实验名称：华为***的基本配置

实验拓扑：

配置思路以及步骤：

第一步还是先配置ip
pc1

server1 IP

路由器
R1
interface GigabitEthernet0/0/0
ip address 192.168.1.254 255.255.255.0

interface GigabitEthernet0/0/1
ip address 100.0.0.1 255.255.255.0
路由
ip route-static 0.0.0.0 0.0.0.0 100.0.0.2

R2
interface GigabitEthernet0/0/0
ip address 100.0.0.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 200.0.0.2 255.255.255.0

R3
interface GigabitEthernet0/0/0
ip address 200.0.0.1 255.255.255.0
ipsec policy yf

interface GigabitEthernet0/0/1
ip address 192.168.2.254 255.255.255.0
路由
ip route-static 0.0.0.0 0.0.0.0 200.0.0.2

第二步配置***

R1
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
authentication-method pre-share
dh group2

ike peer 200.0.0.1 v1
pre-shared-key simple tedu
ike-proposal 1
remote-address 200.0.0.1

acl number 3000 配置acl
rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

ipsec proposal 1
transform ah-esp

ipsec policy yf 1 isakmp
security acl 3000
ike-peer 200.0.0.1
proposal 1

interface GigabitEthernet0/0/1
ipsec policy yf

R3
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
authentication-method pre-share
dh group2

ike peer 100.0.0.1 v1
pre-shared-key simple tedu
ike-proposal 1
remote-address 100.0.0.1

acl number 3000
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

ipsec proposal 1
transform ah-esp

ipsec policy yf 1 isakmp
security acl 3000
ike-peer 100.0.0.1
proposal 1

interface GigabitEthernet0/0/0
ipsec policy yf

查看与验证：
RI
display ike sa

display ipsec sa

R3
display ike sa

display ipsec sa

验证***
pc1pingserver1