评分并提供意见反馈 :
华为采用机器翻译与人工审校相结合的方式将此文档翻译成不同语言，希望能帮助您更容易理解此文档的内容。 请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 华为对于翻译的准确性不承担任何责任，并建议您参考英文文档（已提供链接）。
配置PPPoE拨号分支与总部建立IPSec隧道示例
组网需求
如图5-48所示，RouterA为企业分支网关，RouterB为企业总部网关，分支与总部通过公网建立通信。分支子网为10.1.1.0/24，总部子网为10.1.2.0/24。同时，分支网关通过PPPoE方式接入公网，PPPoE_Server为分支网关分配IP地址的服务器。
企业希望对分支子网与总部子网之间相互访问的流量进行安全保护。分支与总部通过公网建立通信，可以在分支网关与总部网关之间建立一个IPSec隧道来实施安全保护。由于分支网关作为PPPoE客户端获取IP地址，总部无法获取其IP地址，所以总部网关只能响应分支网关发起的IPSec协商。
如果分支网关和总部网关都通过PPPoE方式接入公网，则分支网关和总部网关必须执行命令remote-address host-name host-name指定域名进行IPSec协商，否则IPSec隧道无法建立。
配置思路
采用如下思路配置PPPoE用户发起协商建立IPSec隧道示例：
- 在RouterA上配置PPPoE客户端，使其能从服务器端获取IP地址。
配置IPSec隧道以IKE动态协商方式建立。其中RouterB作为响应方，接受RouterA发起的IPSec协商。
操作步骤
- 在RouterA上配置PPPoE客户端，使其能从服务器端获取IP地址
# 配置拨号访问组，指定允许所有的IPv4报文通过。
<Huawei> system-view [Huawei] sysname RouterA [RouterA] dialer-rule [RouterA-dialer-rule] dialer-rule 1 ip permit [RouterA-dialer-rule] quit
# 创建拨号口，配置拨号口相关参数。
[RouterA] interface dialer 1 [RouterA-Dialer1] link-protocol ppp [RouterA-Dialer1] ppp chap user user@huawei.com [RouterA-Dialer1] ppp chap password cipher Example@123 [RouterA-Dialer1] ip address ppp-negotiate [RouterA-Dialer1] dialer user huawei [RouterA-Dialer1] dialer bundle 1 [RouterA-Dialer1] dialer-group 1 [RouterA-Dialer1] quit
# 在物理接口下绑定拨号口，建立PPPoE会话。
[RouterA] interface gigabitethernet1/0/0 [RouterA-GigabitEthernet1/0/0] pppoe-client dial-bundle-number 1 [RouterA-GigabitEthernet1/0/0] quit
# 配置接口的IP地址。
[RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] ip address 10.1.1.1 255.255.255.0 [RouterA-GigabitEthernet2/0/0] quit
# 配置局域网用户通过NAT转换将私网地址转换为公网地址，进行拨号上网。
[RouterA] acl number 3002 [RouterA-acl-adv-3002] rule 1 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [RouterA-acl-adv-3002] rule 5 permit ip source 10.1.1.0 0.0.0.255 [RouterA-acl-adv-3002] quit [RouterA] interface dialer 1 [RouterA-Dialer1] nat outbound 3002 [RouterA-Dialer1] quit
# 配置到对端的静态路由，指定到达PC B的下一跳地址为拨号口Dialer1。
[RouterA] ip route-static 6.6.6.0 24 dialer1 [RouterA] ip route-static 10.1.2.0 24 dialer1
- 在RouterA上配置以IKE动态协商方式建立IPSec隧道的参数
# 配置ACL，定义由分支子网10.1.1.0/24去往总部子网10.1.2.0/24的数据流。
[RouterA] acl number 3003 [RouterA-acl-adv-3003] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [RouterA-acl-adv-3003] quit
# 配置IPSec安全提议。
[RouterA] ipsec proposal prop1 [RouterA-ipsec-proposal-prop1] esp authentication-algorithm sha2-256 [RouterA-ipsec-proposal-prop1] esp encryption-algorithm aes-128 [RouterA-ipsec-proposal-prop1] quit
# 配置IKE安全提议。
[RouterA] ike proposal 5 [RouterA-ike-proposal-5] encryption-algorithm aes-128 [RouterA-ike-proposal-5] authentication-algorithm sha2-256 [RouterA-ike-proposal-5] dh group14 [RouterA-ike-proposal-5] quit
# 配置IKE对等体。
[RouterA] ike peer rut1 [RouterA-ike-peer-rut1] version 1 [RouterA-ike-peer-rut1] undo version 2 [RouterA-ike-peer-rut1] ike-proposal 5 [RouterA-ike-peer-rut1] pre-shared-key cipher Example@123 [RouterA-ike-peer-rut1] remote-address 6.6.6.6 [RouterA-ike-peer-rut1] quit
# 配置安全策略。
[RouterA] ipsec policy policy1 10 isakmp [RouterA-ipsec-policy-isakmp-policy1-10] ike-peer rut1 [RouterA-ipsec-policy-isakmp-policy1-10] proposal prop1 [RouterA-ipsec-policy-isakmp-policy1-10] security acl 3003 [RouterA-ipsec-policy-isakmp-policy1-10] quit
此时执行display ipsec policy可以查看所配置的信息。
# 在拨号接口下引用安全策略组。
[RouterA] interface dialer 1 [RouterA-Dialer1] ipsec policy policy1 [RouterA-Dialer1] quit
- 在RouterB上配置建立IKE动态协商方式的IPSec隧道的参数，RouterB作为协商响应方
# 配置接口的IP地址和到对端的静态路由。
<Huawei> system-view [Huawei] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip address 6.6.6.6 255.255.255.0 [RouterB-GigabitEthernet1/0/0] quit [RouterB] interface gigabitethernet 2/0/0 [RouterB-GigabitEthernet2/0/0] ip address 10.1.2.1 255.255.255.0 [RouterB-GigabitEthernet2/0/0] quit
# 配置到对端的静态路由，此处假设下一跳地址为6.6.6.254。
[RouterB] ip route-static 0.0.0.0 0.0.0.0 6.6.6.254# 配置IPSec安全提议。
[RouterB] ipsec proposal prop1 [RouterB-ipsec-proposal-prop1] esp authentication-algorithm sha2-256 [RouterB-ipsec-proposal-prop1] esp encryption-algorithm aes-128 [RouterB-ipsec-proposal-prop1] quit
# 配置IKE安全提议。
[RouterB] ike proposal 5 [RouterB-ike-proposal-5] encryption-algorithm aes-128 [RouterB-ike-proposal-5] authentication-algorithm sha2-256 [RouterB-ike-proposal-5] dh group14 [RouterB-ike-proposal-5] quit
# 配置IKE对等体。
由于RouterB上采用策略模板方式配置安全策略，作为协商的响应方，IKE对等体中无需指定对端IP地址。
[RouterB] ike peer rut1 [RouterB-ike-peer-rut1] version 1 [RouterB-ike-peer-rut1] undo version 2 [RouterB-ike-peer-rut1] ike-proposal 5 [RouterB-ike-peer-rut1] pre-shared-key cipher Example@123 [RouterB-ike-peer-rut1] quit
# 配置策略模板。
[RouterB] ipsec policy-template temp1 10 [RouterB-ipsec-policy-templet-temp1-10] ike-peer rut1 [RouterB-ipsec-policy-templet-temp1-10] proposal prop1 [RouterB-ipsec-policy-templet-temp1-10] quit
此时执行display ipsec policy-template可以查看所配置的信息，
# 在安全策略中引用策略模板。
[RouterB] ipsec policy policy1 10 isakmp template temp1# 在接口上引用安全策略组。
[RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ipsec policy policy1 [RouterB-GigabitEthernet1/0/0] quit
- 检查配置结果
# 配置成功后，在PC A上执行ping操作仍然可以ping通PC B，它们之间的数据传输将被加密，执行命令display ipsec statistics可以查看数据包的统计信息。
# 在RouterA上执行display ike sa操作，结果如下。
[RouterA] display ike sa IKE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ------------------------------------------------------------------------- 246 6.6.6.6:500 RD|ST v1:2 IP 6.6.6.6 245 6.6.6.6:500 RD|ST v1:1 IP 6.6.6.6 Number of IKE SA : 2 ------------------------------------------------------------------------- Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING
配置文件
RouterA的配置文件
# sysname RouterA # acl number 3002 rule 1 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 rule 5 permit ip source 10.1.1.0 0.0.0.255 acl number 3003 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 # ipsec proposal prop1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-128 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer rut1 version 1 pre-shared-key cipher %^%#JvZxR2g8c;a9~FPN~n'$7`DEV&=G(=Et02P/%\*!%^%# ike-proposal 5 remote-address 6.6.6.6 # ipsec policy policy1 10 isakmp security acl 3003 ike-peer rut1 proposal prop1 # interface Dialer1 link-protocol ppp ppp chap user user@huawei.com ppp chap password cipher %@%@^_PfANXK0(,Jr-(3p]"R,eOL%@%@ ip address ppp-negotiate dialer user huawei dialer bundle 1 dialer-group 1 nat outbound 3002 ipsec policy policy1 # interface GigabitEthernet1/0/0 pppoe-client dial-bundle-number 1 # interface GigabitEthernet2/0/0 ip address 10.1.1.1 255.255.255.0 # dialer-rule dialer-rule 1 ip permit # ip route-static 6.6.6.0 255.255.255.0 dialer1 ip route-static 10.1.2.0 255.255.255.0 Dialer1 # return
RouterB的配置文件
# sysname RouterB # ipsec proposal prop1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 5 encryption-algorithm aes-128 dh group14 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer rut1 version 1 pre-shared-key cipher %^%#K{JG:rWVHPMnf;5\|,GW(Luq'qi8BT4nOj%5W5=)%^%# ike-proposal 5 # ipsec policy-template temp1 ike-peer rut1 proposal prop1 # ipsec policy policy1 10 isakmp template temp1 # interface GigabitEthernet1/0/0 ip address 6.6.6.6 255.255.255.0 ipsec policy policy1 # interface GigabitEthernet2/0/0 ip address 10.1.2.1 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 6.6.6.254 # return
