***中ipsec—isakmp的實現
說明：動態ipsec是通過isakmp的方法實現，是用戶兩端自動學習協商建立sa，無需手工建立。
注：由於實驗條件有限，Internet有路由器代替模擬。
一、Fw-1的配置
[fw-1]inter eth0/0
[fw-1-Ethernet0/0]ip add 192.168.101.55 255.255.255.0
[fw-1-Ethernet0/0]inter eth0/4
[fw-1-Ethernet0/4]ip add 1.1.1.1 255.255.255.0
[fw-1-Ethernet0/4]quit
[fw-1]ip route 0.0.0.0 0.0.0.0 1.1.1.2 //配置一條默認路由
配置訪問控制列表，起過濾作用
[fw-1]acl number 3000
[fw-1-acl-adv-3000]rule 10 permit ip source 192.168.101.0 0.0.0.255 dest 192.168.102.0 0.0.0.255
[fw-1-acl-adv-3000]rule 20 deny ip source any dest any
配置安全提議（系統默認，可選）
[fw-1]ipsec proposal tran1
[fw-1-ipsec-proposal-tran1]encapsulation-mode tunnel
[fw-1-ipsec-proposal-tran1]transform esp
[fw-1-ipsec-proposal-tran1]esp encryption-algorithm des
[fw-1-ipsec-proposal-tran1]esp authentication-algorithm md5
配置鄰居參數
[fw-1]ike peer fw-2
[fw-1-ike-peer-fw-2]pre-shared-key simple 123456
[fw-1-ike-peer-fw-2]remote-address 1.1.2.2
配置安全策略
[fw-1]ipsec policy policy1 10 isakmp
[fw-1-ipsec-policy-isakmp-policy1-10]security acl 3000
[fw-1-ipsec-policy-isakmp-policy1-10]proposal tran1
[fw-1-ipsec-policy-isakmp-policy1-10]ike-peer fw-2
應用安全策略
[fw-1]inter eth0/4
[fw-1-Ethernet0/4]ipsec policy policy1
二、路由器配置
[Router]inter e0
[Router-Ethernet0]ip add 1.1.1.2 255.255.255.0
[Router-Ethernet0]inter e1
[Router-Ethernet1]ip add 1.1.2.1 255.255.255.0
三、fw-2的配置
[fw-2]inter eth0/0
[fw-2-Ethernet0/0]ip add 192.168.102.90 255.255.255.0
[fw-2-Ethernet0/0]loop //此口設爲loopback口，方便測試。
[fw-2-Ethernet0/0]inter eth0/4
[fw-2-Ethernet0/4]ip add 1.1.2.2 255.255.255.0
[fw-2-Ethernet0/4]quit
[fw-2]ip route 0.0.0.0 0.0.0.0 1.1.2.1 //配置一條默認路由
把端口加入區域（如端口在默認區域，不用在添加）
[fw-2]firewall zone untrust
[fw-2-zone-untrust]add interface eth0/4
[fw-2-zone-untrust]q
[fw-2]firewall zone trust
[fw-2-zone-trust]add interface eth0/0
配置訪問控制列表，起過濾作用
[fw-2]acl number 3000
[fw-2-acl-adv-3000]rule 10 permit ip source 192.168.102.0 0.0.0.255 dest 192.168.101.0 0.0.0.255
[fw-2-acl-adv-3000]rule 20 deny ip source any dest any
配置安全提議（系統默認，可選）
[fw-2]ipsec proposal tran1
[fw-2-ipsec-proposal-tran1]encapsulation-mode tunnel
[fw-2-ipsec-proposal-tran1]transform esp
[fw-2-ipsec-proposal-tran1]esp encryption-algorithm des
[fw-2-ipsec-proposal-tran1]esp authentication-algorithm md5
配置鄰居參數
[fw-2]ike peer fw-1
[fw-2-ike-peer-fw-1]pre-shared-key simple 123456
[fw-2-ike-peer-fw-1]remote-address 1.1.1.1
配置安全策略
[fw-2]ipsec policy policy1 10 isakmp
[fw-2-ipsec-policy-isakmp-policy1-10]security acl 3000
[fw-2-ipsec-policy-isakmp-policy1-10]proposal tran1
[fw-2-ipsec-policy-isakmp-policy1-10]ike-peer fw-1
應用安全策略
[fw-2]inter eth0/4
[fw-2-Ethernet0/4]ipsec policy policy
測試結果
