1、h3c s9500交換機ipsec功能的配置一、組網需求：在網絡中，當發送方和接收方都對數據的安全性和完整性有較高的要求時使用。通過將需要發送的流量轉到ipsec板進行相應的處理來實現。二、組網圖：ipsec組網組網圖以上組網圖中vlan 76和vlan 77之間的私網報文通過s9505上所連接的ipsec單板的加密處理實現了安全通信三、配置步驟：軟件版本：s9500交換機r1327版本及以后的升級版本硬件版本：需要s9500 lsb1ipsec8db0單板按照上面的組網圖，要實現pc_a和pc_b之間進行互相訪問時采用ipsec協議族對其數據進行加密，需要對網絡進行如下配置：1s9505_1

2、設備上的配置過程# 配置vlan，并將連接pc的接口以及s9505之間互連的接口加入到各自的vlan當中s9505_1 vlan 50s9505_1-vlan50 port ethernet 2/1/1s9505_1-vlan50 quits9505_1 vlan 77s9505_1-vlan77 port ethernet 2/1/2s9505_1-vlan77 quit# 配置secblade的module，并將vlan 50和vlan 77配置為security-vlan，同時將配置好的module和插入的ipsec單板關聯起來s9505_1 secblade module tests9

3、505_1-secblade-test security-vlan 50s9505_1-secblade-test security-vlan 77s9505_1-secblade-test map to slot 32s9505_1設備上的secblade的配置過程# 配置接口ip地址secblade_vpn interface gigabitethernet 0/0.50secblade_vpn-gigabitethernet0/0 ip address 172.16.50.2 24secblade_vpn-gigabitethernet0/0 vlan-type dot1q vid 50

4、secblade_vpn-gigabitethernet0/0 quitsecblade_vpn interface gigabitethernet 0/0.77secblade_vpn -gigabitethernet0/0 ip address 10.13.77.2 24secblade_vpn -gigabitethernet0/0 vlan-type dot1q vid 77secblade_vpn -gigabitethernet0/0 quit# 配置acl規則secblade_vpn acl number 3000secblade_vpn -acl-adv-3000 rule p

5、ermit ip source 10.13.77.0 0.0.0.255 destination 10.13.76.0 0.0.0.255 secblade_vpn -acl-adv-3000 quit# 配置ipsec ikesecblade_vpn ike peer peersecblade_vpn-ike-peer-peer pre-shared-key vpnsecblade_vpn-ike-peer-peer remote-address 172.16.50.1secblade_vpn quit# 配置ipsec提議secblade_vpn router ipsec proposal

6、 h3csecblade_vpn router-ipsec-proposal-tran encapsulation-mode tunnelsecblade_vpn router-ipsec-proposal-tran transform ah-espsecblade_vpn router-ipsec-proposal-tran ah authentication-algorithm sha1secblade_vpn router-ipsec-proposal-tran esp encryption-algorithm 3dessecblade_vpn router-ipsec-proposal

7、-tran esp authentication-algorithm sha1# 配置ipsec策略secblade_vpn ipsec policy h3cpolicy 10 isakmpsecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 ike-peer peersecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 proposal h3csecblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 security acl 3000secblade_vpn-ipsec-policy-isakmp-h3cpolicy-10 quit# 在外網子接口上應用安全策略secblade_vpn interface gigabitethernet 0/0.50secblade_vpn-gigabitethernet0/0.50 ipsec policy h3cpolicysecblade_vpn-gigabitethernet0/0.50 quit# 配置靜態路由secblade_vpn ip route-static 10.13.76.0 255.255.255.0 172.16.50.13s9505_2設備上的配置