R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

206
IPsec RRI configuration example
Network requirements
As shown in Figure 130, configure an IPsec tunnel between Firewall A and Firewall B to protect the traffic
between the headquarters and the branch. Configure the tunnel to use the security protocol ESP, the
encryption algorithm DES, and the authentication algorithm SHA1-HMAC-96. Use IKE for automatic SA
negotiation.
Configure IPsec RRI on Firewall A to automatically create a static route to the branch based on the
established IPsec SAs. Specify the next hop of the route as 1.1.1.2.
Figure 130 Network diagram
Configuring Firewall A
Assign IPv4 addresses to the interfaces. Make sure that Firewall A and Firewall B have IP connectivity
between them.
# Configure ACL 3101 to identify traffic from subnet 10.4.4.0/24 to subnet 10.5.5.0/24.
<FirewallA> system-view
[FirewallA] acl number 3101
[FirewallA-acl-adv-3101] rule permit ip source 10.4.4.0 0.0.0.255 destination 10.5.5 0
0.0.0.255
[FirewallA-acl-adv-3101] quit
# Create IPsec proposal tran1.
[FirewallA] ipsec proposal tran1
# Set the packet encapsulation mode to tunnel.
[FirewallA-ipsec-proposal-tran1] encapsulation-mode tunnel
# Use ESP as the security protocol.
[FirewallA-ipsec-proposal-tran1] transform esp
# Use DES as the encryption algorithm and SHA1-HMAC-96 as the authentication algorithm.
[FirewallA-ipsec-proposal-tran1] esp encryption-algorithm des
[FirewallA-ipsec-proposal-tran1] esp authentication-algorithm sha1
[FirewallA-ipsec-proposal-tran1] quit
# Create IKE peer peer.
[FirewallA] ike peer peer
# Set the pre-shared key.
Headquarter
Branch
Internet
Firewall A Firewall B
GE0/1
1.1.1.1/16
GE0/1
2.2.2.2/16
GE0/2
10.4.4.1/24
GE0/2
10.5.5.1/24
Host A
10.4.4.4/24
Host B
10.5.5.5/24