[eNSP]建立IPSec隧道_ensp ipsec

1、配置静态路由
[AR 1]ip route-static 200.2.2.0 24 200.1.1.2
[AR 1]ip route-static 192.168.2.0 24 200.2.2.1
[AR 3]ip route-static 200.1.1.0 24 200.2.2.2
[AR 3]ip route-static 192.168.1.0 24 200.1.1.1


2、配置ACL，定义各自要保护的数据流
[AR 1-acl-adv-3001]rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
[AR 3-acl-adv-3001]rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

3、创建IPSec安全协议	
[AR 1]ipsec proposal tran1
[AR 1-ipsec-proposal-tran1]esp authentication-algorithm sha1
[AR 3]ipsec proposal tran1
[AR 3-ipsec-proposal-tran1]esp authentication-algorithm sha1

4、配置安全策略
[AR 1]ipsec policy map1 10 manual
[AR 1-ipsec-policy-manual-map1-10]security acl 3001
[AR 1-ipsec-policy-manual-map1-10]proposal tran1
[AR 1-ipsec-policy-manual-map1-10]tunnel remote 200.2.2.1	
[AR 1-ipsec-policy-manual-map1-10]tunnel local 200.1.1.1
[AR 1-ipsec-policy-manual-map1-10]sa spi outbound esp 12345	
[AR 1-ipsec-policy-manual-map1-10]sa spi inbound esp 54321	
[AR 1-ipsec-policy-manual-map1-10]sa string-key outbound esp simple abc	
[AR 1-ipsec-policy-manual-map1-10]sa string-key inbound esp simple cba

[AR 3]ipsec policy use1 10 manual
[AR 3-ipsec-policy-manual-use1-10]security acl 3001
[AR 3-ipsec-policy-manual-use1-10]proposal tran1
[AR 3-ipsec-policy-manual-use1-10]tunnel remote 200.1.1.1	
[AR 3-ipsec-policy-manual-use1-10]tunnel local 200.2.2.1	
[AR 3-ipsec-policy-manual-use1-10]sa spi outbound esp 54321	
[AR 3-ipsec-policy-manual-use1-10]sa spi inbound esp 12345	
[AR 3-ipsec-policy-manual-use1-10]sa string-key outbound esp simple cba	
[AR 3-ipsec-policy-manual-use1-10]sa string-key inbound esp simple abc

5、在接口上引用安全策略
[AR 1-GigabitEthernet0/0/0]ipsec policy map1
[AR 3-GigabitEthernet0/0/0]ipsec policy use1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41