-tran1] encapsulation-mode tunnel [HUAWEI-ipsec-proposal-tran1] esp authentication-algorithm sha2-256 [HUAWEI-ipsec-proposal-tran1] esp encryption-algorithm aes-128 [HUAWEI-ipsec-proposal-tran1] quit
- Create an IKE proposal.
[HUAWEI] ike proposal 1 [HUAWEI-ike-proposal-1] encryption-algorithm aes-128 [HUAWEI-ike-proposal-1] authentication-algorithm sha2-256 [HUAWEI-ike-proposal-1] dh group2 [HUAWEI-ike-proposal-1] quit
- Configure an IKE peer.
[HUAWEI] ike peer ar [HUAWEI-ike-peer-ar] undo version 2 [HUAWEI-ike-peer-ar] exchange-mode main [HUAWEI-ike-peer-ar] ike-proposal 1 [HUAWEI-ike-peer-ar] pre-shared-key Key123 [HUAWEI-ike-peer-ar] remote-address 1.1.5.1 [HUAWEI-ike-peer-ar] quit
- Configure an IPSec policy.
[HUAWEI] ipsec policy map1 1 isakmp [HUAWEI-ipsec-policy-isakmp-map1-1] ike-peer ar [HUAWEI-ipsec-policy-isakmp-map1-1] proposal tran1 [HUAWEI-ipsec-policy-isakmp-map1-1] security acl 3000 [HUAWEI-ipsec-policy-isakmp-map1-1] quit
- Apply the IPSec policy to interface GigabitEthernet 1/0/2.
[HUAWEI] interface GigabitEthernet 1/0/2 [HUAWEI-GigabitEthernet1/0/2] ipsec policy map1 [HUAWEI-GigabitEthernet1/0/2] quit
- Configure an ACL to define the data flow to be protected.
- Set IP addresses for interfaces and assign them to security zones.
- Configure the HUAWEI AR router.
- Set interface IP addresses for the HUAWEI AR router.
[AR] interface GigabitEthernet 0/0/1 [AR-GigabitEthernet0/0/1] ip address 10.1.3.1 24 [AR-GigabitEthernet0/0/1] quit [AR] interface GigabitEthernet 0/0/2 [AR-GigabitEthernet0/0/2] ip address 1.1.5.1 24 [AR-GigabitEthernet0/0/2] quit
- Configure a GRE tunnel.
[AR] interface tunnel 0/0/2 [AR-Tunnel0/0/2] tunnel-protocol gre [AR-Tunnel0/0/2] ip address 172.16.1.2 24 [AR-Tunnel0/0/2] source 1.1.5.1 [AR-Tunnel0/0/2] destination 1.1.3.1 [AR-Tunnel0/0/2] quit
- Configure HUAWEI AR router routes.
# Configure a default route from the HUAWEI AR router to the Internet. In the example, the next-hop IP address is 1.1.5.2.
[AR] ip route-static 0.0.0.0 0.0.0.0 1.1.5.2
# Configure a route from the HUAWEI AR router to the headquarters intranet. In the example, the outbound interface is tunnel 0/0/2.
[AR] ip route-static 10.1.1.0 24 tunnel 0/0/2
- Configure an IPSec policy.
- Configure an ACL to define the data flow to be protected.
[AR] acl 3000 [AR-acl-adv-3000] rule permit ip source 1.1.5.1 0 destination 1.1.3.1 0 [AR-acl-adv-3000] quit
- Configure an IPSec proposal.
[AR] ipsec proposal tran1 [AR-ipsec-proposal-tran1] transform esp [AR-ipsec-proposal-tran1] encapsulation-mode tunnel [AR-ipsec-proposal-tran1] esp authentication-algorithm sha2-256 [AR-ipsec-proposal-tran1] esp encryption-algorithm aes-128 [AR-ipsec-proposal-tran1] quit
- Create an IKE proposal.
[AR] ike proposal 1 [AR-ike-proposal-1] encryption-algorithm aes-cbc-128 [AR-ike-proposal-1] authentication-algorithm sha2-256 [AR-ike-proposal-1] dh group2 [AR-ike-proposal-1] quit
- Set the SHA2 encryption and decryption modes to be the same as those on the peer end.
[AR] ipsec authentication sha2 compatible enable
- Configure an IKE peer.
[AR] ike peer firewall v1 /* Parameter v1 indicates that IKEv1 is used for negotiation./ [AR-ike-peer-firewall] exchange-mode main [AR-ike-peer-firewall] ike-proposal 1 [AR-ike-peer-firewall] pre-shared-key cipher Key123 [AR-ike-peer-firewall] remote-address 1.1.3.1 [AR-ike-peer-firewall] nat traversal [AR-ike-peer-firewall] quit
- Configure an ISAKMP IPSec policy.
[AR] ipsec policy map1 1 isakmp [AR-ipsec-policy-isakmp-map1-1] ike-peer firewall [AR-ipsec-policy-isakmp-map1-1] proposal tran1 [AR-ipsec-policy-isakmp-map1-1] security acl 3000 [AR-ipsec-policy-isakmp-map1-1] quit
- Apply the IPSec policy to interface GigabitEthernet 0/0/2.
[AR] interface GigabitEthernet 0/0/2 [AR-GigabitEthernet0/0/2] ipsec policy map1 [AR-GigabitEthernet0/0/2] quit
- Configure an ACL to define the data flow to be protected.
- Set interface IP addresses for the HUAWEI AR router.
Verification
- Ping a user on the headquarters network from the branch network.
- In normal cases, the data flows from the branch to the headquarters trigger the gateways to establish an IPSec tunnel. On the HUAWEI firewall, check whether an IKE SA is established. If the following information is displayed, an IKE SA has been established.
<HUAWEI> display ike sa current ike sa number: 2 -------------------------------------------------------------------------------------------------- conn-id peer flag phase vpn -------------------------------------------------------------------------------------------------- 84125 1.1.5.1 RD|A v1:2 public 84121 1.1.5.1 RD|D|A v1:1 public flag meaning RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT TD--DELETING NEG--NEGOTIATING D--DPD M--ACTIVE S--STANDBY A--ALONE - Run the display ipsec sa command to check whether an IPSec SA is established. If the following information is displayed, an IPSec SA is established.
<HUAWEI> display ipsec sa =============================== Interface: GigabitEthernet1/0/2 path MTU: 1500 =============================== ----------------------------- IPSec policy name: "map1" sequence number: 1 mode: isakmp vpn: public ----------------------------- connection id: 84125 rule number: 5 encapsulation mode: tunnel holding time: 0d 0h 25m 51s tunnel local : 1.1.3.1 tunnel remote: 1.1.5.1 flow source: 1.1.3.1/255.255.255.255 0/0 flow destination: 1.1.3.2/255.255.255.255 0/0 [inbound ESP SAs] spi: 3481684812 (0xcf864b4c) vpn: public said: 2580 cpuid: 0x0000 proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256 sa remaining key duration (kilobytes/sec): 1843200/2049 max received sequence-number: 5 udp encapsulation used for nat traversal: N [outbound ESP SAs] spi: 592143329 (0x234b63e1) vpn: public said: 2581 cpuid: 0x0000 proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256 sa remaining key duration (kilobytes/sec): 1843200/2049 max sent sequence-number: 6 udp encapsulation used for nat traversal: N
Configuration Files
# sysname HUAWEI # interface GigabitEthernet 1/0/1 ip address 10.1.1.1 24 # interface GigabitEthernet 1/0/2 ip address 1.1.3.1 24 ipsec policy map1 # interface tunnel 1 tunnel-protocol gre ip address 172.16.1.1 24 source 1.1.3.1 destination 1.1.5.1 # firewall zone trust add interface GigabitEthernet 1/0/1 # firewall zone untrust add interface GigabitEthernet 1/0/2 add interface tunnel 1 # ip route-static 0.0.0.0 0.0.0.0 1.1.3.2 # security-policy rule name 1 source-zone untrust destination-zone trust source-address 10.1.3.0 24 destination-address 10.1.1.0 24 action permit rule name 2 source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address 10.1.3.0 24 action permit rule name 3 source-zone local destination-zone untrust source-address 1.1.3.1 32 destination-address 1.1.5.1 32 action permit rule name 4 source-zone untrust destination-zone local source-address 1.1.5.1 32 destination-address 1.1.3.1 32 action permit # acl 3000 rule permit ip source 1.1.3.1 0 destination 1.1.5.1 0 # ipsec proposal tran1 transform esp encapsulation-mode tunnel esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 1 encryption-algorithm aes-128 authentication-algorithm sha2-256 dh group2 # ike peer ar undo version 2 exchange-mode main ike-proposal 1 pre-shared-key Key123 remote-address 1.1.5.1 # ipsec policy map1 1 isakmp ike-peer ar proposal tran1 security acl 3000 # return
