H3C Technologies H3C SecPath F1000-E User Manual
Page 480
468
# Configure the IPsec proposal.
[Hub1] ipsec proposal vam
[Hub1-ipsec -proposal-vam] encapsulation-mode tunnel
[Hub1-ipsec -proposal-vam] transform esp
[Hub1-ipsec -proposal-vam] esp encryption-algorithm des
[Hub1-ipsec -proposal-vam] esp authentication-algorithm sha1
[Hub1-ipsec -proposal-vam] quit
# Configure the IKE peer.
[Hub1] ike peer vam
[Hub1-ike-peer-vam] pre-shared-key abcde
[Hub1-ike-peer-vam] quit
# Configure the IPsec profile.
[Hub1] ipsec profile vamp
[Hub1-ipsec-profile-vamp] proposal vam
[Hub1-ipsec-profile-vamp] ike-peer vam
[Hub1-ipsec-profile-vamp] sa duration time-based 600
[Hub1-ipsec-profile-vamp] pfs dh-group2
[Hub1-ipsec-profile-vamp] quit
4.
Configure DVPN tunnels:
# Configure tunnel interface Tunnel 1 for VPN 1.
To use UDP for tunnel encapsulation, perform the following configurations:
[Hub1] interface tunnel 1
[Hub1-Tunnel1] tunnel-protocol dvpn udp
[Hub1-Tunnel1] vam client dvpn1hub1
[Hub1-Tunnel1] ip address 10.0.1.1 255.255.255.0
[Hub1-Tunnel1] source GigabitEthernet 0/2
[Hub1-Tunnel1] ospf network-type p2mp
[Hub1-Tunnel1] ipsec profile vamp
[Hub1-Tunnel1] quit
To use GRE for tunnel encapsulation, perform the following configurations:
[Hub1] interface tunnel 1
[Hub1-Tunnel1] tunnel-protocol dvpn gre
[Hub1-Tunnel1] vam client dvpn1hub1
[Hub1-Tunnel1] ip address 10.0.1.1 255.255.255.0
[Hub1-Tunnel1] source GigabitEthernet 0/2
[Hub1-Tunnel1] ospf network-type p2mp
[Hub1-Tunnel1] ipsec profile vamp
[Hub1-Tunnel1] quit
5.
Configure OSPF:
# Configure OSPF for the public network.
[Hub1] ospf 100
[Hub1-ospf-100] area 0
[Hub1-ospf-100-area-0.0.0.0] network 192.168.1.1 0.0.0.255
[Hub1-ospf-100-area-0.0.0.0] quit
# Configure OSPF for the private network.
[Hub1] ospf 200