HQ Router Configuration:
[admin@HQ] > ip dhcp-client add interface=ether1 use-peer-dns=yes add-default-route=yes disabled=no
[admin@HQ] > ip address add address= 192.168.2.1/24 interface=ether2
[admin@HQ] > ip firewall nat add chain=srcnat action=accept src-address=192.168.2.0/24 dst-address=192.168.1.0/24
[admin@HQ] > ip firewall nat Add chain=srcnat action=masquerade out-interface=ether1
[admin@HQ] > ip ipsec peer add address=180.140.100.2/32:500 auth-method=pre-shared-key secret="password" generate-policy=no exchange-mode=main
send-initial-contact=yes nat-traversal=yes proposal-check=obey hash-algorithm=sha1 enc-algorithm=3des
dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=disable-dpd dpd-maximum-failures=1
[admin@HQ] > ip ipsec proposal add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024
[admin@HQ] > ip ipsec policy add src-address=0.0.0.0/0:any dst-address=0.0.0.0/0:any protocol=all action=encrypt level=require ipsec-protocols=esp
tunnel=yes sa-src-address=0.0.0.0 sa-dst-address=180.140.100.2 proposal=default priority=0
Branch router configuration:
[admin@Remote] > ip address add address= 80.140.100.2/30 interface=ether1
[admin@Remote] > ip address add address= 192.168.1.1/24 interface=ether2
[admin@Remote] > ip firewall nat add chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24
[admin@Remote] > ip firewall nat Add chain=srcnat action=masquerade out-interface=ether1
[admin@Remote] > i p route add dst-address=0.0.0.0 gateway=180.140.100.1
[admin@Remote] > ip ipsec proposal add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024
[admin@Remote] > ip ipsec peer add address=0.0.0.0/0 port=500 auth-method=pre-shared-key secret="password"
generate-policy=yes exchange-mode=main send-initial-contact=yes
nat-traversal=no my-id-user-fqdn="" proposal-check=obey
hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0 dpd-interval=2m dpd-maximum-failures=5
No comments:
Post a Comment