大家好，最近正好有机会，再实战H3CMSR 36-40的IPSEC配置，经过参考一些网上的配置方案后，IPSEC可以连接，但是内网之间无法通信。百思不得其解，希望有大神可以帮忙看一下配置，为小弟解答，感激不尽！

以下为配置方案

MSR36-40 配置如下：

version 7.1.059, Release 0304P15

#

sysname H3C

#

telnet server enable

#

dhcp enable

#

password-recovery enable

#

vlan 1

#

dhcp server ip-pool 1

gateway-list 192.168.0.1

network 192.168.0.0 mask 255.255.255.0

dns-list 202.99.190.168

#

controller Cellular0/0

#

controller Cellular0/1

#

interface Aux0

#

interface NULL0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 122.166.230.130 255.255.255.252

nat outbound

nat outbound 3100

ipsec apply policy 456

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet0/2

port link-mode route

#

scheduler logfile size 16

#

line class aux

user-role network-admin

#

line class tty

user-role network-operator

#

line class vty

user-role network-operator

#

line aux 0

user-role network-admin

#

line vty 0 4

user-role level-15

user-role network-operator

set authentication password hash $h$6$KBo7uNangf5N0+Bn$79EDt6ArrraWEB1Mx3JWn4aj8IYlGteQDmlbJP4TzhsATnKUr4xGtPkCulnbEahqx3pr3xoBPMrMRe2U9LCpmQ==

#

line vty 5 63

user-role network-operator

#

ip route-static 0.0.0.0 0 122.166.230.129

#

acl advanced 3001

rule 0 permit ip source 192.168.0.0 0.0.0.255 destination 10.10.1.0 0.0.0.255

#

acl advanced 3100

rule 0 deny ip source 192.168.0.0 0.0.0.255 destination 10.10.1.0 0.0.0.255

#

domain system

#

domain default enable system

#

role name level-0

description Predefined level-0 role

#

role name level-1

description Predefined level-1 role

#

role name level-2

description Predefined level-2 role

#

role name level-3

description Predefined level-3 role

#

role name level-4

description Predefined level-4 role

#

role name level-5

description Predefined level-5 role

#

role name level-6

description Predefined level-6 role

#

role name level-7

description Predefined level-7 role

#

role name level-8

description Predefined level-8 role

#

role name level-9

description Predefined level-9 role

#

role name level-10

description Predefined level-10 role

#

role name level-11

description Predefined level-11 role

#

role name level-12

description Predefined level-12 role

#

role name level-13

description Predefined level-13 role

#

role name level-14

description Predefined level-14 role

#

user-group system

#

ipsec transform-set 1

esp encryption-algorithm des-cbc

esp authentication-algorithm md5

#

ipsec policy-template 1 1

transform-set 1

security acl 3001

ike-profile 1

#

ipsec policy 456 1 isakmp template 1

#

ike profile 1

keychain 1

exchange-mode aggressive

local-identity fqdn center

match remote identity fqdn 1

#

ike keychain 1

pre-shared-key hostname 1 key cipher $c$3$4D3endFD6ncmSdxN0mL+PTJQZEA64Xw=

#

return

另外一端设备使用的是H3C ER2100，由于只有WEB没有命令行配置，没办法贴配置，但是显示隧道已经建立，就是双方无法互相PING通。

分享至：