R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

143
Configuring the router
# Specify a name for the local security gateway.
<Router> system-view
[Router] ike local-name routerb
# Configure an ACL.
[Router] acl number 3101
[Router-acl-adv-3101] rule 0 permit ip source 192.168.0.0 0.0.0.255 destination 172.16.0.0
0.0.0.255
[Router-acl-adv-3101] quit
# Configure an IKE proposal.
[Router] ike proposal 1
[Router-ike-proposal-1] authentication-algorithm sha
[Router-ike-proposal-1] authentication-method pre-share
[Router-ike-proposal-1] encryption-algorithm 3des-cbc
[Router-ike-proposal-1] dh group2
# Configure an IKE peer.
[Router] ike peer peer
[Router-ike-peer-peer] exchange-mode aggressive
[Router-ike-peer-peer] pre-shared-key abc
[Router-ike-peer-peer] id-type name
[Router-ike-peer-peer] remote-name Firewall
[Router-ike-peer-peer] remote-address 100.1.1.1
[Router-ike-peer-peer] nat traversal
[Router-ike-peer-peer] quit
# Create an IPsec proposal named prop.
[Router] ipsec proposal prop
[Router-ipsec-proposal-prop] encapsulation-mode tunnel
[Router-ipsec-proposal-prop] transform esp
[Router-ipsec-proposal-prop] esp encryption-algorithm 3des
[Router-ipsec-proposal-prop] esp authentication-algorithm sha1
[Router-ipsec-proposal-prop] quit
# Create an IPsec policy that uses IKE.
[Router] ipsec policy policy 10 isakmp
# Configure the IPsec policy to reference the IKE peer.
[Router-ipsec-policy-isakmp-policy-10] ike-peer peer
# Configure the IPsec policy to reference ACL 3101.
[Router-ipsec-policy-isakmp-policy-10] security acl 3101
# Configure the IPsec policy to reference IPsec proposal prop.
[Router-ipsec-policy-isakmp-policy-10] proposal prop
[Router-ipsec-policy-isakmp-policy-10] quit
# Create a dialer rule.
[Router] dialer-rule 1 ip permit
# Configure dialer interface Dialer 0. Use the username and password assigned by the ISP for dial and
PPP authentication.