H3C IPSEC VPN设置方法

H3C MSR20系列路由器IPSEC VPN设置方法

H3C MSR20系列路由器 IPSEC VPN 设置一例（对端除IKE名称 、ACL数据流向不同外 其他一致），本端ADSL接入方式，对端固定IP接入

version 5.20, Release 2207P02, Basic #

sysname testvpn #

ike local-name testvp

n ike sa keepalive-timer timeout 28800 #

domain default enable system #

telnet server enable #

dar p2p signature-file cfa0:/p2p_default.mtd #

port-security enable #

acl number 3001 name nat

rule 0 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 （对端VPN设置 两个IP地址段对

调）

rule 20 permit ip source 192.168.2.94 0 允许内网nat 的地址（可上网的ip）

rule 30 permit ip source 192.168.2.80 0 acl number 3026

rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255 定义VPN隧道数据流向（对端VPN设置 两个IP地址段对调） #

vlan 1 #

domain system

access-limit disable state active idle-cut disable self-service-url disable #

ike peer testvpn 设置IKE 对等体 exchange-mode aggressive 野蛮模式

pre-shared-key cipher nWUE29323vCRHSJ19231231hkSNpRHtg== 共享密钥

id-type name ID类型为名称

remote-name testpeer 远程IKE名称

remote-address 202.106.0.20 （因本端ADSL接入动态IP地址，对端指定本段IKE名称即可不用指定远程IP地址） local-name testvpn 本地IKE名称 nat traversal nat穿越 #

ipsec proposal testvpn #

ipsec policy testvpn 10 isakmp security acl 3026 匹配的ACL pfs dh-group1

ike-peer testvpn IKE对等体名称

proposal testvpn IPSEC 安全提议名称 #

user-group system

group-attribute allow-guest #

local-user admin

password cipher .]@QWEUSEWEW=B,53Q123=^Q`M12DAAF4<1!! authorization-attribute level 3 service-type telnet service-type web

#

interface Aux0 async mode flow link-protocol ppp #

interface Cellular0/0 async mode protocol link-protocol ppp #

interface Dialer1 设置 PPPOE拨号接口 nat outbound 3001 link-protocol ppp

ppp pap local-user 9009239392939 password cipher )^6G123G6S032316;R3Q=^Q`MAF4<1!! mtu 1450

ip address ppp-negotiate tcp mss 1024 dialer user admin dialer-group 1 dialer bundle 1 ipsec policy testvpn #

interface Ethernet0/0 port link-mode route description inside

ip address 192.168.2.1 255.255.255.0 #

interface Ethernet0/1 port link-mode route description outside

pppoe-client dial-bundle-number 1 tcp mss 1024

ip address dhcp-alloc #

interface NULL0 #

ip route-static 0.0.0.0 0.0.0.0 Dialer1 #

ssh server enable #

load xml-configuration #

user-interface con 0 user-interface tty 13

user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

本文来源：https://www.bwwdw.com/article/yobr.html