曉林電腦服務(wù)公司給大家分享一下H3C V7防火墻GRE VPN配置案例IT外包 服務(wù)器虛擬化 數(shù)據(jù)存儲 數(shù)據(jù)備份 數(shù)據(jù)恢復(fù)IT外包 服務(wù)器虛擬化 數(shù)據(jù)存儲 數(shù)據(jù)備份 數(shù)據(jù)恢復(fù)
1.配置需求
配置需求及實現(xiàn)的效果
總部和分部各有一臺防火墻部署在互聯(lián)網(wǎng)出口，因業(yè)務(wù)需要兩端內(nèi)網(wǎng)業(yè)務(wù)需要通過GRE VPN相互訪問。IP地址及接口規(guī)劃如下表所示：
莆田IT外包|服務(wù)器虛擬化|數(shù)據(jù)存儲|數(shù)據(jù)備份|網(wǎng)絡(luò)故障排除|數(shù)據(jù)恢復(fù) www.xiaolin.cc
2網(wǎng)絡(luò)拓撲圖
莆田IT外包|服務(wù)器虛擬化|數(shù)據(jù)存儲|數(shù)據(jù)備份|網(wǎng)絡(luò)故障排除|數(shù)據(jù)恢復(fù) www.xiaolin.cc
3.配置步驟
3.1 總部側(cè)防火墻基本網(wǎng)絡(luò)配置
3.1.1 設(shè)置總部側(cè)外網(wǎng)接口地址
#輸入命令“system-view”進入系統(tǒng)視圖后為1/0/3接口配置101.88.26.34/30的地址，并配置nat地址轉(zhuǎn)換。
<H3C>system-view
[H3C]interface GigabitEthe.NET 1/0/3
[H3C-GigabitEthernet1/0/3]ip address 101.88.26.34 255.255.255.252
[H3C-GigabitEthernet1/0/3]nat outbound
[H3C-GigabitEthernet1/0/3]quit
3.1.2 設(shè)置總部側(cè)內(nèi)網(wǎng)接口地址
#在1/0/4接口配置連接內(nèi)網(wǎng)地址192.168.10.1/24。
[H3C]interface GigabitEthernet 1/0/4
[H3C-GigabitEthernet1/0/4]ip address 192.168.10.1 255.255.255.0
[H3C-GigabitEthernet1/0/4]quit
3.1.3 設(shè)置總部側(cè)到公網(wǎng)路由
#配置默認(rèn)路由目的地址及掩碼為0.0.0.0、下一跳（網(wǎng)關(guān)）地址為101.88.26.33。
[H3C]ip route-static 0.0.0.0 0 101.88.26.33
3.2 總部側(cè)GRE VPN配置
3.2.1 新建Tunnel 0隧道接口
#新建Tunnel 0隧道接口，并配置IP地址為1.1.1.1/24，指定Tunnel 0接口源地址與目的地址分別對應(yīng)總部分支側(cè)的公網(wǎng)地址。
[H3C]interface Tunnel 0 mode gre
[H3C-Tunnel0]ip address 1.1.1.1 255.255.255.0
[H3C-Tunnel0]source 101.88.26.34
[H3C-Tunnel0]destination 198.76.26.90
[H3C-Tunnel0]quit
3.2.2 新建到tunnel接口的明細路由
#新建一條目的地址為192.168.20.0/24，下一跳（網(wǎng)關(guān)）地址為tunnel0接口的路由，用于匹配去往192.168.20.0/24網(wǎng)段的路由客戶通過隧道轉(zhuǎn)發(fā)。
[H3C]ip route-static 192.168.20.0 24 Tunnel 0
3.3 總部側(cè)安全策略配置
莆田IT外包|服務(wù)器虛擬化|數(shù)據(jù)存儲|數(shù)據(jù)備份|網(wǎng)絡(luò)故障排除|數(shù)據(jù)恢復(fù) www.xiaolin.cc
3.3.1 將外網(wǎng)、內(nèi)網(wǎng)、tunnel接口加入對應(yīng)安全
#外網(wǎng)接口加untrust區(qū)域、內(nèi)網(wǎng)接口、tunnel接口加入trust區(qū)域。
[H3C]security-zone name Untrust
[H3C-security-zone-Untrust]import interface GigabitEthernet
1/0/3
[H3C-security-zone-Untrust]quit
[H3C]security-zone name Trust
[H3C-security-zone-Trust]import interface GigabitEthernet
1/0/4
[H3C-security-zone-Trust]import interface Tunnel 0
[H3C-security-zone-Trust]quit
3.3.2 放通安全策略使數(shù)據(jù)通信正常
1. 放通trust到untrust、local的安全策略，使內(nèi)網(wǎng)用戶訪問網(wǎng)絡(luò)的同時能管理防火墻設(shè)備。
[H3C]security-policy ip
[H3C-security-policy-ip]rule 5 name trust-untrust、local
[
H3C-security-policy-ip-5-trust-untrust、local]action pass
[
H3C-security-policy-ip-5-trust-untrust、local]source-zone trust
[
H3C-security-policy-ip-5-trust-untrust、local]destination-zone untrust
[
H3C-security-policy-ip-5-trust-untrust、local]destination-zone local
[
H3C-security-policy-ip-5-trust-untrust、local]quit
[H3C-security-policy-ip]quit
2. 放通untrust到trust目的地址為192.168.20.0/24網(wǎng)段到192.168.10.0/24網(wǎng)段的數(shù)據(jù)
#新建IPV4地址對象組分部網(wǎng)段與總部網(wǎng)段分別對應(yīng)192.168.20.0/24與192.168.10.0/24網(wǎng)段。
莆田IT外包|服務(wù)器虛擬化|數(shù)據(jù)存儲|數(shù)據(jù)備份|網(wǎng)絡(luò)故障排除|數(shù)據(jù)恢復(fù) www.xiaolin.cc
[H3C]object-group ip address 分部網(wǎng)段
[H3C-obj-grp-ip-分部網(wǎng)段]0 network subnet 192.168.20.0 255.255.255.0
[H3C-obj-grp-ip-分部網(wǎng)段]quit
[H3C]object-group ip address 總部網(wǎng)段
[H3C-obj-grp-ip-總部網(wǎng)段]0 network subnet 192.168.10.0 255.255.255.0
[H3C-obj-grp-ip-總部網(wǎng)段]quit
#新建IPV4地址對象組 IT外包 服務(wù)器虛擬化 數(shù)據(jù)存儲 數(shù)據(jù)備份 數(shù)據(jù)恢復(fù)IT外包 服務(wù)器虛擬化 數(shù)據(jù)存儲 數(shù)據(jù)備份 數(shù)據(jù)恢復(fù)
[H3C]security-policy ip
[H3C-security-policy-ip]rule 10 name untrust-trust
[H3C-security-policy-ip-10-untrust-trust]action pass
[H3C-security-policy-ip-10-untrust-trust]source-zone untrust
[H3C-security-policy-ip-10-untrust-trust]destination-zone trust
[
H3C-security-policy-ip-10-untrust-trust]source-ip分部網(wǎng)段
[
H3C-security-policy-ip-10-untrust-trust]destination-ip總部網(wǎng)段
[H3C-security-policy-ip-10-untrust-trust]quit
[H3C-security-policy-ip]quit
#放通同安全域間的安全策略
[H3C]security-zone intra-zone default permit
3.4 分部側(cè)防火墻GRE配置
分部防火墻與總部側(cè)防火墻配置方法一致。
3.5 結(jié)果測試
#使用總部側(cè)PC機PING測試分部側(cè)PC機測試：
可以看到在總部側(cè)訪問分部數(shù)據(jù)可達，并且通過“display interface Tunnel 0”可以看到收發(fā)包數(shù)量。
<H3C>display interface Tunnel 0
Tunnel0
Current
state: UP
Line
protocol state: UP
Description: Tunnel0 Interf?ace
Bandwidth: 64 kbps
Maximum
transmission unit: 1476
Internet
address: 1.1.1.1/24 (primary)
Tunnel
source 101.88.26.34, destination 198.76.26.90
Tunnel
keepalive disabled
Tunnel
TTL 255
Tunnel
protocol/transport GRE/IP
GRE key disabled
Checksumming of GRE packets
disabled
Last
clearing of counters: Never
Last 300
seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Last 300
seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec
Input:
5 packets, 420 bytes, 0 drops
Output:
5 packets, 420 bytes, 0 drops
3.6 保存配置
[H3C]save f
