Networking requirements

Such as chart 1 Shown , The Internet A And the Internet B adopt NGFW_A and NGFW_B Connect to Internet,NGFW_A and NGFW_B Public network routing can reach . Now it's necessary to NGFW_A and NGFW_B Establish between IKE The way of IPSec Tunnel , Make the network A And the Internet B Users of can use IPSec Tunnel safety visits .


eb084d251dce0da7820949ce2762bb21.png

chart 1 IKE Point to point negotiation IPSec Tunnel example network diagram  

Data planning

0691a4f34122d20abab4e3fb459ac3cc.jpeg

Configuration ideas

NGFW_A and NGFW_B The configuration idea is the same .

1. Configure interface IP Address and add the interface to the security zone .

2. Configure security policy .

3. Configure routing to the peer intranet .

4. To configure IPSec Strategy . Including configuration IPSec The basic information of the strategy 、 Configure the data stream to be encrypted 、 Configure negotiation parameters for security proposals .

Operation steps

· To configure NGFW_A( headquarters ).

1. Configure interface IP Address .

<sysname> system-view
[sysname] sysname NGFW_A
[NGFW_A] interface GigabitEthernet 1/0/3
[NGFW_A-GigabitEthernet1/0/3] ip address 10.1.1.1 24
[NGFW_A-GigabitEthernet1/0/3] quit
[NGFW_A] interface GigabitEthernet 1/0/1
[NGFW_A-GigabitEthernet1/0/1] ip address 1.1.3.1 24
[NGFW_A-GigabitEthernet1/0/1] quit

2. Configure the interface to join the corresponding security zone .

[NGFW_A] firewall zone trust
[NGFW_A-zone-trust] add interface GigabitEthernet 1/0/3
[NGFW_A-zone-trust] quit
[NGFW_A] firewall zone untrust
[NGFW_A-zone-untrust] add interface GigabitEthernet 1/0/1
[NGFW_A-zone-untrust] quit

3. Configure security policy .

a. To configure Trust Domain and Untrust Security policy for domain , Allow packets before and after encapsulation to pass through NGFW_A.

[NGFW_A] security-policy
[NGFW_A-policy-security] rule name policy_ipsec_1
[NGFW_A-policy-security-rule-policy_ipsec_1] source-zone trust
[NGFW_A-policy-security-rule-policy_ipsec_1] destination-zone untrust
[NGFW_A-policy-security-rule-policy_ipsec_1] source-address 10.1.1.0 24
[NGFW_A-policy-security-rule-policy_ipsec_1] destination-address 10.1.2.0 24
[NGFW_A-policy-security-rule-policy_ipsec_1] action permit
[NGFW_A-policy-security-rule-policy_ipsec_1] quit
[NGFW_A-policy-security] rule name policy_ipsec_2
[NGFW_A-policy-security-rule-policy_ipsec_2] source-zone untrust
[NGFW_A-policy-security-rule-policy_ipsec_2] destination-zone trust
[NGFW_A-policy-security-rule-policy_ipsec_2] source-address 10.1.2.0 24
[NGFW_A-policy-security-rule-policy_ipsec_2] destination-address 10.1.1.0 24
[NGFW_A-policy-security-rule-policy_ipsec_2] action permit
[NGFW_A-policy-security-rule-policy_ipsec_2] quit

b. To configure Local Domain and Untrust Security policy for domain , allow IKE Negotiation message can pass normally NGFW_A.

[NGFW_A-policy-security] rule name policy_ipsec_3
[NGFW_A-policy-security-rule-policy_ipsec_3] source-zone local
[NGFW_A-policy-security-rule-policy_ipsec_3] destination-zone untrust
[NGFW_A-policy-security-rule-policy_ipsec_3] source-address 1.1.3.1 32
[NGFW_A-policy-security-rule-policy_ipsec_3] destination-address 1.1.5.1 32
[NGFW_A-policy-security-rule-policy_ipsec_3] action permit
[NGFW_A-policy-security-rule-policy_ipsec_3] quit
[NGFW_A-policy-security] rule name policy_ipsec_4
[NGFW_A-policy-security-rule-policy_ipsec_4] source-zone untrust
[NGFW_A-policy-security-rule-policy_ipsec_4] destination-zone local
[NGFW_A-policy-security-rule-policy_ipsec_4] source-address 1.1.5.1 32
[NGFW_A-policy-security-rule-policy_ipsec_4] destination-address 1.1.3.1 32
[NGFW_A-policy-security-rule-policy_ipsec_4] action permit
[NGFW_A-policy-security-rule-policy_ipsec_4] quit
[NGFW_A-policy-security] quit

4. Configure the route to the private network . hypothesis NGFW_A Leading to NGFW_B Next hop device on the side IP The address is 1.1.3.2.

[NGFW_A] ip route-static 10.1.2.0 24 1.1.3.2

5. To configure NGFW_A Of IPSec Tunnel .

a. Configure access control list , Define the data stream to be protected .

[NGFW_A] acl 3000
[NGFW_A-acl-adv-3000] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[NGFW_A-acl-adv-3000] quit

b. The configuration number is 10 Of IKE Security proposal .

[NGFW_A] ike proposal 10
[NGFW_A-ike-proposal-10] authentication-method pre-share
[NGFW_A-ike-proposal-10] authentication-algorithm sha2-256
[NGFW_A-ike-proposal-10] quit

c. To configure IKE Peer.

[NGFW_A] ike peer b
[NGFW_A-ike-peer-b] ike-proposal 10
[NGFW_A-ike-peer-b] remote-address 1.1.5.1
[NGFW_A-ike-peer-b] pre-shared-key Admin@123
[NGFW_A-ike-peer-b] undo version 2
[NGFW_A-ike-peer-b] quit

d. The configuration name is tran1 Of IPSec Security proposal .

[NGFW_A] ipsec proposal tran1
[NGFW_A-ipsec-proposal-tran1] encapsulation-mode tunnel
[NGFW_A-ipsec-proposal-tran1] transform esp
[NGFW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[NGFW_A-ipsec-proposal-tran1] esp encryption-algorithm aes
[NGFW_A-ipsec-proposal-tran1] quit

e. To configure IPSec Security policy group map1.

[NGFW_A] ipsec policy map1 10 isakmp
[NGFW_A-ipsec-policy-isakmp-map1-10] security acl 3000
[NGFW_A-ipsec-policy-isakmp-map1-10] proposal tran1
[NGFW_A-ipsec-policy-isakmp-map1-10] ike-peer b
[NGFW_A-ipsec-policy-isakmp-map1-10] quit

f. In out interface GigabitEthernet 1/0/1 Apply security policy group on map1.

[NGFW_A] interface GigabitEthernet 1/0/1
[NGFW_A-GigabitEthernet1/0/1] ipsec policy map1 auto-neg
[NGFW_A-GigabitEthernet1/0/1] quit

· To configure NGFW_B( Branch ).

1. Configure interface IP Address .

<sysname> system-view
[sysname] sysname NGFW_B
[NGFW_B] interface GigabitEthernet 1/0/3
[NGFW_B-GigabitEthernet1/0/3] ip address 10.1.2.1 24
[NGFW_B-GigabitEthernet1/0/3] quit
[NGFW_B] interface GigabitEthernet 1/0/1
[NGFW_B-GigabitEthernet1/0/1] ip address 1.1.5.1 24
[NGFW_B-GigabitEthernet1/0/1] quit

2. Configure the interface to join the corresponding security zone .

[NGFW_B] firewall zone trust
[NGFW_B-zone-trust] add interface GigabitEthernet 1/0/3
[NGFW_B-zone-trust] quit
[NGFW_B] firewall zone untrust
[NGFW_B-zone-untrust] add interface GigabitEthernet 1/0/1
[NGFW_B-zone-untrust] quit

3. Configure security policy .

a. To configure Trust Domain and Untrust Security policy for domain , Allow packets before and after encapsulation to pass through NGFW_B.

[NGFW_B] security-policy
[NGFW_B-policy-security] rule name policy_ipsec_1
[NGFW_B-policy-security-rule-policy_ipsec_1] source-zone trust
[NGFW_B-policy-security-rule-policy_ipsec_1] destination-zone untrust
[NGFW_B-policy-security-rule-policy_ipsec_1] source-address 10.1.2.0 24
[NGFW_B-policy-security-rule-policy_ipsec_1] destination-address 10.1.1.0 24
[NGFW_B-policy-security-rule-policy_ipsec_1] action permit
[NGFW_B-policy-security-rule-policy_ipsec_1] quit
[NGFW_B-policy-security] rule name policy_ipsec_2
[NGFW_B-policy-security-rule-policy_ipsec_2] source-zone untrust
[NGFW_B-policy-security-rule-policy_ipsec_2] destination-zone trust
[NGFW_B-policy-security-rule-policy_ipsec_2] source-address 10.1.1.0 24
[NGFW_B-policy-security-rule-policy_ipsec_2] destination-address 10.1.2.0 24
[NGFW_B-policy-security-rule-policy_ipsec_2] action permit
[NGFW_B-policy-security-rule-policy_ipsec_2] quit

b. To configure Local Domain and Untrust Security policy for domain , allow IKE Negotiation message can pass normally NGFW_B.

[NGFW_B-policy-security] rule name policy_ipsec_3
[NGFW_B-policy-security-rule-policy_ipsec_3] source-zone local
[NGFW_B-policy-security-rule-policy_ipsec_3] destination-zone untrust
[NGFW_B-policy-security-rule-policy_ipsec_3] source-address 1.1.5.1 32
[NGFW_B-policy-security-rule-policy_ipsec_3] destination-address 1.1.3.1 32
[NGFW_B-policy-security-rule-policy_ipsec_3] action permit
[NGFW_B-policy-security-rule-policy_ipsec_3] quit
[NGFW_B-policy-security] rule name policy_ipsec_4
[NGFW_B-policy-security-rule-policy_ipsec_4] source-zone untrust
[NGFW_B-policy-security-rule-policy_ipsec_4] destination-zone local
[NGFW_B-policy-security-rule-policy_ipsec_4] source-address 1.1.3.1 32
[NGFW_B-policy-security-rule-policy_ipsec_4] destination-address 1.1.5.1 32
[NGFW_B-policy-security-rule-policy_ipsec_4] action permit
[NGFW_B-policy-security-rule-policy_ipsec_4] quit
[NGFW_B-policy-security] quit

4. Configure the route to the private network . hypothesis NGFW_B Leading to NGFW_A Next hop device on the side IP The address is 1.1.5.2.

[NGFW_B] ip route-static 10.1.1.0 24 1.1.5.2

5. To configure NGFW_B Of IPSec Tunnel .

a. Configure access control list , Define the data stream to be protected .

[NGFW_B] acl 3000
[NGFW_B-acl-adv-3000] rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
[NGFW_B-acl-adv-3000] quit

b. The configuration number is 10 Of IKE Security proposal .

[NGFW_B] ike proposal 10
[NGFW_B-ike-proposal-10] authentication-method pre-share
[NGFW_B-ike-proposal-10] authentication-algorithm sha2-256
[NGFW_B-ike-proposal-10] quit

c. To configure IKE Peer.

[NGFW_B] ike peer a
[NGFW_B-ike-peer-a] ike-proposal 10
[NGFW_B-ike-peer-a] remote-address 1.1.3.1
[NGFW_B-ike-peer-a] pre-shared-key Admin@123
[NGFW_B-ike-peer-a] undo version 2
[NGFW_B-ike-peer-a] quit

d. The configuration name is tran1 Of IPSec Security proposal .

[NGFW_B] ipsec proposal tran1
[NGFW_B-ipsec-proposal-tran1] encapsulation-mode tunnel
[NGFW_B-ipsec-proposal-tran1] transform esp
[NGFW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[NGFW_B-ipsec-proposal-tran1] esp encryption-algorithm aes
[NGFW_B-ipsec-proposal-tran1] quit

e. To configure IPSec Security policy group map1.

[NGFW_B] ipsec policy map1 10 isakmp
[NGFW_B-ipsec-policy-isakmp-map1-10] security acl 3000
[NGFW_B-ipsec-policy-isakmp-map1-10] proposal tran1
[NGFW_B-ipsec-policy-isakmp-map1-10] ike-peer a
[NGFW_B-ipsec-policy-isakmp-map1-10] quit

f. In out interface GigabitEthernet 1/0/1 Apply security policy group on map1.

[NGFW_B] interface GigabitEthernet 1/0/1
[NGFW_B-GigabitEthernet1/0/1] ipsec policy map1 auto-neg
[NGFW_B-GigabitEthernet1/0/1] quit

The results verify that

1. After successful configuration , stay NGFW_A On the implementation display ike sa command , see IKE The establishment of the Security Alliance , The following display description appears IKE The security alliance has been established successfully .

[NGFW_A] display ike sa
current ike sa number: 2
---------------------------------------------------------------------------
conn-id    peer                                flag          phase ***
---------------------------------------------------------------------------
3          1.1.5.1                             RD|ST|A       v1:2  public
2          1.1.5.1                             RD|ST|A       v1:1  public
 flag meaning
 RD--READY     ST--STAYALIVE     RL--REPLACED    FD--FADING    TO--TIMEOUT
 TD--DELETING  NEG--NEGOTIATING  D--DPD          M--ACTIVE     S--STANDBY
 A--ALONE

2. stay NGFW_A On the implementation display ipsec sa command , see IPSec The establishment of the Security Alliance , The following display description appears IPSec The security alliance has been established successfully .

[NGFW_A] display ipsec sa
===============================
Interface: GigabitEthernet 1/0/1
   path MTU: 1500
===============================
                         
 -----------------------------
 IPsec policy name: "map1"
 sequence number: 10
 mode: isakmp
 ***: 0
 -----------------------------
   connection id: 3
 rule number: 5
   encapsulation mode: tunnel
   holding time: 0d 0h 0m 12s
   tunnel local : 1.1.3.1    tunnel remote: 1.1.5.1
   flow      source: 10.1.1.0/255.255.255.0 0/0
   flow destination: 10.1.2.0/255.255.255.0 0/0
                         
   [inbound ESP SAs]
     spi: 3715780278 (0xdd7a4eb6)
   ***: public  said: 0  cpuid: 0x0000
     proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256
     sa remaining key duration (kilobytes/sec): 1843200/3588
     max received sequence-number: 1
     udp encapsulation used for nat traversal: N
                         
 [outbound ESP SAs]
    spi: 3312146193 (0xc56b5711)
     ***: public  said: 1  cpuid: 0x0000
     proposal: ESP-ENCRYPT-AES ESP-AUTH-SHA2-256
     sa remaining key duration (kilobytes/sec): 1843200/3588
     max sent sequence-number: 1
    udp encapsulation used for nat traversal: N

The configuration script

· NGFW_A( headquarters ) Configuration script for

#
acl number 3000
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
#
ike proposal 10
authentication-algorithm sha2-256
integrity-algorithm hmac-sha2-256
#
ike peer b
pre-shared-key %$%$g6]1Md'q_QwX%A,v7]c1;md[%$%$
ike-proposal 10
undo version 2
remote-address 1.1.5.1
#
ipsec proposal tran1
esp authentication-algorithm sha2-256
#
ipsec policy map1 10 isakmp
security acl 3000
ike-peer b
alias map1_10
proposal tran1
#
interface GigabitEthernet1/0/3
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/1
ip address 1.1.3.1 255.255.255.0
ipsec policy map1 auto-neg
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/3
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
#
ip route-static 10.1.2.0 255.255.255.0 1.1.3.2
#
security-policy
 rule name policy_ipsec_1
   source-zone trust
   destination-zone untrust
   source-address 10.1.1.0 24
   destination-address 10.1.2.0 24
   action permit
 rule name policy_ipsec_2
   source-zone untrust
   destination-zone trust
   source-address 10.1.2.0 24
   destination-address 10.1.1.0 24
   action permit
 rule name policy_ipsec_3
   source-zone local
   destination-zone untrust
   source-address 1.1.3.1 32
   destination-address 1.1.5.1 32
   action permit
 rule name policy_ipsec_4
   source-zone untrust
   destination-zone local
   source-address 1.1.5.1 32
   destination-address 1.1.3.1 32
   action permit

· NGFW_B( Branch ) Configuration script for

#
acl number 3000
rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
ike proposal 10
authentication-algorithm sha2-256
integrity-algorithm hmac-sha2-256
#
ike peer a
pre-shared-key %$%$g6]1Md'q_QwX%A,v7]c1;md[%$%$
ike-proposal 10
undo version 2
remote-address 1.1.3.1
#
ipsec proposal tran1
esp authentication-algorithm sha2-256
#
ipsec policy map1 10 isakmp
security acl 3000
ike-peer a
proposal tran1
#
interface GigabitEthernet1/0/3
ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
ip address 1.1.5.1 255.255.255.0
ipsec policy map1 auto-neg
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/3
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
#
ip route-static 10.1.1.0 255.255.255.0 1.1.5.2
#
security-policy
 rule name policy_ipsec_1
   source-zone trust
   destination-zone untrust
   source-address 10.1.2.0 24
   destination-address 10.1.1.0 24
   action permit
 rule name policy_ipsec_2
   source-zone untrust
   destination-zone trust
   source-address 10.1.1.0 24
   destination-address 10.1.2.0 24
   action permit
 rule name policy_ipsec_3
   source-zone local
   destination-zone untrust
   source-address 1.1.5.1 32
   destination-address 1.1.3.1 32
   action permit
 rule name policy_ipsec_4
   source-zone untrust
   destination-zone local
   source-address 1.1.3.1 32
   destination-address 1.1.5.1 32
   action permit