我们假设企业站点H使用的VPN网关设备为H3C路由器，出口IP地址为10.23.1.3，内网业务网段为172.18.18.0/24；企业站点J使用的VPN网关设备为Juniper防火墙，出口IP地址为10.12.1.1，内网业务网段为192.168.18.0/24。经过这么多次配置（IPsec VPN合集），我们已经知道，不同厂商的设备对接，区别主要就是在算法上面。所以，我们本次配置约定双方使用的算法如下：一阶段和二阶段的认证算法均使用SHA256、加密算法均使用AES-128、DH组均配置为Group5。1、配置H3C路由器
#ike keychain h3c2jun pre-shared-key address 10.12.1.1 255.255.255.255 key simple h3c_juniper
配置IKE安全提议，修改与天翼云相匹配的认证算法、加密算法和DH算法。ike proposal 10000 encryption-algorithm aes-cbc-128 dh group5 authentication-algorithm sha256
配置IKE配置文件，引用预共享密钥和安全提议配置，并指定本端和对端的身份标识。# ike profile h3c2jun keychain h3c2jun local-identity address 10.23.1.3 match remote identity address 10.12.1.1 proposal 10000
配置ACL感兴趣流，与天翼云配置的本端子网和对端网段相对应。#acl advanced 3333rule 0 permit ip source 172.18.18.0 0.0.0.255 destination 192.168.18.0 0.0.0.255 rule 5 permit ip source 192.168.18.0 0.0.0.255 destination 172.18.18.0 0.0.0.255
配置IPsec安全提议，修改与天翼云相匹配的认证算法、加密算法和PFS算法。ipsec transform-set h3c2jun esp encryption-algorithm aes-cbc-128 esp authentication-algorithm sha256 pfs dh-group5
配置IPsec策略，引用IKE配置文件、IPsec安全提议、感兴趣流ACL，并指定本端和对端的IP地址。#ipsec policy h3c2jun 10 isakmp transform-set h3c2jun security acl 3333 local-address 10.23.1.3 remote-address 10.12.1.1 ike-profile h3c2jun
interface GigabitEthernet1/0 ip address 10.23.1.3 255.255.255.0 ipsec apply policy h3c2jun
2、配置Juniper防火墙
首先，创建一个安全隧道接口（secure tunnel interface，st）st0。cliconfigureset interfaces st0 unit 0 family inet
将涉及业务转发的逻辑接口ge-0/0/0.0、ge-0/0/1.0和st0.0都加入到trust安全域，配置trust安全域的策略为允许所有流量和服务。 set security zones security-zone trust interfaces ge-0/0/0.0set security zones security-zone trust interfaces ge-0/0/1.0set security zones security-zone trust interfaces st0.0set security zones security-zone trust host-inbound-traffic system-services allset security zones security-zone trust host-inbound-traffic protocols all
创建2个地址组h3c和juniper，分别对应H3C路由器内网和Juniper防火墙内网；在策略配置中，配置策略匹配所有源地址、所有目的地址、所有应用，执行动作为允许。set security address-book global address h3c 172.18.18.0/24set security address-book global address juniper 192.168.18.0/24set security policies from-zone trust to-zone trust policy default-permit match source-address anyset security policies from-zone trust to-zone trust policy default-permit match destination-address anyset security policies from-zone trust to-zone trust policy default-permit match application anyset security policies from-zone trust to-zone trust policy default-permit then permit
配置IKE提议，认证方式为预共享密钥；配置DH组使用group5、认证算法使用sha-256、加密算法使用aes-128。配置IKE策略，默认使用主模式，引用IKE提议h3c2jun，并配置使用预共享密钥h3c_juniper。配置IKE网关信息，包括对端网关IP地址、remoteID、本端网关IP地址、localID、本端出接口，以及IKE版本等信息，并指定绑定的IKE策略。set security ike proposal h3c2jun authentication-method pre-shared-keys set security ike proposal h3c2jun dh-group group5set security ike proposal h3c2jun authentication-algorithm sha-256set security ike proposal h3c2jun encryption-algorithm aes-128-gcmset security ike policy h3c2jun proposals h3c2junset security ike policy h3c2jun pre-shared-key ascii-text h3c_juniperset security ike gateway h3c2jun address 10.23.1.3set security ike gateway h3c2jun remote-identity inet 10.23.1.3set security ike gateway h3c2jun external-interface ge-0/0/0set security ike gateway h3c2jun local-address 10.12.1.1set security ike gateway h3c2jun local-identity inet 10.12.1.1set security ike gateway h3c2jun version v1-onlyset security ike gateway h3c2jun ike-policy h3c2jun
配置IPsec提议，指定加密协议为ESP，并指定认证算法使用sha-256、加密算法使用aes-128；配置IPsec策略，引用IPsec提议h3c2jun，配置PFS使用group5。配置VPN隧道，指定IKE网关信息和IPsec策略，绑定隧道接口st0.0。创建流量策略，对应本端设备去H3C路由器的流量。最后配置隧道立即协商，并提交配置变更。set security ipsec proposal h3c2jun protocol espset security ipsec proposal h3c2jun authentication-algorithm hmac-sha-256-128set security ipsec proposal h3c2jun encryption-algorithm aes-128-gcmset security ipsec policy h3c2jun proposals h3c2junset security ipsec policy h3c2jun perfect-forward-secrecy keys group5 set security ipsec vpn h3c2jun ike gateway h3c2junset security ipsec vpn h3c2jun ike ipsec-policy h3c2junset security ipsec vpn h3c2jun bind-interface st0.0set security ipsec vpn h3c2jun traffic-selector ts-1 local-ip juniperset security ipsec vpn h3c2jun traffic-selector ts-1 remote-ip h3cset security ipsec vpn h3c2jun establish-tunnels immediatelycommit
3、业务验证
配置完成之后，在Juniper防火墙测试访问H3C路由器站点内网的连通性。
