Example for Configuring Both Centralized NAT and a Common IPsec Tunnel
This section provides an example for configuring both centralized NAT and a common IPsec tunnel. A NAT device converts private IP addresses to public IP addresses before sending packets to an IPsec tunnel established using a security policy.
Networking Requirements
In Figure 2-4, networks A and B exchange resources in a gateway-to-gateway mode. Networks A and B connect to the Internet through devices A and B, respectively. Device A can processes NAT and IPsec.
- Network A belongs to the 10.1.1.0/24 subnet and connects to device A through GE 1/0/1.
- Network B belongs to the 10.1.2.0/24 subnet and connects to device B through GE 1/0/1.
- Device A and device B are routable to each other.
- There are eight public IP addresses, including 11.11.11.0/32 through 11.11.11.7/32.
- IPsec is enabled on both devices A and B.
NAT and an IPsec tunnel need to be configured to perform multiple-to-multiple conversion between private and public IP addresses. PCs A and B need to communicate with each other.
Configuration Roadmap
The configuration roadmap is as follows:
- Configure IP addresses for interfaces.
- Configure basic NAT functions.
- Configure a NAT distribution policy.
- Configure public network routes. In this example, static routes are used.
- Configure an access control list (ACL) rule group to allow specific data flows to be protected.
- Configure an IPsec security proposal.
- Configure an IKE security proposal.
- Configure IKE peers.
- Configure an IPSec policy.
- Configure an IPsec service instance group.
- Apply the IPsec policy to a tunnel interface.
Data Preparation
IP addresses of interfaces
service-location backup group index ID (1)
Name of a service-instance-group service instance group (group1)
NAT instance name (nat1) and index (1)
Device A's NAT address pool name (address-group1), address pool number (1), a range of public IP addresses (11.11.11.0 through 11.11.11.7)
NAT ACL name (3000)
Traffic classifier (classifier1)
Traffic behavior (behavior1)
Traffic policy (policy1)
Number of an interface to which a NAT traffic distribution policy applies
Tunnel interface IP address
Pre-shared key
Security protocols, encryption algorithms, and authentication algorithms to be used by IPsec proposals
Authentication algorithm used in an IKE security proposal
Procedure
- Configure device A.
- Configure a static route to network B for traffic processed by NAT and set the static route's outbound interface name and nexthop IP address to Tunnel10 and 192.168.1.2, respectively. Assume that the next-hop IP address and mask of device A is 12.12.1.2/24.
When you configure the static route to direct traffic processed by NAT to an IPsec tunnel, set the outbound interface in the static route to the IPsec tunnel interface and specify a next-hop IP address.
[~DeviceA] ip route-static 10.1.2.0 255.255.255.0 Tunnel 10 192.168.1.2
[*DeviceA] ip route-static 192.168.1.2 255.255.255.255 12.12.1.2
[*DeviceA] commit
- Configure an IKE peer named b.
[~DeviceA] ike peer b
[*DeviceA-ike-peer-b] ike-proposal 10
[*DeviceA-ike-peer-b] remote-address 192.168.1.2
[*DeviceA-ike-peer-b] pre-shared-key abcde
[*DeviceA-ike-peer-b] quit
[*DeviceA] commit
Enable both IKEv1 and IKEv2 on an NE20E. If the peer device does not support IKEv2, disable IKEv2 and use IKEv1 in negotiation.
The authentication keyword on a local device must be the same as that on the peer device.
- Configure a static route to network B for traffic processed by NAT and set the static route's outbound interface name and nexthop IP address to Tunnel10 and 192.168.1.2, respectively. Assume that the next-hop IP address and mask of device A is 12.12.1.2/24.
- # Configure device B.
- Configure a static route to network A for traffic processed by NAT and set the static route's outbound interface name and next-hop IP address to Tunnel10 and 192.168.1.1, respectively. Assume that the next-hop IP address of device B is 12.12.2.2/24.
When you configure the static route to direct traffic processed by NAT to an IPsec tunnel, set the outbound interface in the static route to the IPsect tunnel interface and specify a next-hop IP address.
[~DeviceB] ip route-static 11.11.11.0 255.255.255.248 Tunnel 10 192.168.1.1
[*DeviceB] ip route-static 192.168.1.1 255.255.255.255 12.12.2.2
[*DeviceB] commit
- Configure a static route to network A for traffic processed by NAT and set the static route's outbound interface name and next-hop IP address to Tunnel10 and 192.168.1.1, respectively. Assume that the next-hop IP address of device B is 12.12.2.2/24.
Configuration Files
Device A configuration file
# sysname DeviceA # ike dpd 100 # service-location 1 location slot 9//The information is generated in the configuration file when the location slot is used. location follow-forwarding-mode//The information is generated in the configuration file when the location follow-forwarding-mode is used. # service-instance-group group1 service-location 1 # nat instance nat1 id 1 service-instance-group group1 nat address-group address-group1 group-id 1 11.11.11.0 mask 29 # acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 # acl number 3010 rule 5 permit ip source 11.11.11.0 0.0.0.7 destination 10.1.2.2 0.0.0.0 # ike proposal 10 encryption-algorithm aes-cbc 256 dh group14 authentication-algorithm sha2-256 integrity-algorithm hmac-sha2-256 # ike peer b pre-shared-key cipher %^%#.EJ~F"jURXr&0--*9[2(uLl^I@0_]XBJe;=-0x,V%^%# ike-proposal 10 remote-address 192.168.1.2 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes 256 # traffic classifier classifier1 operator or if-match acl 3000 # traffic behavior behavior1 nat bind instance nat1 # traffic policy policy1 classifier classifier1 behavior behavior1 precedence 1 # ipsec policy map1 10 isakmp security acl 3010 ike-peer b proposal tran1 # interface GigabitEthernet 0/2/1 ip address 10.1.1.1 255.255.255.0 traffic-policy policy1 inbound # interface GigabitEthernet 0/2/2 ip address 12.12.1.1 255.255.255.0 # interface Tunnel10 ip address 192.168.1.1 255.255.255.255 tunnel-protocol ipsec ipsec policy map1 service-instance-group group1 # ip route-static 10.1.2.0 255.255.255.0 Tunnel 10 192.168.1.2 ip route-static 192.168.1.2 255.255.255.255 12.12.1.2 # return
Device B configuration file
# sysname DeviceB # acl number 3010 rule 5 permit ip source 10.1.2.2 0 destination 11.11.11.0 0.0.0.7 # ike proposal 10 encryption-algorithm aes-cbc 256 dh group14 authentication-algorithm sha2-256 integrity-algorithm hmac-sha2-256 # ike peer a pre-shared-key cipher %^%#.EJ~F"jURXr&0--*9[2(uLl^I@0_]XBJe;=-0x,V%^%# ike-proposal 10 remote-address 192.168.1.1 # service-location 1 location slot 9//The information is generated in the configuration file when the location slot is used. location follow-forwarding-mode//The information is generated in the configuration file when the location follow-forwarding-mode is used. # service-instance-group group1 service-location 1 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes 256 # ipsec policy map1 10 isakmp security acl 3010 ike-peer a proposal tran1 # interface GigabitEthernet0/2/1 ip address 10.1.2.1 255.255.255.0 # interface GigabitEthernet0/2/2 ip address 12.12.2.1 255.255.255.0 # interface Tunnel10 ip address 192.168.1.2 255.255.255.255 tunnel-protocol ipsec ipsec policy map1 service-instance-group 1 # ip route-static 11.11.11.0 255.255.255.248 Tunnel 10 192.168.1.1 ip route-static 192.168.1.1 255.255.255.255 12.12.2.2 # return
