| ike proposal | 阶段一：加密/认证/DH/生存期 |
|---|---|
| ipsec proposal | 阶段二：封装模式与算法 |
| ike peer | 对端地址、版本、预共享密钥 |
| ipsec policy | 关联 ACL 与 peer，接口应用 |
配置示例
配置示例
ike proposal 10
encryption-algorithm aes-cbc-256
authentication-algorithm sha2-256
dh group14
!
ipsec proposal 10
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
!
ike peer PEER1 v2
pre-shared-key cipher Huawei@123
remote-address 203.0.113.2
!
acl number 3000
rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.2.2.0 0.0.0.255
!
ipsec policy POLICY1 10 isakmp
security acl 3000
ike-peer PEER1
proposal 10
!
interface GigabitEthernet0/0/1
ipsec policy POLICY1