华为路由器防火墙组网设置(华为防火墙USG6000v配置IPsec vpn异地组网)

小编：小蝶更新时间：2022-12-07

网络拓扑图

北京区域设备配置

AR1基本配置

sys [AR1]inter g0/0/1 [AR1-GigabitEthernet0/0/1]ip add 1.1.1.1 29 [AR1-GigabitEthernet0/0/1]quit [AR1]inter g0/0/2 [AR1-GigabitEthernet0/0/2]ip add 1.1.2.1 29 [AR1-GigabitEthernet0/0/2]quit [AR1]inter loopb0 [AR1-LoopBack0]ip add 5.5.5.5 32 [AR1-LoopBack0]quit

FW1基本配置

sys [FW1]inter g0/0/0 [FW1-GigabitEthernet0/0/0]ip add 192.168.7.100 24 [FW1-GigabitEthernet0/0/0]service-manage all per [FW1-GigabitEthernet0/0/0]quit [FW1]inter g1/0/0 [FW1-GigabitEthernet1/0/0]ip add 1.1.1.2 29 [FW1-GigabitEthernet1/0/0]service-manage ping per [FW1-GigabitEthernet1/0/0]quit [FW1]firewall zone untrust [FW1-zone-untrust]add inter g1/0/0 [FW1-zone-untrust]quit [FW1]inter g1/0/6 [FW1-GigabitEthernet1/0/6]i add 10.10.1.1 24 [FW1-GigabitEthernet1/0/6]service-manage ping per [FW1-GigabitEthernet1/0/6]quit [FW1]firewall zone trust [FW1-zone-trust]add inter g1/0/6 [FW1-zone-trust]quit [FW1]inter loopb0 [FW1-LoopBack0]ip add 9.9.9.9 32 [FW1-LoopBack0]quit 配置OSPF内部路由协议 [FW1]ospf 1 router-id 9.9.9.9 [FW1-ospf-1]area 0 [FW1-ospf-1-area-0.0.0.0]net 9.9.9.9 0.0.0.0 [FW1-ospf-1-area-0.0.0.0]net 10.10.1.0 0.0.0.255 [FW1-ospf-1-area-0.0.0.0]quit [FW1]ip route-static 0.0.0.0 0.0.0.0 g1/0/0 1.1.1.1 配置安全策略开发环境请勿any到any [FW1]security-policy [FW1-policy-security]rule name policy1 [FW1-policy-security-rule-policy1]source-zone trust [FW1-policy-security-rule-policy1]destination-zone untrust [FW1-policy-security-rule-policy1]act per [FW1-policy-security-rule-policy1]quit [FW1-policy-security]rule name policy2 [FW1-policy-security-rule-policy2]source-zone untrust [FW1-policy-security-rule-policy2]destination-zone trust [FW1-policy-security-rule-policy2]act per [FW1-policy-security-rule-policy2]quit [FW1-policy-security]rule name policy3 [FW1-policy-security-rule-policy3]source-zone local [FW1-policy-security-rule-policy3]destination-zone untrust [FW1-policy-security-rule-policy3]act per [FW1-policy-security-rule-policy3]quit [FW1-policy-security]rule name policy4 [FW1-policy-security-rule-policy4]source-zone untrust [FW1-policy-security-rule-policy4]destination-zone local [FW1-policy-security-rule-policy4]act per [FW1-policy-security-rule-policy4]quit 配置nat策略 [FW1]nat-policy [FW1-policy-nat]rule name easy_nat [FW1-policy-nat-rule-easy_nat]source-zone trust [FW1-policy-nat-rule-easy_nat]source-zone untrust [FW1-policy-nat-rule-easy_nat]act source-nat easy-ip [FW1-policy-nat-rule-easy_nat]quit 创建IPsec安全提议 [FW1]ipsec proposal tran1 [FW1-ipsec-proposal-tran1]esp authentication-algorithm sha2-256 [FW1-ipsec-proposal-tran1]esp encryption-algorithm aes-256 [FW1-ipsec-proposal-tran1]quit 创建IPsec policy P10 [FW1]ipsec policy P10 10 manual [FW1-ipsec-policy-manual-P10-10]security acl 3000 [FW1-ipsec-policy-manual-P10-10]proposal tran1 [FW1-ipsec-policy-manual-P10-10]tunnel local 1.1.2.2 [FW1-ipsec-policy-manual-P10-10]tunnel remote 1.1.1.2 [FW1-ipsec-policy-manual-P10-10]sa spi inbound esp 654321 [FW1-ipsec-policy-manual-P10-10]sa string-key inbound esp P@ssw0rd [FW1-ipsec-policy-manual-P10-10]sa spi outbound esp 123456 [FW1-ipsec-policy-manual-P10-10]sa string-key outbound esp P@ssw0rd [FW1-ipsec-policy-manual-P10-10]quit [FW1]inter g1/0/0 [FW1-GigabitEthernet1/0/0]ipsec policy P10 [FW1-GigabitEthernet1/0/0]quit 配置nat豁免 [FW1]nat-policy [FW1-policy-nat]rule name nat1 [FW1-policy-nat-rule-nat1]source-zone trust [FW1-policy-nat-rule-nat1]source-zone untrust [FW1-policy-nat-rule-nat1]source-add 10.10.1.0 0.0.0.255 [FW1-policy-nat-rule-nat1]destination-add 10.10.5.0 0.0.0.255 [FW1-policy-nat-rule-nat1]action no-nat [FW1-policy-nat-rule-nat1]quit [FW1-policy-nat]rule move nat1 top

LSW1基本配置

[LSW1]vlan batch 100 200 300 [LSW1]inter vlan 100 [LSW1-Vlanif100]ip add 10.10.1.254 24 [LSW1-Vlanif100]quit [LSW1-Vlanif200]ip add 10.10.2.254 24 [LSW1-Vlanif200]quit [LSW1]inter vlan 300 [LSW1-Vlanif300]ip add 10.10.3.254 24 [LSW1-Vlanif300]quit [LSW1]inter loopb0 [LSW1-LoopBack0]ip add 8.8.8.8 32 [LSW1-LoopBack0]quit 配置OSPF内部路由协议 [LSW1]ospf 1 router-id 8.8.8.8 [LSW1-ospf-1]area 0 [LSW1-ospf-1-area-0.0.0.0]net 8.8.8.8 0.0.0.0 [LSW1-ospf-1-area-0.0.0.0]net 10.10.1.0 0.0.0.255 [LSW1-ospf-1-area-0.0.0.0]net 10.10.2.0 0.0.0.255 [LSW1-ospf-1-area-0.0.0.0]net 10.10.3.0 0.0.0.255 [LSW1-ospf-1-area-0.0.0.0]quit [LSW1]inter g0/0/24 [LSW1-GigabitEthernet0/0/24]port link-ty ac [LSW1-GigabitEthernet0/0/24]port de vlan 100 [LSW1-GigabitEthernet0/0/24]quit [LSW1]inter g0/0/10 [LSW1-GigabitEthernet0/0/10]potr link-ty ac [LSW1-GigabitEthernet0/0/10]port de vlan 100 [LSW1-GigabitEthernet0/0/10]quit [LSW1]inter g0/0/11 [LSW1-GigabitEthernet0/0/11]port link-ty ac [LSW1-GigabitEthernet0/0/11]port de vlan 100 [LSW1-GigabitEthernet0/0/11]quit [LSW1-GigabitEthernet0/0/1]port link-ty ac [LSW1-GigabitEthernet0/0/1]port de vlan 200 [LSW1-GigabitEthernet0/0/1]quit [LSW1]inter g0/0/2 [LSW1-GigabitEthernet0/0/2]port link-ty ac [LSW1-GigabitEthernet0/0/2]port de vlan 300 [LSW1-GigabitEthernet0/0/2]quit [LSW1]ip route-static 0.0.0.0 0.0.0.0 Vlanif 100 10.10.1.1 [LSW1]dhcp enable [LSW1]ip pool 200 [LSW1-ip-pool-200]ga 10.10.2.254 [LSW1-ip-pool-200]netw 10.10.2.0 mask 255.255.255.0 [LSW1-ip-pool-200]dns 1.1.1.1 2.2.2.2 [LSW1-ip-pool-200]excluded-ip-address 10.10.2.50 10.10.2.253 [LSW1-ip-pool-200]quit [LSW1]inter vlan 200 [LSW1-Vlanif200]dhcp sel gl [LSW1-Vlanif200]quit [LSW1]ip pool 300 [LSW1-ip-pool-300]ga 10.10.3.254 [LSW1-ip-pool-300]netw 10.10.3.0 mask 255.255.255.0 [LSW1-ip-pool-300]dns 1.1.1.1 2.2.2.2 [LSW1-ip-pool-300]excluded-ip-address 10.10.3.50 10.10.3.253 [LSW1-ip-pool-300]quit [LSW1]inter vlan 300 [LSW1-Vlanif300]dhcp sel gl

上海区域设备配置

FW2基本配置

sys [FW2]inter g0/0/0 [FW2-GigabitEthernet0/0/0]ip add 192.168.7.150 24 [FW2-GigabitEthernet0/0/0]service-manage all per [FW2-GigabitEthernet0/0/0]quit [FW2]inter g1/0/0 [FW2-GigabitEthernet1/0/0]ip add 1.1.2.2 29 [FW2-GigabitEthernet1/0/0]service-manage ping per [FW2-GigabitEthernet1/0/0]quit [FW2]firewall zone untrust [FW2-zone-untrust]add inter g1/0/0 [FW2-zone-untrust]quit [FW2]inter g1/0/6 [FW2-GigabitEthernet1/0/6]ip add 10.10.5.1 24 [FW2-GigabitEthernet1/0/6]service-manage ping per [FW2-GigabitEthernet1/0/6]quit [FW2]firewall zone trust [FW2-zone-trust]add inter g1/0/6 [FW2-zone-trust]quit [FW2]inter loopb0 [FW2-LoopBack0]ip add 4.4.4.4 32 [FW2-LoopBack0]quit 配置OSPF内部路由协议 [FW2]ospf 1 router-id 4.4.4.4 [FW2-ospf-1]area 0 [FW2-ospf-1-area-0.0.0.0]net 4.4.4.4 0.0.0.0 [FW2-ospf-1-area-0.0.0.0]net 10.10.5.0 0.0.0.255 [FW2-ospf-1-area-0.0.0.0]quit [FW2]ip route-static 0.0.0.0 0.0.0.0 g1/0/0 1.1.2.1 配置安全策略开发环境请勿any到any [FW2]security-policy [FW2-policy-security]rule name policy1 [FW2-policy-security-rule-policy1]source-zone trust [FW2-policy-security-rule-policy1]destination-zone untrust [FW2-policy-security-rule-policy1]act per [FW2-policy-security-rule-policy1]quit [FW2-policy-security]rule name policy2 [FW2-policy-security-rule-policy2]source-zone untrust [FW2-policy-security-rule-policy2]destination-zone trust [FW2-policy-security-rule-policy2]act per [FW2-policy-security-rule-policy2]quit [FW2-policy-security]rule name policy3 [FW2-policy-security-rule-policy3]source-zone local [FW2-policy-security-rule-policy3]destination-zone untrust [FW2-policy-security-rule-policy3]act per [FW2-policy-security-rule-policy3]quit [FW2-policy-security]rule name policy4 [FW2-policy-security-rule-policy4]source-zone untrust [FW2-policy-security-rule-policy4]destination-zone local [FW2-policy-security-rule-policy4]act per [FW2-policy-security-rule-policy4]quit 配置nat策略 [FW2]nat-policy [FW2-policy-nat]rule name easy_nat [FW2-policy-nat-rule-easy_nat]source-zone trust [FW2-policy-nat-rule-easy_nat]source-zone untrust [FW2-policy-nat-rule-easy_nat]act source-nat easy-ip [FW2-policy-nat-rule-easy_nat]quit 创建高级ACL识别感兴趣流 [FW2-acl-adv-3000]rule per ip so 10.10.5.0 0.0.0.255 destination 10.10.1.0 0.0.0.255 [FW2-acl-adv-3000]quit 创建IPsec安全提议 [FW2]ipsec proposal tran1 [FW2-ipsec-proposal-tran1]esp authentication-algorithm sha2-256 [FW2-ipsec-proposal-tran1]esp encryption-algorithm aes-256 [FW2-ipsec-proposal-tran1]quit 创建IPsec policy P10 [FW2]ipsec policy P10 10 manual [FW2-ipsec-policy-manual-P10-10]security acl 3000 [FW2-ipsec-policy-manual-P10-10]proposal tran1 [FW2-ipsec-policy-manual-P10-10]tunnel local 1.1.2.2 [FW2-ipsec-policy-manual-P10-10]tunnel remote 1.1.1.2 [FW2-ipsec-policy-manual-P10-10]sa spi inbound esp 123456 [FW2-ipsec-policy-manual-P10-10]sa string-key inbound esp P@ssw0rd [FW2-ipsec-policy-manual-P10-10]sa spi outbound esp 654321 [FW2-ipsec-policy-manual-P10-10]sa string-key outbound esp P@ssw0rd [FW2-ipsec-policy-manual-P10-10]quit [FW2]inter g1/0/0 [FW2-GigabitEthernet1/0/0]ipsec policy P10 [FW2-GigabitEthernet1/0/0]quit 配置nat豁免 [FW2]nat-policy [FW2-policy-nat]rule name nat1 [FW2-policy-nat-rule-nat1]source-zone trust [FW2-policy-nat-rule-nat1]source-zone untrust [FW2-policy-nat-rule-nat1]source-add 10.10.5.0 0.0.0.255 [FW2-policy-nat-rule-nat1]destination-add 10.10.1.0 0.0.0.255 [FW2-policy-nat-rule-nat1]action no-nat [FW2-policy-nat-rule-nat1]quit [FW2-policy-nat]rule move nat1 top

LSW2基本配置

[LSW2]vlan batch 100 200 300 [LSW2]inter vlan 100 [LSW2-Vlanif100]ip add 10.10.5.254 24 [LSW2-Vlanif100]quit [LSW2-Vlanif200]ip add 10.10.6.254 24 [LSW2-Vlanif200]quit [LSW2]inter vlan 300 [LSW2-Vlanif300]ip add 10.10.7.254 24 [LSW2-Vlanif300]quit [LSW2]inter loopb0 [LSW2-LoopBack0]ip add 3.3.3.3 32 [LSW2-LoopBack0]quit 配置OSPF内部路由协议 [LSW2]ospf 1 router-id 3.3.3.3 [LSW2-ospf-1]area 0 [LSW2-ospf-1-area-0.0.0.0]net 3.3.3.3 0.0.0.0 [LSW2-ospf-1-area-0.0.0.0]net 10.10.5.0 0.0.0.255 [LSW2-ospf-1-area-0.0.0.0]net 10.10.6.0 0.0.0.255 [LSW2-ospf-1-area-0.0.0.0]net 10.10.7.0 0.0.0.255 [LSW2-ospf-1-area-0.0.0.0]quit [LSW2]inter g0/0/24 [LSW2-GigabitEthernet0/0/24]port link-ty ac [LSW2-GigabitEthernet0/0/24]port de vlan 100 [LSW2-GigabitEthernet0/0/24]quit [LSW2]inter g0/0/10 [LSW2-GigabitEthernet0/0/10]potr link-ty ac [LSW2-GigabitEthernet0/0/10]port de vlan 100 [LSW2-GigabitEthernet0/0/10]quit [LSW2]inter g0/0/11 [LSW2-GigabitEthernet0/0/11]port link-ty ac [LSW2-GigabitEthernet0/0/11]port de vlan 100 [LSW2-GigabitEthernet0/0/11]quit [LSW2-GigabitEthernet0/0/1]port link-ty ac [LSW2-GigabitEthernet0/0/1]port de vlan 200 [LSW2-GigabitEthernet0/0/1]quit [LSW2]inter g0/0/2 [LSW2-GigabitEthernet0/0/2]port link-ty ac [LSW2-GigabitEthernet0/0/2]port de vlan 300 [LSW2-GigabitEthernet0/0/2]quit [LSW2]ip route-static 0.0.0.0 0.0.0.0 Vlanif 100 10.10.5.1 [LSW2]dhcp enable [LSW2]ip pool 200 [LSW2-ip-pool-200]ga 10.10.6.254 [LSW2-ip-pool-200]netw 10.10.6.0 mask 255.255.255.0 [LSW2-ip-pool-200]dns 1.1.1.1 2.2.2.2 [LSW2-ip-pool-200]excluded-ip-address 10.10.6.50 10.10.6.253 [LSW2-ip-pool-200]quit [LSW2]inter vlan 200 [LSW2-Vlanif200]dhcp sel gl [LSW2-Vlanif200]quit [LSW2]ip pool 300 [LSW2-ip-pool-300]ga 10.10.7.254 [LSW2-ip-pool-300]netw 10.10.7.0 mask 255.255.255.0 [LSW2-ip-pool-300]dns 1.1.1.1 2.2.2.2 [LSW2-ip-pool-300]excluded-ip-address 10.10.7.50 10.10.7.253 [LSW2-ip-pool-300]quit [LSW2]inter vlan 300 [LSW2-Vlanif300]dhcp sel gl

上一篇：mesh组网的两台路由器(家大墙少全屋WiFi覆盖试试mesh组网) 下一篇：路由器能替代全屋组网吗(你的路由器支持Mesh组网吗？大户型路由器就选它)