IPsec vpn-总部深信服 SSL M7.5设备旁挂对接分布华三防火墙

只看该作者 · 发表于 2024-6-18 09:09

大佬们，IPsec vpn-总部深信服 SSL M7.5设备旁挂核心对接分部出口华三防火墙（野蛮模式），对接不上。可以帮忙看看吗？

华三侧配置
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>dis cu
#
version 7.1.064, Ess 8394P05
#
sysname yanglao
#
clock protocol none
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dialer-group 1 rule ip permit
dialer-group 3 rule ip permit
#
dns server 8.8.8.8
dns server 114.114.114.114
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
policy-based-route 1 permit node 0
if-match acl 3200
#
policy-based-route 1 permit node 5
if-match acl 3100
apply default-output-interface Dialer1
#
policy-based-route 1 permit node 10
if-match acl 3300
apply default-output-interface Dialer3
#
interface Dialer1
ppp chap password cipher $c$3$f5lGKV3pD7sM/fTgDl4iWy00Fy61xpZPoDzL
ppp chap user 075508273848@163.com
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 075508273848@163.com password cipher $c$3$esMeHJvVLXIxt+ET6dxptux19c9klCv4pr1I
dialer bundle enable
dialer-group 1
dialer timer idle 0
dialer timer autodial 5
dialer number 1 autodial
ip address ppp-negotiate
tcp mss 1024
nat outbound 3000
#
interface Dialer3
ppp chap password cipher $c$3$YXPROvJK5Xv6k0jOJgrycWJL3lwVplyF8NQn
ppp chap user 075507670267@163.com
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 075507670267@163.com password cipher $c$3$3+0FuM6/zEwPIDKWJugJQcTtaOSZaJ5JIIbM
dialer bundle enable
dialer-group 3
dialer timer idle 0
dialer timer autodial 5
dialer number 3 autodial
ip address ppp-negotiate
tcp mss 1024
nat outbound 3501
ipsec apply policy yanglao
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
pppoe-client dial-bundle-number 1
#
interface GigabitEthernet1/0/2
port link-mode route
#
interface GigabitEthernet1/0/3
port link-mode route
pppoe-client dial-bundle-number 3
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
ip address 10.10.10.1 255.255.255.0
ip policy-based-route 1
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface Ten-GigabitEthernet1/0/10
port link-mode route
#
interface Ten-GigabitEthernet1/0/11
port link-mode route
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/7
#
security-zone name DMZ
#
security-zone name Untrust
import interface Dialer1
import interface Dialer3
import interface GigabitEthernet1/0/1
import interface GigabitEthernet1/0/3
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
authentication-mode none
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 Dialer1
ip route-static 0.0.0.0 0 Dialer3
ip route-static 172.16.0.0 16 10.10.10.2
#
info-center loghost 106.3.96.73
#
customlog format attack-defense
customlog format dpi url-filter
customlog format dpi ips
customlog format dpi anti-virus
customlog format dpi reputation
customlog host 106.3.96.73 export dpi ips anti-virus reputation
#
ssh server enable
#
acl advanced 3000
rule 10 permit ip
#
acl advanced 3100
description WAN1
rule 0 permit ip source 192.168.253.0 0.0.0.255
#
acl advanced 3200
rule 0 permit ip source 192.168.252.0 0.0.1.255 destination 192.168.0.0 0.0.255.255
rule 5 permit ip source 192.168.252.0 0.0.1.255 destination 172.16.0.0 0.0.255.255
#
acl advanced 3300
description WAN3
rule 0 permit ip source 192.168.252.0 0.0.0.255
#
acl advanced 3500
rule 1 permit ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
rule 2 permit ip source 172.16.110.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
#
acl advanced 3501
rule 1 deny ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
rule 2 deny ip source 172.16.110.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
rule 10 permit ip
#
acl advanced 3510
#
acl advanced name IPsec_66_IPv4_1
rule 0 permit ip source 172.16.100.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$PGC1EoWDRam/cqA1$kdbCs5c2P3ccDfn1IGnbsqtA/Vb3dqJ/OA2DcpDblawo7g3f3/m6MP6LqxEu22hGw/oEW/p3n0r2OeeK6WY0Rw==
service-type ssh telnet terminal http https
authorization-attribute user-role level-3
authorization-attribute user-role level-15
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user admins class manage
password hash $h$6$D6Q3ur/sAyDpYyYS$CMn+fJvdgrbgwzgVvUf//oSd5mGHZjg2B9E4XsHFzTYgsXmxAU0ymUmA25nOo6gWGOk2TfF5NZfvNeOLpk+4SA==
service-type ssh telnet http https
authorization-attribute work-directory slot1#flash:
authorization-attribute user-role network-admin
#
ssl renegotiation disable
ssl version ssl3.0 disable
ssl version tls1.0 disable
undo ssl version tls1.1 disable
#
ipsec logging packet enable
#
ipsec transform-set yanglao
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#
ipsec policy yanglao 1 isakmp
transform-set yanglao
security acl 3500
remote-address 113.98.196.77
ike-profile 1
#
ike profile 1
keychain 1
exchange-mode aggressive
local-identity fqdn yanglao
match remote identity fqdn zongbu
match remote identity address 113.98.196.77 255.255.255.255
proposal 1
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike keychain 1
pre-shared-key address 113.98.196.77 255.255.255.255 key cipher $c$3$3w3GiMxVJw0C6gJRSiJLrNXR9Pg0CMJlEZBxwBE=
#
ip https enable
#
blacklist global enable
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
app-profile 0_IPv4
ips apply policy default mode protect
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
log language chinese
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
security-policy ip
rule 0 name 1
action pass
counting enable
profile 0_IPv4
#
dac log-collect service attack-defense blacklist enable
dac log-collect service attack-defense flood enable
dac log-collect service attack-defense scan enable
dac log-collect service attack-defense signature enable
dac log-collect service dpi traffic enable
dac traffic-statistic user enable
dac traffic-statistic application enable
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus logging parameter-profile av_logging_default_parameter
#
return
<yanglao>
<yanglao>
<yanglao>
<yanglao>dis ike sa
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
ID Profile Remote Flag Remote-Type Remote-ID
--------------------------------------------------------------------------------
13 1 113.98.196.77 RD FQDN zongbu
<yanglao>disp ipsec policy
-------------------------------------------
IPsec Policy: yanglao
Interface: Virtual-Access0,
Dialer3
-------------------------------------------
-----------------------------
Sequence number: 1
Alias: yanglao-1
Mode: ISAKMP
-----------------------------
Traffic Flow Confidentiality: Disabled
Security data flow: 3500
Selector mode: standard
Local address:
Remote address: 113.98.196.77
Remote address switchback mode: Disabled
Transform set: yanglao
IKE profile: 1
IKEv2 profile:
smart-link policy:
SA trigger mode: Traffic-based
SA duration(time based): 3600 seconds
SA duration(traffic based): 1843200 kilobytes
SA soft-duration buffer(time based): --
SA soft-duration buffer(traffic based): --
SA idle time: --
SA df-bit:
Responder only: Disabled
<yanglao>
<yanglao>
<yanglao>
<yanglao>disp acl
^
% Incomplete command found at '^' position.
<yanglao>
<yanglao>
<yanglao>disp acl all
Advanced IPv4 ACL 3000, 1 rule,
ACL's step is 5
rule 10 permit ip (1771900185 times matched)
Advanced IPv4 ACL 3100, 1 rule,
WAN1
ACL's step is 5
rule 0 permit ip source 192.168.253.0 0.0.0.255 (374677136 times matched)
Advanced IPv4 ACL 3200, 2 rules,
ACL's step is 5
rule 0 permit ip source 192.168.252.0 0.0.1.255 destination 192.168.0.0 0.0.255.255 (3599255 times matched)
rule 5 permit ip source 192.168.252.0 0.0.1.255 destination 172.16.0.0 0.0.255.255 (24751 times matched)
Advanced IPv4 ACL 3300, 1 rule,
WAN3
ACL's step is 5
rule 0 permit ip source 192.168.252.0 0.0.0.255 (1379575019 times matched)
Advanced IPv4 ACL 3500, 2 rules,
ACL's step is 5
rule 1 permit ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
rule 2 permit ip source 172.16.110.0 0.0.0.254 destination 192.168.0.0 0.0.255.255 (149 times matched)
Advanced IPv4 ACL 3501, 3 rules,
ACL's step is 5
rule 1 deny ip source 172.16.100.0 0.0.0.254 destination 192.168.0.0 0.0.255.255
rule 2 deny ip source 172.16.110.0 0.0.0.255 destination 192.168.0.0 0.0.255.255 (172 times matched)
rule 10 permit ip (140168 times matched)
Advanced IPv4 ACL 3510, 0 rule,
ACL's step is 5
Advanced IPv4 ACL named IPsec_66_IPv4_1, 1 rule,
ACL's step is 5
rule 0 permit ip source 172.16.100.0 0.0.0.255 destination 192.168.0.0 0.0.255.255
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>dis cu conf ike-profile
#
ike profile 1
keychain 1
exchange-mode aggressive
local-identity fqdn yanglao
match remote identity fqdn zongbu
match remote identity address 113.98.196.77 255.255.255.255
proposal 1
#
return
<yanglao>
<yanglao>
<yanglao>
<yanglao>dis cu conf ike-keychain
#
ike keychain 1
pre-shared-key address 113.98.196.77 255.255.255.255 key cipher $c$3$3w3GiMxVJw0C6gJRSiJLrNXR9Pg0CMJlEZBxwBE=
#
return
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>display ike proposal
Priority Authentication Authentication Encryption Diffie-Hellman Duration
method algorithm algorithm group (seconds)
----------------------------------------------------------------------------
1 PRE-SHARED-KEY MD5 3DES-CBC Group 2 86400
default PRE-SHARED-KEY SHA1 DES-CBC Group 1 86400
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao> display ipsec transform-set
IPsec transform set: yanglao
State: complete
Encapsulation mode: tunnel
ESN: Disabled
PFS:
Transform: ESP
ESP protocol:
Integrity: MD5
Encryption: 3DES-CBC
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>disp ike sa
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
ID Profile Remote Flag Remote-Type Remote-ID
--------------------------------------------------------------------------------
13 1 113.98.196.77 RD FQDN zongbu
<yanglao>disp ike sa ve
<yanglao>disp ike sa verbose
-----------------------------------------------
Connection ID: 13
Outside VPN:
Inside VPN:
Profile: 1
Transmitting entity: Initiator
Initiator cookie: ea454cb18fc5725e
Responder cookie: 1525d959f8439335
Output interface name:
-----------------------------------------------
Local IP/port: 100.64.20.190/4500
Local ID type: FQDN
Local ID: yanglao
Remote IP/port: 113.98.196.77/4500
Remote ID type: FQDN
Remote ID: zongbu
Authentication-method: PRE-SHARED-KEY
Authentication-algorithm: MD5
Encryption-algorithm: 3DES-CBC
Life duration(sec): 86400
Remaining key duration(sec): 86011
Exchange-mode: Aggressive
Diffie-Hellman group: Group 2
NAT traversal: Detected
Extend authentication: Disabled
Assigned IP address:
Vendor ID index:0xffffffff
Vendor ID sequence number:0x0
<yanglao>
<yanglao>
<yanglao>disp ipsec sa
<yanglao>
<yanglao>
<yanglao>
<yanglao>
<yanglao>sa f
Validating file. Please wait...
Saved the current configuration to mainboard device successfully.
<yanglao>
<yanglao>