H3CMSR路由器配置.docx

1、H3CMSR路由器配置H3C-MSR路由器配置H3C-dhcp-pool-1dns-list202.106.0.20 114.114.114.114 /具体的运营商DNS地址H3C-dhcp-pool-1quit4)在WAN接口配置NAT，实现内网地址上网进行源地址转换。H3Cinterface GigabitEthernet 0/0H3C-GigabitEthernet0/0nat outbound5)配置默认路由H3Cip route-static 0.0.0.0 0.0.0.0 119.57.73.65 /下一跳地址配置运营商分配的网关地址 Nat一对一NATsystem-viewH3C

2、nat static outbound 192.168.1.248 119.57.73.70H3Cinterface GigabitEthernet0/0H3C-GigabitEthernet0/0ip address 119.57.73.70 255.255.255.248 subH3C-GigabitEthernet0/0nat static enableH3C-GigabitEthernet0/0quitNAT端口映射system-viewH3Cinterface GigabitEthernet 0/0/进入设备公网接口H3C-GigabitEthernet0/0 nat server

3、protocol tcp global 119.57.73.67 5366 inside 192.168.1.67 5366 nat server protocol tcp global 119.57.73.67 5367 inside 192.168.1.67 5367 nat server protocol tcp global 119.57.73.67 8081 inside 192.168.1.244 8081 nat server protocol tcp global 119.57.73.67 8123 inside 192.168.1.250 8443 nat server pr

4、otocol tcp global 119.57.73.67 33890 inside 192.168.1.88 3389L2TP over ipsec1. 开启L2TP功能。system-viewH3Cl2tp enable2.配置本地用户名和密码，可配置多个用户H3Clocal-userhnjbclass network/配置拨号用户名New local user added.H3C-luser-network-hnjbpassword simplehnjb8013/配置拨号密码H3C-luser-network-hnjbservice-type pppH3C-luser-network-

5、hnjbquit3. 配置用户认证方式和IP地址池H3Cdomain systemH3C-isp-systemauthentication ppp local/配置PPP用户的认证方式为本地认证H3C-isp-systemquitH3Cip pool 10 10.1.1.10 10.1.1.100/配置为拨入终端分配的IP地址范围4. 创建虚拟模板接口H3Cinterface Virtual-Template0H3C-Virtual-Template0ppp authentication-modechap/配置本端PPP协议对终端的验证方式为CHAPH3C-Virtual-Template0r

6、emote address pool10/在虚模板视图下指定为用户分配IP的地址池H3C-Virtual-Template0ip address10.1.1.1 24H3C-Virtual-Template0 ppp ipcp dns 219.141.140.10 114.114.114.114 配置DNSH3C-Virtual-Template0quit5.创建并配置L2TP组H3Cl2tp-group 1 mode lnsH3C-l2tp1undo tunnel authentication/取消L2TP隧道验证功能，因为很多终端系统不支持隧道验证功能。H3C-l2tp1allow l2t

7、p virtual-template0H3C-l2tp1quit配置IPsec功能A.创建并进入一个IKE keychain视图，该视图用于配置IKE对等体的密钥信息。H3Cike keychainkeychain1H3C-ike-keychain-keychain1pre-shared-key address 0.0.0.0 0.0.0.0 key simplehnjb2017/配置预共享密钥123456。H3C-ike-keychain-keychain1quit配置IKE对等体H3Cike profileprofile1H3C-ike-profile-profile1keychainke

8、ychain1 H3C-ike-profile-profile1local-identity address119.57.73.67/指定标识本端身份的IP地址。H3C-ike-profile-profile1match remote identity address 0.0.0.0 0.0.0.0/指定对端身份FQDN名称。H3C-ike-profile-profile1proposal 1 2 3 4 5 6H3C-ike-profile-profile1quit配置IPsec安全提议H3Cipsec transform-settran1H3C-ipsec-transform-set-tr

9、an1esp encryption-algorithm des-cbcH3C-ipsec-transform-set-tran1esp authentication-algorithm md5H3C-ipsec-transform-set-tran1quit配置IPSec安全策略模板H3Cipsec policy-templatemsr1H3C-ipsec-policy-template-msr-1ike-profileprofile1/引用之前配置的IKE对等体H3C-ipsec-policy-template-msr-1transform-set1 2 3 4 5 6 /引用之前配置的IP

10、sec安全提议H3C-ipsec-policy-template-msr-1quit创建IPSec安全策略并引用安全策略模板H3Cipsec policy1231 isakmp templatemsr在公网接口上应用IPsec安全策略。H3Cinterface GigabitEthernet 0/0H3C-GigabitEthernet0/0ipsec apply policy123ike proposal 1 encryption-algorithm aes-cbc-128 dh group2 authentication-algorithm md5ike proposal 2 encryp

11、tion-algorithm 3des-cbc dh group2 authentication-algorithm md5ike proposal 3 encryption-algorithm 3des-cbc dh group2ike proposal 4 encryption-algorithm aes-cbc-256 dh group2ike proposal 5 dh group2ike proposal 6 encryption-algorithm aes-cbc-192 dh group2ipsec transform-set 1 encapsulation-mode trans

12、port esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 ipsec transform-set 2 encapsulation-mode transport esp encryption-algorithm aes-cbc-128 esp authentication-algorithm sha1 ipsec transform-set 3 encapsulation-mode transport esp encryption-algorithm aes-cbc-256 esp authentication

13、-algorithm sha1 ipsec transform-set 4 encapsulation-mode transport esp encryption-algorithm des-cbc esp authentication-algorithm sha1 ipsec transform-set 5 encapsulation-mode transport esp encryption-algorithm 3des-cbc esp authentication-algorithm sha1 ipsec transform-set 6 encapsulation-mode transport esp encryption-algorithm aes-cbc-192 esp authentication-algorithm sha1