|
IPsec vpn-总部深信服 SSL M7.5设备旁挂对接分布华三防火墙
新手031191
2024-6-18 09:09
1117
大佬们,IPsec vpn-总部深信服 SSL M7.5设备旁挂核心对接分部出口华三防火墙(野蛮模式),对接不上。可以帮忙看看吗?- 华三侧配置
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>dis cu
- #
- version 7.1.064, Ess 8394P05
- #
- sysname yanglao
- #
- clock protocol none
- #
- telnet server enable
- #
- irf mac-address persistent timer
- irf auto-update enable
- undo irf link-delay
- irf member 1 priority 1
- #
- dialer-group 1 rule ip permit
- dialer-group 3 rule ip permit
- #
- dns server 8.8.8.8
- dns server 114.114.114.114
- #
- lldp global enable
- #
- password-recovery enable
- #
- vlan 1
- #
- policy-based-route 1 permit node 0
- if-match acl 3200
- #
- policy-based-route 1 permit node 5
- if-match acl 3100
- apply default-output-interface Dialer1
- #
- policy-based-route 1 permit node 10
- if-match acl 3300
- apply default-output-interface Dialer3
- #
- interface Dialer1
- ppp chap password cipher $c$3$f5lGKV3pD7sM/fTgDl4iWy00Fy61xpZPoDzL
- ppp chap user 075508273848@163.com
- ppp ipcp dns admit-any
- ppp ipcp dns request
- ppp pap local-user 075508273848@163.com password cipher $c$3$esMeHJvVLXIxt+ET6dxptux19c9klCv4pr1I
- dialer bundle enable
- dialer-group 1
- dialer timer idle 0
- dialer timer autodial 5
- dialer number 1 autodial
- ip address ppp-negotiate
- tcp mss 1024
- nat outbound 3000
- #
- interface Dialer3
- ppp chap password cipher $c$3$YXPROvJK5Xv6k0jOJgrycWJL3lwVplyF8NQn
- ppp chap user 075507670267@163.com
- ppp ipcp dns admit-any
- ppp ipcp dns request
- ppp pap local-user 075507670267@163.com password cipher $c$3$3+0FuM6/zEwPIDKWJugJQcTtaOSZaJ5JIIbM
- dialer bundle enable
- dialer-group 3
- dialer timer idle 0
- dialer timer autodial 5
- dialer number 3 autodial
- ip address ppp-negotiate
- tcp mss 1024
- nat outbound 3501
- ipsec apply policy yanglao
- #
- interface NULL0
- #
- interface GigabitEthernet1/0/0
- port link-mode route
- ip address 192.168.0.1 255.255.255.0
- #
- interface GigabitEthernet1/0/1
- port link-mode route
- pppoe-client dial-bundle-number 1
- #
- interface GigabitEthernet1/0/2
- port link-mode route
- #
- interface GigabitEthernet1/0/3
- port link-mode route
- pppoe-client dial-bundle-number 3
- #
- interface GigabitEthernet1/0/4
- port link-mode route
- #
- interface GigabitEthernet1/0/5
- port link-mode route
- #
- interface GigabitEthernet1/0/6
- port link-mode route
- #
- interface GigabitEthernet1/0/7
- port link-mode route
- ip address 10.10.10.1 255.255.255.0
- ip policy-based-route 1
- #
- interface GigabitEthernet1/0/8
- port link-mode route
- #
- interface GigabitEthernet1/0/9
- port link-mode route
- #
- interface Ten-GigabitEthernet1/0/10
- port link-mode route
- #
- interface Ten-GigabitEthernet1/0/11
- port link-mode route
- #
- security-zone name Local
- #
- security-zone name Trust
- import interface GigabitEthernet1/0/7
- #
- security-zone name DMZ
- #
- security-zone name Untrust
- import interface Dialer1
- import interface Dialer3
- import interface GigabitEthernet1/0/1
- import interface GigabitEthernet1/0/3
- #
- security-zone name Management
- import interface GigabitEthernet1/0/0
- #
- scheduler logfile size 16
- #
- line class aux
- user-role network-operator
- #
- line class console
- authentication-mode scheme
- user-role network-admin
- #
- line class vty
- user-role network-operator
- #
- line aux 0
- authentication-mode none
- user-role network-admin
- #
- line con 0
- user-role network-admin
- #
- line vty 0 63
- authentication-mode scheme
- user-role network-admin
- #
- ip route-static 0.0.0.0 0 Dialer1
- ip route-static 0.0.0.0 0 Dialer3
- ip route-static 172.16.0.0 16 10.10.10.2
- #
- info-center loghost 106.3.96.73
- #
- customlog format attack-defense
- customlog format dpi url-filter
- customlog format dpi ips
- customlog format dpi anti-virus
- customlog format dpi reputation
- customlog host 106.3.96.73 export dpi ips anti-virus reputation
- #
- ssh server enable
- #
- acl advanced 3000
- rule 10 permit ip
- #
- acl advanced 3100
- description WAN1
- rule 0 permit ip source 192.168.253.0 0.0.0.255
- #
- acl advanced 3200
- rule 0 permit ip source 192.168.252.0 0.0.1.255 destination 192.168.0.0 0.0.255.255
- rule 5 permit ip source 192.168.252.0 0.0.1.255 destination 172.16.0.0 0.0.255.255
- #
- acl advanced 3300
- description WAN3
- rule 0 permit ip source 192.168.252.0 0.0.0.255
- #
- acl advanced 3500
- rule 1 permit ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
- rule 2 permit ip source 172.16.110.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
- #
- acl advanced 3501
- rule 1 deny ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
- rule 2 deny ip source 172.16.110.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
- rule 10 permit ip
- #
- acl advanced 3510
- #
- acl advanced name IPsec_66_IPv4_1
- rule 0 permit ip source 172.16.100.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
- #
- domain system
- #
- domain default enable system
- #
- role name level-0
- description Predefined level-0 role
- #
- role name level-1
- description Predefined level-1 role
- #
- role name level-2
- description Predefined level-2 role
- #
- role name level-3
- description Predefined level-3 role
- #
- role name level-4
- description Predefined level-4 role
- #
- role name level-5
- description Predefined level-5 role
- #
- role name level-6
- description Predefined level-6 role
- #
- role name level-7
- description Predefined level-7 role
- #
- role name level-8
- description Predefined level-8 role
- #
- role name level-9
- description Predefined level-9 role
- #
- role name level-10
- description Predefined level-10 role
- #
- role name level-11
- description Predefined level-11 role
- #
- role name level-12
- description Predefined level-12 role
- #
- role name level-13
- description Predefined level-13 role
- #
- role name level-14
- description Predefined level-14 role
- #
- user-group system
- #
- local-user admin class manage
- password hash $h$6$PGC1EoWDRam/cqA1$kdbCs5c2P3ccDfn1IGnbsqtA/Vb3dqJ/OA2DcpDblawo7g3f3/m6MP6LqxEu22hGw/oEW/p3n0r2OeeK6WY0Rw==
- service-type ssh telnet terminal http https
- authorization-attribute user-role level-3
- authorization-attribute user-role level-15
- authorization-attribute user-role network-admin
- authorization-attribute user-role network-operator
- #
- local-user admins class manage
- password hash $h$6$D6Q3ur/sAyDpYyYS$CMn+fJvdgrbgwzgVvUf//oSd5mGHZjg2B9E4XsHFzTYgsXmxAU0ymUmA25nOo6gWGOk2TfF5NZfvNeOLpk+4SA==
- service-type ssh telnet http https
- authorization-attribute work-directory slot1#flash:
- authorization-attribute user-role network-admin
- #
- ssl renegotiation disable
- ssl version ssl3.0 disable
- ssl version tls1.0 disable
- undo ssl version tls1.1 disable
- #
- ipsec logging packet enable
- #
- ipsec transform-set yanglao
- esp encryption-algorithm 3des-cbc
- esp authentication-algorithm md5
- #
- ipsec policy yanglao 1 isakmp
- transform-set yanglao
- security acl 3500
- remote-address 113.98.196.77
- ike-profile 1
- #
- ike profile 1
- keychain 1
- exchange-mode aggressive
- local-identity fqdn yanglao
- match remote identity fqdn zongbu
- match remote identity address 113.98.196.77 255.255.255.255
- proposal 1
- #
- ike proposal 1
- encryption-algorithm 3des-cbc
- dh group2
- authentication-algorithm md5
- #
- ike keychain 1
- pre-shared-key address 113.98.196.77 255.255.255.255 key cipher $c$3$3w3GiMxVJw0C6gJRSiJLrNXR9Pg0CMJlEZBxwBE=
- #
- ip https enable
- #
- blacklist global enable
- #
- ips signature auto-update
- update schedule daily start-time 02:00:00 tingle 120
- #
- app-profile 0_IPv4
- ips apply policy default mode protect
- #
- inspect logging parameter-profile av_logging_default_parameter
- #
- inspect logging parameter-profile ips_logging_default_parameter
- log language chinese
- #
- inspect logging parameter-profile url_logging_default_parameter
- #
- loadbalance isp file flash:/lbispinfo_v1.5.tp
- #
- security-policy ip
- rule 0 name 1
- action pass
- counting enable
- profile 0_IPv4
- #
- dac log-collect service attack-defense blacklist enable
- dac log-collect service attack-defense flood enable
- dac log-collect service attack-defense scan enable
- dac log-collect service attack-defense signature enable
- dac log-collect service dpi traffic enable
- dac traffic-statistic user enable
- dac traffic-statistic application enable
- #
- ips logging parameter-profile ips_logging_default_parameter
- #
- anti-virus logging parameter-profile av_logging_default_parameter
- #
- return
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>dis ike sa
- Flags:
- RD--READY RL--REPLACED FD-FADING RK-REKEY
- ID Profile Remote Flag Remote-Type Remote-ID
- --------------------------------------------------------------------------------
- 13 1 113.98.196.77 RD FQDN zongbu
- <yanglao>disp ipsec policy
- -------------------------------------------
- IPsec Policy: yanglao
- Interface: Virtual-Access0,
- Dialer3
- -------------------------------------------
- -----------------------------
- Sequence number: 1
- Alias: yanglao-1
- Mode: ISAKMP
- -----------------------------
- Traffic Flow Confidentiality: Disabled
- Security data flow: 3500
- Selector mode: standard
- Local address:
- Remote address: 113.98.196.77
- Remote address switchback mode: Disabled
- Transform set: yanglao
- IKE profile: 1
- IKEv2 profile:
- smart-link policy:
- SA trigger mode: Traffic-based
- SA duration(time based): 3600 seconds
- SA duration(traffic based): 1843200 kilobytes
- SA soft-duration buffer(time based): --
- SA soft-duration buffer(traffic based): --
- SA idle time: --
- SA df-bit:
- Responder only: Disabled
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>disp acl
- ^
- % Incomplete command found at '^' position.
- <yanglao>
- <yanglao>
- <yanglao>disp acl all
- Advanced IPv4 ACL 3000, 1 rule,
- ACL's step is 5
- rule 10 permit ip (1771900185 times matched)
- Advanced IPv4 ACL 3100, 1 rule,
- WAN1
- ACL's step is 5
- rule 0 permit ip source 192.168.253.0 0.0.0.255 (374677136 times matched)
- Advanced IPv4 ACL 3200, 2 rules,
- ACL's step is 5
- rule 0 permit ip source 192.168.252.0 0.0.1.255 destination 192.168.0.0 0.0.255.255 (3599255 times matched)
- rule 5 permit ip source 192.168.252.0 0.0.1.255 destination 172.16.0.0 0.0.255.255 (24751 times matched)
- Advanced IPv4 ACL 3300, 1 rule,
- WAN3
- ACL's step is 5
- rule 0 permit ip source 192.168.252.0 0.0.0.255 (1379575019 times matched)
- Advanced IPv4 ACL 3500, 2 rules,
- ACL's step is 5
- rule 1 permit ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
- rule 2 permit ip source 172.16.110.0 0.0.0.254 destination 192.168.0.0 0.0.255.255 (149 times matched)
-
- Advanced IPv4 ACL 3501, 3 rules,
- ACL's step is 5
- rule 1 deny ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
- rule 2 deny ip source 172.16.110.0 0.0.0.255 destination 192.168.0.0 0.0.255.255 (172 times matched)
- rule 10 permit ip (140168 times matched)
- Advanced IPv4 ACL 3510, 0 rule,
- ACL's step is 5
- Advanced IPv4 ACL named IPsec_66_IPv4_1, 1 rule,
- ACL's step is 5
- rule 0 permit ip source 172.16.100.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>dis cu conf ike-profile
- #
- ike profile 1
- keychain 1
- exchange-mode aggressive
- local-identity fqdn yanglao
- match remote identity fqdn zongbu
- match remote identity address 113.98.196.77 255.255.255.255
- proposal 1
- #
- return
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>dis cu conf ike-keychain
- #
- ike keychain 1
- pre-shared-key address 113.98.196.77 255.255.255.255 key cipher $c$3$3w3GiMxVJw0C6gJRSiJLrNXR9Pg0CMJlEZBxwBE=
- #
- return
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>display ike proposal
- Priority Authentication Authentication Encryption Diffie-Hellman Duration
- method algorithm algorithm group (seconds)
- ----------------------------------------------------------------------------
- 1 PRE-SHARED-KEY MD5 3DES-CBC Group 2 86400
- default PRE-SHARED-KEY SHA1 DES-CBC Group 1 86400
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao> display ipsec transform-set
- IPsec transform set: yanglao
- State: complete
- Encapsulation mode: tunnel
- ESN: Disabled
- PFS:
- Transform: ESP
- ESP protocol:
- Integrity: MD5
- Encryption: 3DES-CBC
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>disp ike sa
- Flags:
- RD--READY RL--REPLACED FD-FADING RK-REKEY
- ID Profile Remote Flag Remote-Type Remote-ID
- --------------------------------------------------------------------------------
- 13 1 113.98.196.77 RD FQDN zongbu
- <yanglao>disp ike sa ve
- <yanglao>disp ike sa verbose
- -----------------------------------------------
- Connection ID: 13
- Outside VPN:
- Inside VPN:
- Profile: 1
- Transmitting entity: Initiator
- Initiator cookie: ea454cb18fc5725e
- Responder cookie: 1525d959f8439335
- Output interface name:
- -----------------------------------------------
- Local IP/port: 100.64.20.190/4500
- Local ID type: FQDN
- Local ID: yanglao
- Remote IP/port: 113.98.196.77/4500
- Remote ID type: FQDN
- Remote ID: zongbu
- Authentication-method: PRE-SHARED-KEY
- Authentication-algorithm: MD5
- Encryption-algorithm: 3DES-CBC
- Life duration(sec): 86400
- Remaining key duration(sec): 86011
- Exchange-mode: Aggressive
- Diffie-Hellman group: Group 2
- NAT traversal: Detected
- Extend authentication: Disabled
- Assigned IP address:
- Vendor ID index:0xffffffff
- Vendor ID sequence number:0x0
- <yanglao>
- <yanglao>
- <yanglao>disp ipsec sa
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>
- <yanglao>sa f
- Validating file. Please wait...
- Saved the current configuration to mainboard device successfully.
- <yanglao>
- <yanglao>
复制代码
帮忙看看吗? |
-
22.jpg
(509.75 KB, 下载次数: 64)
深信服配置1
-
23.jpg
(619.45 KB, 下载次数: 62)
深信服配置2
-
24.jpg
(651.45 KB, 下载次数: 59)
深信服配置3
解决该疑问,预计可以帮助到 16627 人!
回帖即可获得
2S豆
,被楼主采纳即奖励 20S豆+10分钟内回帖奖励 10S豆
[已过期]
, 了解更多S豆奖励信息
完善手机号和公司名称,让服务更省心更便捷!立即完善
|