H3C Technologies H3C SecPath F1000-E User Manual
Page 158
30
# Set the tunnel destination address to 1.1.1.1, the source address of the remote peer.
[DeviceA–Tunnel1] destination 1.1.1.1
# Apply IPsec profile atob to tunnel interface Tunnel 1.
[DeviceA–Tunnel1] ipsec profile atob
[DeviceA–Tunnel1] quit
# Configure a static route to Device B.
[DeviceA] ip route-static 192.168.1.0 255.255.255.0 tunnel 1
2.
Configure Device B
# Assign an IP address to interface Gigabitethernet 0/1.
[DeviceB] interface gigabitethernet 0/1
[DeviceB-GigabitEthernet0/1] ip address 1.1.1.1 24
[DeviceB-GigabitEthernet0/1] quit
# Name the local gateway deviceb.
[DeviceB] ike local-name deviceb
# Configure an IKE peer named btoa. As the remote peer obtains the IP address automatically, set the
IKE negotiation mode to aggressive.
[DeviceB] ike peer btoa
[DeviceB-ike-peer-btoa] exchange-mode aggressive
[DeviceB-ike-peer-btoa] pre-shared-key simple aabb
[DeviceB-ike-peer-btoa] id-type name
[DeviceB-ike-peer-btoa] remote-name devicea
[DeviceB-ike-peer-btoa] quit
# Create an IPsec proposal named method1, leaving it to use the default, that is, the security protocol of
ESP, the encryption algorithm of DES, and the authentication algorithm of MD5.
[DeviceB] ipsec proposal method1
[DeviceB-ipsec-proposal-method1] quit
# Create an IPsec profile named btoa.
[DeviceB] ipsec profile btoa
# Configure the IPsec profile to reference the IKE peer.
[DeviceB-ipsec-profile-btoa] ike-peer btoa
# Configure the IPsec profile to reference the IPsec proposal method1.
[DeviceB-ipsec-profile-btoa] proposal method1
[DeviceB-ipsec-profile-btoa] quit
# Create tunnel interface Tunnel 1. This interface will be used to protect the data flows between Device
B and Device A. As the public IP address of the remote peer is not known, you do not need to configure
the destination address on the tunnel interface.
[DeviceB] interface tunnel 1
# Assign IPv4 address 10.1.1.2/24 to tunnel interface Tunnel 1.
[DeviceB–Tunnel1] ip address 10.1.1.2 24
# Set the tunnel mode of tunnel interface Tunnel 1 to IPsec over IPv4.
[DeviceB–Tunnel1] tunnel-protocol ipsec ipv4
# Set the source interface of the tunnel to Gigabitethernet 0/1 on Tunnel 1.
[DeviceB–Tunnel1] source gigabitethernet 0/1