Paso 5: Configuración del dispositivo de gateway del cliente

<AR651>system-view

[AR651]interface GigabitEthernet 0/0/8

[AR651-GigabitEthernet0/0/8]ip address 22.xx.xx.22 255.255.255.0

[AR651-GigabitEthernet0/0/8]quit

[AR651]ip route-static 0.0.0.0 0.0.0.0 22.xx.xx.1

En este comando, 22.xx.xx.1 es la dirección de gateway de la dirección IP pública del router AR. Reemplácelo con la dirección de gateway real.

[AR651]IPsec authentication sha2 compatible enable

[AR651]IPsec proposal hwproposal1

[AR651-IPsec-proposal-hwproposal1]esp authentication-algorithm sha2-256

[AR651-IPsec-proposal-hwproposal1]esp encryption-algorithm aes-128

[AR651-IPsec-proposal-hwproposal1]quit

[AR651]ike proposal 2

[AR651-ike-proposal-2]encryption-algorithm aes-128

[AR651-ike-proposal-2]dh group14

[AR651-ike-proposal-2]authentication-algorithm sha2-256

[AR651-ike-proposal-2]authentication-method pre-share

[AR651-ike-proposal-2]integrity-algorithm hmac-sha2-256

[AR651-ike-proposal-2]prf hmac-sha2-256

[AR651-ike-proposal-2]quit

[AR651]ike peer hwpeer1

[AR651-ike-peer-hwpeer1]undo version 1

[AR651-ike-peer-hwpeer1]pre-shared-key cipher Test@123

[AR651-ike-peer-hwpeer1]ike-proposal 2

[AR651-ike-peer-hwpeer1]local-address 22.xx.xx.22

[AR651-ike-peer-hwpeer1]remote-address 11.xx.xx.11

[AR651-ike-peer-hwpeer1]rsa encryption-padding oaep

[AR651-ike-peer-hwpeer1]rsa signature-padding pss

[AR651-ike-peer-hwpeer1]ikev2 authentication sign-hash sha2-256

[AR651-ike-peer-hwpeer1]quit

#

[AR651]ike peer hwpeer2

[AR651-ike-peer-hwpeer2]undo version 1

[AR651-ike-peer-hwpeer2]pre-shared-key cipher Test@123

[AR651-ike-peer-hwpeer2]ike-proposal 2

[AR651-ike-peer-hwpeer2]local-address 22.xx.xx.22

[AR651-ike-peer-hwpeer2]remote-address 11.xx.xx.12

[AR651-ike-peer-hwpeer2]rsa encryption-padding oaep

[AR651-ike-peer-hwpeer2]rsa signature-padding pss

[AR651-ike-peer-hwpeer2]ikev2 authentication sign-hash sha2-256

[AR651-ike-peer-hwpeer2]quit

Los comandos se describen de la siguiente manera:

• pre-shared-key cipher: configura una PSK, que debe ser la misma que la configurada en la consola de VPN.
• local-address: especifica la dirección IP pública del router AR.
• remote-address: especifica la EIP activa o en espera del gateway de VPN.

[AR651]IPsec profile hwpro1

[AR651-IPsec-profile-hwpro1]ike-peer hwpeer1

[AR651-IPsec-profile-hwpro1]proposal hwproposal1

[AR651-IPsec-profile-hwpro1]pfs dh-group14

[AR651-IPsec-profile-hwpro1]quit

#

[AR651]IPsec profile hwpro2

[AR651-IPsec-profile-hwpro2]ike-peer hwpeer2

[AR651-IPsec-profile-hwpro2]proposal hwproposal1

[AR651-IPsec-profile-hwpro2]pfs dh-group14

[AR651-IPsec-profile-hwpro2]quit

[AR651]interface Tunnel0/0/1

[AR651-Tunnel0/0/1]mtu 1400

[AR651-Tunnel0/0/1]ip address 169.254.70.1 255.255.255.252

[AR651-Tunnel0/0/1]tunnel-protocol IPsec

[AR651-Tunnel0/0/1]source 22.xx.xx.22

[AR651-Tunnel0/0/1]destination 11.xx.xx.11

[AR651-Tunnel0/0/1]IPsec profile hwpro1

[AR651-Tunnel0/0/1]quit

#

[AR651]interface Tunnel0/0/2

[AR651-Tunnel0/0/2]mtu 1400

[AR651-Tunnel0/0/2]ip address 169.254.71.1 255.255.255.252

[AR651-Tunnel0/0/2]tunnel-protocol IPsec

[AR651-Tunnel0/0/2]source 22.xx.xx.22

[AR651-Tunnel0/0/2]destination 11.xx.xx.12

[AR651-Tunnel0/0/2]IPsec profile hwpro2

[AR651-Tunnel0/0/2]quit

Los comandos se describen de la siguiente manera:

• interface Tunnel0/0/1 e interface Tunnel0/0/2 indican las interfaces de túnel correspondientes a las dos conexiones de VPN.

  En este ejemplo, Tunnel0/0/1 establece una conexión de VPN con la EIP activa del gateway de VPN, y Tunnel0/0/2 establece una conexión de VPN con la EIP en espera del gateway de VPN.

• ip address: configura una dirección IP para una interfaz de túnel en el router AR.
• source: especifica la dirección IP pública del router AR.
• destination: especifica la EIP activa o en espera del gateway de VPN.

[AR651]nqa test-instance IPsec_nqa1 IPsec_nqa1

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]test-type icmp

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]destination-address ipv4 169.254.70.2

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]source-address ipv4 169.254.70.1

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]frequency 15

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]ttl 255

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]start now

[AR651-nqa-IPsec_nqa1-IPsec_nqa1]quit

#

[AR651]nqa test-instance IPsec_nqa2 IPsec_nqa2

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]test-type icmp

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]destination-address ipv4 169.254.71.2

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]source-address ipv4 169.254.71.1

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]frequency 15

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]ttl 255

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]start now

[AR651-nqa-IPsec_nqa2-IPsec_nqa2]quit

Los comandos se describen de la siguiente manera:

• nqa test-instance IPsec_nqa1 IPsec_nqa1 y nqa test-instance IPsec_nqa2 IPsec_nqa2: configuran dos instancias de prueba de NQA denominadas IPsec_nqa1 y IPsec_nqa2.

  En este ejemplo, se crea la instancia de prueba IPsec_nqa1 para la conexión de VPN a la que pertenece la EIP activa del gateway de VPN; se crea la instancia de prueba IPsec_nqa2 para la conexión de VPN a la que pertenece la EIP en espera del gateway de VPN.

• destination-address: especifica la dirección de la interfaz de túnel del gateway de VPN.
• source-address: especifica la dirección de la interfaz de túnel del router AR.

[AR651]ip route-static 192.168.0.0 255.255.255.0 Tunnel0/0/1 track nqa IPsec_nqa1 IPsec_nqa1

[AR651]ip route-static 192.168.0.0 255.255.255.0 Tunnel0/0/2 track nqa IPsec_nqa2 IPsec_nqa2

Los parámetros se describen de la siguiente manera:

• 192.168.0.0 indica la subred local de la VPC.
• Tunnelx y IPsec_nqax en el mismo comando corresponden a la misma conexión de VPN.