防火墻技術(shù)案例5雙機(jī)熱備負(fù)載分擔(dān)資料組網(wǎng)下的ipsec配置(編輯修改稿)
2025-05-14 12:53 本頁面
【文章內(nèi)容簡介】 ikeproposal 10HRP_A[NGFW_Cikepeerngfw_a]remoteaddress HRP_A[NGFW_Cikepeerngfw_a]presharedkey Admin@123HRP_A[NGFW_Cikepeerngfw_a]quitHRP_A[NGFW_C]ike peer ngfw_bHRP_A[NGFW_Cikepeerngfw_b]ikeproposal 10HRP_A[NGFW_Cikepeerngfw_b]remoteaddress HRP_A[NGFW_Cikepeerngfw_b]presharedkey Admin@123HRP_A[NGFW_Cikepeerngfw_b]quit5）配置兩個IPSec策略，分別用于總部與兩個分支建立IPSec。HRP_A[NGFW_C]ipsec policy map1 10 isakmpHRP_A[NGFW_Cipsecpolicyisakmpmap110]security acl 3005HRP_A[NGFW_Cipsecpolicyisakmpmap110]proposal tran1HRP_A[NGFW_Cipsecpolicyisakmpmap110]ikepeer ngfw_aHRP_A[NGFW_Cipsecpolicyisakmpmap110]quitHRP_A[NGFW_C]ipsec policy map2 10 isakmpHRP_A[NGFW_Cipsecpolicyisakmpmap210]security acl 3006HRP_A[NGFW_Cipsecpolicyisakmpmap210]proposal tran1HRP_A[NGFW_Cipsecpolicyisakmpmap210]ikepeer ngfw_bHRP_A[NGFW_Cipsecpolicyisakmpmap210]quit6）配置在Tunnel接口上應(yīng)用IPSec策略?！緩?qiáng)叔點(diǎn)評】之前點(diǎn)評中提到我們需要在NGFW_C的tunnel1上與NGFW_A建立一條主用隧道，在tunnel2上與NGFW_B建立一條備份隧道，這是通過在應(yīng)用IPSec策略時設(shè)定active或standby參數(shù)來實現(xiàn)的。HRP_A[NGFW_C]interface Tunnel 1HRP_A[NGFW_CTunnel1]ipsec policy map1 activeHRP_A[NGFW_CTunnel1]quitHRP_A[NGFW_C]interface Tunnel 2HRP_A[NGFW_CTunnel2]ipsec policy map2standbyHRP_A[NGFW_CTunnel2]quit7）在NGFW_D上配置IPSec。雙機(jī)熱備狀態(tài)成功建立后，NGFW_C上配置的ACL、IPSec策略（包括其中的IPSec安全提議，IKE對等體）等都會自動備份到NGFW_D上。只有在接口上應(yīng)用IPSec策略的配置不會備份，需要在此手動配置。HRP_S[NGFW_D]interface Tunnel 1HRP_S[NGFW_DTunnel1]ipsec policy map1 standbyHRP_S[NGFW_DTunnel1]quitHRP_S[NGFW_D]interface Tunnel 2HRP_S[NGFW_DTunnel2]ipsec policy map2 activeHRP_S[NGFW_DTunnel2]q
教學(xué)教案相關(guān)推薦
鄂ICP備17016276號-1