实验名称：华为***的基本配置

实验拓扑：

配置思路以及步骤：

第一步还是先配置ip

pc1

server1 IP

路由器

R1interface GigabitEthernet0/0/0ip address 192.168.1.254 255.255.255.0

interface GigabitEthernet0/0/1

ip address 100.0.0.1 255.255.255.0 路由ip route-static 0.0.0.0 0.0.0.0 100.0.0.2

R2

interface GigabitEthernet0/0/0ip address 100.0.0.2 255.255.255.0

interface GigabitEthernet0/0/1

ip address 200.0.0.2 255.255.255.0

R3

interface GigabitEthernet0/0/0 ip address 200.0.0.1 255.255.255.0 ipsec policy yf

interface GigabitEthernet0/0/1

ip address 192.168.2.254 255.255.255.0路由ip route-static 0.0.0.0 0.0.0.0 200.0.0.2

第二步配置***

R1

ike proposal 1encryption-algorithm 3des-cbcauthentication-algorithm md5authentication-method pre-sharedh group2

ike peer 200.0.0.1 v1

pre-shared-key simple teduike-proposal 1remote-address 200.0.0.1

acl number 3000 配置acl

rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

ipsec proposal 1

transform ah-esp

ipsec policy yf 1 isakmp

security acl 3000ike-peer 200.0.0.1proposal 1

interface GigabitEthernet0/0/1

ipsec policy yf

R3

ike proposal 1encryption-algorithm 3des-cbcauthentication-algorithm md5authentication-method pre-sharedh group2

ike peer 100.0.0.1 v1

pre-shared-key simple teduike-proposal 1remote-address 100.0.0.1

acl number 3000

rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

ipsec proposal 1

transform ah-esp

ipsec policy yf 1 isakmp

security acl 3000ike-peer 100.0.0.1proposal 1

interface GigabitEthernet0/0/0

ipsec policy yf

查看与验证：

RIdisplay ike sadisplay ipsec sa

R3

display ike sadisplay ipsec sa

验证***

pc1pingserver1