No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

CLI-based Configuration Guide - VPN

AR650, AR1600, and AR6100 V300R003

This document describes VPN features on the device and provides configuration procedures and configuration examples.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring DSVPN Protected by IPSec

Example for Configuring DSVPN Protected by IPSec

Networking Requirements

A large-scale enterprise has a central office (Hub) and multiple branches which are located in different areas (this example shows only two Spokes Spoke1 and Spoke2). The networks of the central office and branches frequently change. The Spokes use dynamic addresses to connect to the public network. Open Shortest Path First (OSPF) is used on the enterprise network.

The enterprise wants to establish a VPN between the Spokes and encrypt data transmitted between the Hub and Spokes, and between Spokes to increase data security.

Figure 3-23  Networking diagram for DSVPN protected by IPSec configuration

Configuration Roadmap

The configuration roadmap is as follows:
  1. Because a Spoke uses a dynamic address to connect to the public network, it does not know the public IP address of the other Spoke. DSVPN is implemented to establish a VPN between the Spokes.

  2. Shortcut Scenario of DSVPN is implemented because the enterprise has a large number of branches.

  3. The networks of the central office and branches frequently change. OSPF is deployed to realize communication between the Hub and Spokes and to simplify maintenance.

  4. DSVPN protected by IPSec is implemented to encrypt data transmitted between the central office and branches, and between branches.

NOTE:
When you deploy IPSec on a DSVPN network, the IPSec encapsulation mode can only be transport if two branches are connected to different NAT devices or the headquarters is connected to a NAT device.

Procedure

  1. Assign an IP address to each interface.

    Configure IP addresses for the interfaces of each Router.

    # Configure IP addresses for interfaces of Hub.

    <Huawei> system-view
    [Huawei] sysname Hub
    [Hub] interface GigabitEthernet 1/0/0
    [Hub-GigabitEthernet1/0/0] ip address 1.1.1.10 255.255.255.0
    [Hub-GigabitEthernet1/0/0] quit
    [Hub] interface tunnel 0/0/0
    [Hub-Tunnel0/0/0] ip address 172.16.1.1 255.255.255.0
    [Hub-Tunnel0/0/0] quit
    [Hub] interface loopback 0
    [Hub-LoopBack0] ip address 192.168.0.1 255.255.255.0
    [Hub-LoopBack0] quit
    

    Configure IP addresses for interfaces of the Spoke1 and Spoke2 as shown in Figure 3-23. The specific configuration is not mentioned here.

  2. Configure routes between the Routers.

    Configure OSPF on each Router to provide reachable routes to the public network.

    # Configure OSPF on Hub.

    [Hub] ospf 2 router-id 1.1.1.10
    [Hub-ospf-2] area 0.0.0.1
    [Hub-ospf-2-area-0.0.0.1] network 1.1.1.0 0.0.0.255
    [Hub-ospf-2-area-0.0.0.1] quit
    [Hub-ospf-2] quit
    

    # Configure OSPF on Spoke1.

    [Spoke1] ospf 2 router-id 1.1.2.10
    [Spoke1-ospf-2] area 0.0.0.1
    [Spoke1-ospf-2-area-0.0.0.1] network 1.1.2.0 0.0.0.255
    [Spoke1-ospf-2-area-0.0.0.1] quit
    [Spoke1-ospf-2] quit
    

    # Configure OSPF on Spoke2.

    [Spoke2] ospf 2 router-id 1.1.3.10
    [Spoke2-ospf-2] area 0.0.0.1
    [Spoke2-ospf-2-area-0.0.0.1] network 1.1.3.0 0.0.0.255
    [Spoke2-ospf-2-area-0.0.0.1] quit
    [Spoke2-ospf-2] quit
    

  3. Configure the basic OSPF functions.

    # Configure Hub.

    [Hub] ospf 1 router-id 172.16.1.1
    [Hub-ospf-1] area 0.0.0.0
    [Hub-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255
    [Hub-ospf-1-area-0.0.0.0] network 192.168.0.0 0.0.0.255
    [Hub-ospf-1-area-0.0.0.0] quit
    [Hub-ospf-1] quit
    

    # Configure Spoke1.

    [Spoke1] ospf 1 router-id 172.16.1.2
    [Spoke1-ospf-1] area 0.0.0.0
    [Spoke1-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255
    [Spoke1-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255
    [Spoke1-ospf-1-area-0.0.0.0] quit
    [Spoke1-ospf-1] quit
    

    # Configure Spoke2.

    [Spoke2] ospf 1 router-id 172.16.1.3
    [Spoke2-ospf-1] area 0.0.0.0
    [Spoke2-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255
    [Spoke2-ospf-1-area-0.0.0.0] network 192.168.2.0 0.0.0.255
    [Spoke2-ospf-1-area-0.0.0.0] quit
    [Spoke2-ospf-1] quit
    

  4. Configure IKE proposals.

    On Hub, Spoke1, and Spoke2, configure IKE proposals and set the same authentication mode.

    # Configure Hub.

    [Hub] ike proposal 1
    [Hub-ike-proposal-1] dh group5
    [Hub-ike-proposal-1] authentication-algorithm sha2-256
    [Hub-ike-proposal-1] prf aes-xcbc-128
    [Hub-ike-proposal-1] quit
    

    # Configure Spoke1.

    [Spoke1] ike proposal 1
    [Spoke1-ike-proposal-1] dh group5
    [Spoke1-ike-proposal-1] authentication-algorithm sha2-256
    [Spoke1-ike-proposal-1] prf aes-xcbc-128
    [Spoke1-ike-proposal-1] quit
    

    # Configure Spoke2.

    [Spoke2] ike proposal 1
    [Spoke2-ike-proposal-1] dh group5
    [Spoke2-ike-proposal-1] authentication-algorithm sha2-256
    [Spoke2-ike-proposal-1] prf aes-xcbc-128
    [Spoke2-ike-proposal-1] quit
    

  5. Configure IKE peers.

    Configure IKE peers used during IKE negotiation on Hub, Spoke1, and Spoke2.

    # Configure Hub.

    [Hub] ike peer hub
    [Hub-ike-peer-hub] ike-proposal 1
    [Hub-ike-peer-hub] pre-shared-key cipher Huawei@1234
    [Hub-ike-peer-hub] dpd type periodic
    [Hub-ike-peer-hub] dpd idle-time 40
    [Hub-ike-peer-hub] quit
    

    # Configure Spoke1.

    [Spoke1] ike peer spoke1
    [Spoke1-ike-peer-spoke1] ike-proposal 1
    [Spoke1-ike-peer-spoke1] pre-shared-key cipher Huawei@1234
    [Spoke1-ike-peer-spoke1] dpd type periodic
    [Spoke1-ike-peer-spoke1] dpd idle-time 40
    [Spoke1-ike-peer-spoke1] quit
    

    # Configure Spoke2.

    [Spoke2] ike peer spoke2
    [Spoke2-ike-peer-spoke2] ike-proposal 1
    [Spoke2-ike-peer-spoke2] pre-shared-key cipher Huawei@1234
    [Spoke2-ike-peer-spoke2] dpd type periodic
    [Spoke2-ike-peer-spoke2] dpd idle-time 40
    [Spoke2-ike-peer-spoke2] quit
    

  6. Create IPSec proposals.

    Configure IPSec proposals on Hub, Spoke1, and Spoke2.

    # Configure Hub.

    [Hub] ipsec proposal pro1
    [Hub-ipsec-proposal-pro1] transform ah-esp
    [Hub-ipsec-proposal-pro1] ah authentication-algorithm sha2-256
    [Hub-ipsec-proposal-pro1] esp authentication-algorithm sha2-256
    [Hub-ipsec-proposal-pro1] esp encryption-algorithm aes-192
    [Hub-ipsec-proposal-pro1] quit
    

    # Configure Spoke1.

    [Spoke1] ipsec proposal pro1
    [Spoke1-ipsec-proposal-pro1] transform ah-esp
    [Spoke1-ipsec-proposal-pro1] ah authentication-algorithm sha2-256
    [Spoke1-ipsec-proposal-pro1] esp authentication-algorithm sha2-256
    [Spoke1-ipsec-proposal-pro1] esp encryption-algorithm aes-192
    [Spoke1-ipsec-proposal-pro1] quit
    

    # Configure Spoke2.

    [Spoke2] ipsec proposal pro1
    [Spoke2-ipsec-proposal-pro1] transform ah-esp
    [Spoke2-ipsec-proposal-pro1] ah authentication-algorithm sha2-256
    [Spoke2-ipsec-proposal-pro1] esp authentication-algorithm sha2-256
    [Spoke2-ipsec-proposal-pro1] esp encryption-algorithm aes-192
    [Spoke2-ipsec-proposal-pro1] quit
    

  7. Configure IPSec profiles.

    Configure IPSec profiles on Hub, Spoke1, and Spoke2.

    # Configure Hub.

    [Hub] ipsec profile profile1
    [Hub-ipsec-profile-profile1] ike-peer hub
    [Hub-ipsec-profile-profile1] proposal pro1
    [Hub-ipsec-profile-profile1] quit
    

    # Configure Spoke1.

    [Spoke1] ipsec profile profile1
    [Spoke1-ipsec-profile-profile1] ike-peer spoke1
    [Spoke1-ipsec-profile-profile1] proposal pro1
    [Spoke1-ipsec-profile-profile1] quit
    

    # Configure Spoke2.

    [Spoke2] ipsec profile profile1
    [Spoke2-ipsec-profile-profile1] ike-peer spoke2
    [Spoke2-ipsec-profile-profile1] proposal pro1
    [Spoke2-ipsec-profile-profile1] quit
    

  8. Configure tunnel interfaces.

    # On Hub, configure a tunnel interface, configure OSPF, and apply the IPSec profile.
    [Hub] interface tunnel 0/0/0
    [Hub-Tunnel0/0/0] tunnel-protocol gre p2mp
    [Hub-Tunnel0/0/0] source GigabitEthernet 1/0/0
    [Hub-Tunnel0/0/0] nhrp entry multicast dynamic
    [Hub-Tunnel0/0/0] ospf network-type p2mp
    [Hub-Tunnel0/0/0] nhrp redirect
    [Hub-Tunnel0/0/0] ipsec profile profile1
    [Hub-Tunnel0/0/0] quit
    
    # On Spoke1, configure a tunnel interface, OSPF, and a static NHRP mapping entry of Hub, and apply the IPSec profile.
    [Spoke1] interface tunnel 0/0/0
    [Spoke1-Tunnel0/0/0] tunnel-protocol gre p2mp
    [Spoke1-Tunnel0/0/0] source GigabitEthernet 1/0/0
    [Spoke1-Tunnel0/0/0] nhrp entry 172.16.1.1 1.1.1.10 register
    [Spoke1-Tunnel0/0/0] ospf network-type p2mp
    [Spoke1-Tunnel0/0/0] nhrp shortcut
    [Spoke1-Tunnel0/0/0] ipsec profile profile1
    [Spoke1-Tunnel0/0/0] quit
    
    # On Spoke2, configure a tunnel interface, OSPF, and a static NHRP mapping entry of Hub, and apply the IPSec profile.
    [Spoke2] interface tunnel 0/0/0
    [Spoke2-Tunnel0/0/0] tunnel-protocol gre p2mp
    [Spoke2-Tunnel0/0/0] source GigabitEthernet 1/0/0
    [Spoke2-Tunnel0/0/0] nhrp entry 172.16.1.1 1.1.1.10 register
    [Spoke2-Tunnel0/0/0] ospf network-type p2mp
    [Spoke2-Tunnel0/0/0] nhrp shortcut
    [Spoke2-Tunnel0/0/0] ipsec profile profile1
    [Spoke2-Tunnel0/0/0] quit
    

  9. Verify the DSVPN configuration.

    After the preceding configurations are complete, check the NHRP mapping entries of Spoke1 and Spoke2.

    # Run the display nhrp peer all command on Spoke and Hub. Take Spoke1 as an example. The command output is as follows:

    [Spoke1] display nhrp peer all
    -------------------------------------------------------------------------------
    Protocol-addr   Mask  NBMA-addr       NextHop-addr    Type         Flag
    -------------------------------------------------------------------------------
    172.16.1.1      32    1.1.1.10        172.16.1.1       hub          up
    -------------------------------------------------------------------------------
    Tunnel interface: Tunnel0/0/0
    Created time    : 00:10:58
    Expire time     : --
    
    Number of nhrp peers: 1
    
    NOTE:

    If you run the display nhrp peer all command on Spoke1 and Spoke2, you can view only the static NHRP mapping entry of Hub.

  10. Verify the IPSec SA configuration.

    Check the IPSec SAs generated on Hub, Spoke1, and Spoke2. Take Spoke1 as an example.

    # Run the display ipsec sa command on Spoke1. The command output is as follows:

    [Spoke1] display ipsec sa
    ipsec sa information: 
    
    ===============================
    Interface: Tunnel0/0/0
    ===============================
    
      -----------------------------
      IPSec profile name: "profile1"
      Mode              : PROF-ISAKMP
      -----------------------------
        Connection ID     : 2
        Encapsulation mode: Tunnel
        Tunnel local      : 1.1.2.10:500
        Tunnel remote     : 1.1.1.10:500
    
        [Outbound ESP SAs] 
          SPI: 2485560141 (0x9426a34d)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887426800/2652
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 107
          UDP encapsulation used for NAT traversal: N
    
        [Outbound AH SAs] 
          SPI: 3662509166 (0xda4d746e)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/2652
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 107
          UDP encapsulation used for NAT traversal: N
    
        [Inbound AH SAs] 
          SPI: 833505824 (0x31ae4a20)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/2652
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 119
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    
        [Inbound ESP SAs] 
          SPI: 2140030022 (0x7f8e4446)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887425168/2652
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 119
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    

  11. Run the ping command to check the configuration result.

    Ping 192.168.2.1 on Spoke1. You can see that Spoke1 and Spoke2 have learned dynamic NHRP mapping entries from each other.

    # Run the ping -a 192.168.1.1 192.168.2.1 command on Spoke1. The command output is as follows:

    [Spoke1] ping -a 192.168.1.1 192.168.2.1
      PING 192.168.2.1: 56  data bytes, press CTRL_C to break
        Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=254 time=3 ms
        Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=255 time=2 ms
        Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=255 time=2 ms
        Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=255 time=2 ms
        Reply from 192.168.2.1: bytes=56 Sequence=5 ttl=255 time=2 ms
    
      --- 192.168.2.1 ping statistics ---
        5 packet(s) transmitted
        5 packet(s) received
        0.00% packet loss
        round-trip min/avg/max = 2/2/3 ms
    

    # Run the display nhrp peer all command on Spoke. Take Spoke1 as an example. The command output is as follows:

    [Spoke1] display nhrp peer all
    -------------------------------------------------------------------------------
    Protocol-addr   Mask  NBMA-addr       NextHop-addr    Type            Flag
    -------------------------------------------------------------------------------
    172.16.1.1      32    1.1.1.10        172.16.1.1      hub              up
    -------------------------------------------------------------------------------
    Tunnel interface: Tunnel0/0/0
    Created time    : 00:46:35
    Expire time     : --
    -------------------------------------------------------------------------------
    Protocol-addr   Mask  NBMA-addr       NextHop-addr    Type            Flag
    -------------------------------------------------------------------------------
    192.168.2.1     32    1.1.3.10        172.16.1.3      remote-network  up
    -------------------------------------------------------------------------------
    Tunnel interface: Tunnel0/0/0
    Created time    : 00:00:28
    Expire time     : 01:59:32
    -------------------------------------------------------------------------------
    Protocol-addr   Mask  NBMA-addr       NextHop-addr    Type            Flag
    -------------------------------------------------------------------------------
    172.16.1.3      32    1.1.3.10        172.16.1.3      remote          up
    -------------------------------------------------------------------------------
    Tunnel interface: Tunnel0/0/0
    Created time    : 00:00:28
    Expire time     : 01:59:32
    -------------------------------------------------------------------------------
    Protocol-addr   Mask  NBMA-addr       NextHop-addr    Type            Flag
    -------------------------------------------------------------------------------
    172.16.1.2      32    1.1.2.10        172.16.1.2      local           up
    -------------------------------------------------------------------------------
    Tunnel interface: Tunnel0/0/0
    Created time    : 00:00:28
    Expire time     : 01:59:32
    
    Number of nhrp peers: 4
    

    # Run the display ipsec sa command on Spoke. Take Spoke1 as an example. The command output is as follows:

    [Spoke1] display ipsec sa
    ipsec sa information: 
    
    ===============================
    Interface: Tunnel0/0/0
    ===============================
    
      -----------------------------
      IPSec profile name: "profile1"
      Mode              : PROF-ISAKMP
      -----------------------------
        Connection ID     : 2
        Encapsulation mode: Tunnel
        Tunnel local      : 1.1.2.10:500
        Tunnel remote     : 1.1.1.10:500
    
        [Outbound ESP SAs] 
          SPI: 2485560141 (0x9426a34d)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887420488/2020
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 175
          UDP encapsulation used for NAT traversal: N
    
        [Outbound AH SAs] 
          SPI: 3662509166 (0xda4d746e)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/2020
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 175
          UDP encapsulation used for NAT traversal: N
    
        [Inbound AH SAs] 
          SPI: 833505824 (0x31ae4a20)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/2020
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 192
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    
        [Inbound ESP SAs] 
          SPI: 2140030022 (0x7f8e4446)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887418092/2020
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 192
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    
      -----------------------------
      IPSec profile name: "profile1"
      Mode              : PROF-ISAKMP
      -----------------------------
        Connection ID     : 5
        Encapsulation mode: Tunnel
        Tunnel local      : 1.1.2.10:500
        Tunnel remote     : 1.1.3.10:500
     
        [Outbound ESP SAs] 
          SPI: 576349831 (0x225a6687)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436368/3511
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 4
          UDP encapsulation used for NAT traversal: N
    
        [Outbound AH SAs] 
          SPI: 3363305474 (0xc877f802)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/3511
          Outpacket count       : 8 
          Outpacket encap count : 8 
          Outpacket drop count  : 0     
          Max sent sequence-number: 4
          UDP encapsulation used for NAT traversal: N
    
        [Inbound AH SAs] 
          SPI: 3753703982 (0xdfbcfa2e)
          Proposal: SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436800/3511
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 4
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    
        [Inbound ESP SAs] 
          SPI: 3361785078 (0xc860c4f6)
          Proposal: ESP-ENCRYPT-AES-192 SHA2-512-256
          SA remaining key duration (bytes/sec): 1887436368/3511
          Inpacket count        : 10 
          Inpacket decap count  : 10 
          Inpacket drop count   : 0    
          Max received sequence-number: 4
          UDP encapsulation used for NAT traversal: N
          Anti-replay : Enable  
          Anti-replay window size: 1024  
    

Configuration Files

  • Hub configuration file

    #
    sysname Hub
    # 
    ipsec proposal pro1
     transform ah-esp
     ah authentication-algorithm sha2-256
     esp authentication-algorithm sha2-256
     esp encryption-algorithm aes-192
    # 
    ike proposal 1
     encryption-algorithm aes-256                                                   
     dh group5                                                                      
     authentication-algorithm sha2-256                                       
     authentication-method pre-share                                                
     integrity-algorithm hmac-sha2-256                                              
     prf aes-xcbc-128  
    # 
    ike peer hub
     pre-shared-key cipher %^%#O3uIP\/YNF+`AcJhbZ&C7y*iVlOOU@DraF58J4=;%^%#
     ike-proposal 1
     dpd type periodic
     dpd idle-time 40   
    # 
    ipsec profile profile1
     ike-peer hub
     proposal pro1
    # 
    interface GigabitEthernet1/0/0
     ip address 1.1.1.10 255.255.255.0
    # 
    interface LoopBack0
     ip address 192.168.0.1 255.255.255.0
    # 
    interface Tunnel0/0/0
     ip address 172.16.1.1 255.255.255.0
     tunnel-protocol gre p2mp
     source GigabitEthernet1/0/0
     ospf network-type p2mp
     nhrp redirect
     nhrp entry multicast dynamic
     ipsec profile profile1
    # 
    ospf 1 router-id 172.16.1.1
     area 0.0.0.0
      network 172.16.1.0 0.0.0.255
      network 192.168.0.0 0.0.0.255
    # 
    ospf 2 router-id 1.1.1.10
     area 0.0.0.1
      network 1.1.1.0 0.0.0.255
    # 
    return
    
  • Spoke1 configuration file

    #
    sysname Spoke1
    # 
    ipsec proposal pro1
     transform ah-esp
     ah authentication-algorithm sha2-256
     esp authentication-algorithm sha2-256
     esp encryption-algorithm aes-192
    # 
    ike proposal 1
     encryption-algorithm aes-256                                                   
     dh group5                                                                      
     authentication-algorithm sha2-256                                       
     authentication-method pre-share                                                
     integrity-algorithm hmac-sha2-256                                              
     prf aes-xcbc-128  
    # 
    ike peer spoke1
     pre-shared-key cipher %^%#O3uIP\/YNF+`AcJhbZ&C7y*iVlOOU@DraF58J4=;%^%#
     ike-proposal 1
     dpd type periodic
     dpd idle-time 40   
    # 
    ipsec profile profile1
     ike-peer spoke1
     proposal pro1
    # 
    interface GigabitEthernet1/0/0
     ip address 1.1.2.10 255.255.255.0
    # 
    interface LoopBack0
     ip address 192.168.1.1 255.255.255.0
    # 
    interface Tunnel0/0/0
     ip address 172.16.1.2 255.255.255.0
     tunnel-protocol gre p2mp
     source GigabitEthernet1/0/0
     ospf network-type p2mp
     nhrp shortcut
     nhrp entry 172.16.1.1 1.1.1.10 register
     ipsec profile profile1
    # 
    ospf 1 router-id 172.16.1.2
     area 0.0.0.0
      network 172.16.1.0 0.0.0.255
      network 192.168.1.0 0.0.0.255
    # 
    ospf 2 router-id 1.1.2.10
     area 0.0.0.1
      network 1.1.2.0 0.0.0.255
    # 
    return
    
  • Spoke2 configuration file

    #
    sysname Spoke2
    # 
    ipsec proposal pro1
     transform ah-esp
     ah authentication-algorithm sha2-256
     esp authentication-algorithm sha2-256
     esp encryption-algorithm aes-192
    # 
    ike proposal 1
     encryption-algorithm aes-256                                                   
     dh group5                                                                      
     authentication-algorithm sha2-256                                       
     authentication-method pre-share                                                
     integrity-algorithm hmac-sha2-256                                              
     prf aes-xcbc-128  
    # 
    ike peer spoke2
     pre-shared-key cipher %^%#O3uIP\/YNF+`AcJhbZ&C7y*iVlOOU@DraF58J4=;%^%#
     ike-proposal 1
     dpd type periodic
     dpd idle-time 40   
    # 
    ipsec profile profile1
     ike-peer spoke2
     proposal pro1
    # 
    interface GigabitEthernet1/0/0
     ip address 1.1.3.10 255.255.255.0
    # 
    interface LoopBack0
     ip address 192.168.2.1 255.255.255.0
    # 
    interface Tunnel0/0/0
     ip address 172.16.1.3 255.255.255.0
     tunnel-protocol gre p2mp
     source GigabitEthernet1/0/0
     ospf network-type p2mp
     nhrp shortcut
     nhrp entry 172.16.1.1 1.1.1.10 register
     ipsec profile profile1
    # 
    ospf 1 router-id 172.16.1.3
     area 0.0.0.0
      network 172.16.1.0 0.0.0.255
      network 192.168.2.0 0.0.0.255
    # 
    ospf 2 router-id 1.1.3.10
     area 0.0.0.1
      network 1.1.3.0 0.0.0.255
    # 
    return
    
Download
Updated: 2019-04-12

Document ID: EDOC1100041799

Views: 31708

Downloads: 45

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next