华为防火墙：GRE over IPSec
华为防火墙：GRE over IPSec-（ipsec安全策略方式）-（点到点）-（静态路由）
1、Internet上仅配置IP地址
2、FW-A和FW-B之间配置GRE over ipsec tunnel隧道
3、配置静态路由使A-B两个网络互通
防火墙安全策略配置
| 源安全区域 |
目的安全区域 |
源地址 |
目的地址 |
| untrust |
local |
gre-remote-公网IP |
gre-local-公网IP |
| local |
untrust |
gre-local-公网IP |
gre-remote-公网IP |
| trust |
tunnel接口所在区域 |
reg-local-匹配流量 |
gre-remote-匹配流量 |
| tunnel接口所在区域 |
trust |
gre-remote-匹配流量 |
gre-local-匹配流量 |
ACL配置A-B两端的公网地址（GRE数据流）
---------------------------------------------------------------------------------------------------------------------------------
FW-A配置
基本配置
[FW-A]int GigabitEthernet 1/0/0
[FW-A-GigabitEthernet1/0/0]ip add 10.1.1.1 30
[FW-A-GigabitEthernet1/0/0]q
[FW-A]int GigabitEthernet 1/0/1
[FW-A-GigabitEthernet1/0/1]ip add 172.16.10.254 24
[FW-A-GigabitEthernet1/0/1]q
[FW-A]firewall zone trust
[FW-A-zone-trust]add interface GigabitEthernet 1/0/1
[FW-A-zone-trust]q
[FW-A]firewall zone untrust
[FW-A-zone-untrust]add interface g1/0/0
[FW-A-zone-untrust]q
配置gre tunnel
[FW-A]interface Tunnel 1
[FW-A-Tunnel1] description to_network-b
[FW-A-Tunnel1] ip address 1.1.1.1 24
[FW-A-Tunnel1] tunnel-protocol gre
[FW-A-Tunnel1] source 10.1.1.1
[FW-A-Tunnel1] destination 20.1.1.1
[FW-A-Tunnel1] gre key cipher 123456
[FW-A-Tunnel1] quit
[FW-A]firewall zone name gre
[FW-A-zone-gre] set priority 10
[FW-A-zone-gre] add interface Tunnel1
[FW-A-zone-gre] quit
配置路由
[FW-A]ip route-static 0.0.0.0 0.0.0.0 10.1.1.2
[FW-A]ip route-static 172.16.20.0 255.255.255.0 Tunnel 1
配置ipsec
ACL配置A-B两端的公网地址（GRE数据流）
[FW-A]acl number 3000
[FW-A-acl-adv-3000] rule 5 permit ip source 10.1.1.1 0 destination 20.1.1.1 0
[FW-A-acl-adv-3000]quit
[FW-A]ike proposal 10
[FW-A-ike-proposal-10] encryption-algorithm aes-256
[FW-A-ike-proposal-10] dh group18
[FW-A-ike-proposal-10] authentication-algorithm sha2-512
[FW-A-ike-proposal-10] authentication-method pre-share
[FW-A-ike-proposal-10] integrity-algorithm hmac-sha2-256
[FW-A-ike-proposal-10] prf hmac-sha2-256
[FW-A-ike-proposal-10] quit
[FW-A]ike peer fw
[FW-A-ike-peer-fw] exchange-mode main
[FW-A-ike-peer-fw] pre-shared-key huawei
[FW-A-ike-peer-fw] ike-proposal 10
[FW-A-ike-peer-fw] remote-address 20.1.1.1
[FW-A-ike-peer-fw] quit
[FW-A]ipsec proposal 10
[FW-A-ipsec-proposal-10] transform esp
[FW-A-ipsec-proposal-10] encapsulation-mode tunnel
[FW-A-ipsec-proposal-10] esp authentication-algorithm sha2-512
[FW-A-ipsec-proposal-10] esp encryption-algorithm aes-256
[FW-A-ipsec-proposal-10] quit
[FW-A]ipsec policy ipsec 1 isakmp
[FW-A-ipsec-policy-isakmp-ipsec-1] security acl 3000
[FW-A-ipsec-policy-isakmp-ipsec-1] ike-peer fw
[FW-A-ipsec-policy-isakmp-ipsec-1] proposal 10
[FW-A-ipsec-policy-isakmp-ipsec-1] quit
[FW-A]interface GigabitEthernet1/0/0
[FW-A-GigabitEthernet1/0/0] ipsec policy ipsec
[FW-A-GigabitEthernet1/0/0] quit
配置安全策略
[FW-A]security-policy
[FW-A-policy-security] rule name local_remote
[FW-A-policy-security-rule-local_remote] source-zone local
[FW-A-policy-security-rule-local_remote] destination-zone untrust
[FW-A-policy-security-rule-local_remote] source-address 10.1.1.1 0.0.0.0
[FW-A-policy-security-rule-local_remote] destination-address 20.1.1.1 0.0.0.0
[FW-A-policy-security-rule-local_remote] action permit
[FW-A-policy-security-rule-local_remote] quit
[FW-A-policy-security] rule name remote_local
[FW-A-policy-security-rule-remote_local] source-zone untrust
[FW-A-policy-security-rule-remote_local] destination-zone local
[FW-A-policy-security-rule-remote_local] source-address 20.1.1.1 0.0.0.0
[FW-A-policy-security-rule-remote_local] destination-address 10.1.1.1 0.0.0.0
[FW-A-policy-security-rule-remote_local] action permit
[FW-A-policy-security-rule-remote_local] quit
[FW-A-policy-security] rule name neiwang_a-neiwang_b
[FW-A-policy-security-rule-neiwang_a-neiwang_b] source-zone trust
[FW-A-policy-security-rule-neiwang_a-neiwang_b] destination-zone gre
[FW-A-policy-security-rule-neiwang_a-neiwang_b] source-address 172.16.10.0 mask 255.255.255.0
[FW-A-policy-security-rule-neiwang_a-neiwang_b] destination-address 172.16.20.0 mask 255.255.255.0
[FW-A-policy-security-rule-neiwang_a-neiwang_b] action permit
[FW-A-policy-security-rule-neiwang_a-neiwang_b] quit
[FW-A-policy-security] rule name neiwang_b-neiwang_a
[FW-A-policy-security-rule-neiwang_b-neiwang_a] source-zone gre
[FW-A-policy-security-rule-neiwang_b-neiwang_a] destination-zone trust
[FW-A-policy-security-rule-neiwang_b-neiwang_a] source-address 172.16.20.0 mask 255.255.255.0
[FW-A-policy-security-rule-neiwang_b-neiwang_a] destination-address 172.16.10.0 mask 255.255.255.0
[FW-A-policy-security-rule-neiwang_b-neiwang_a] action permit
[FW-A-policy-security-rule-neiwang_b-neiwang_a] quit
[FW-A-policy-security]q
FW-B配置
[FW-B]int GigabitEthernet 1/0/0
[FW-B-GigabitEthernet1/0/0]ip add 20.1.1.1 30
[FW-B-GigabitEthernet1/0/0]q
[FW-B]int GigabitEthernet 1/0/1
[FW-B-GigabitEthernet1/0/1]ip add 172.16.20.254 24
[FW-B-GigabitEthernet1/0/1]q
[FW-B]firewall zone trust
[FW-B-zone-trust]add interface GigabitEthernet 1/0/1
[FW-B-zone-trust]q
[FW-B]firewall zone untrust
[FW-B-zone-untrust]add interface g1/0/0
[FW-B-zone-untrust]q
[FW-B]interface Tunnel 1
[FW-B-Tunnel1] description to_network-a
[FW-B-Tunnel1] ip address 1.1.1.2 255.255.255.0
[FW-B-Tunnel1] tunnel-protocol gre
[FW-B-Tunnel1] source 20.1.1.1
[FW-B-Tunnel1] destination 10.1.1.1
[FW-B-Tunnel1] gre key cipher 123456
[FW-B-Tunnel1] quit
[FW-B]ip route-static 0.0.0.0 0.0.0.0 20.1.1.2
[FW-B]ip route-static 172.16.10.0 24 Tunnel 1
[FW-B]firewall zone name gre
[FW-B-zone-gre] set priority 10
[FW-B-zone-gre] add interface Tunnel1
[FW-B-zone-gre] quit
[FW-B]acl number 3000
[FW-B-acl-adv-3000] rule 5 permit ip source 20.1.1.1 0 destination 10.1.1.1 0
[FW-B-acl-adv-3000]quit
[FW-B]ike proposal 10
[FW-B-ike-proposal-10] encryption-algorithm aes-256
[FW-B-ike-proposal-10] dh group18
[FW-B-ike-proposal-10] authentication-algorithm sha2-512
[FW-B-ike-proposal-10] authentication-method pre-share
[FW-B-ike-proposal-10] integrity-algorithm hmac-sha2-256
[FW-B-ike-proposal-10] prf hmac-sha2-256
[FW-B-ike-proposal-10] quit
[FW-B]ike peer fw
[FW-B-ike-peer-fw] exchange-mode main
[FW-B-ike-peer-fw] pre-shared-key huawei
[FW-B-ike-peer-fw] ike-proposal 10
[FW-B-ike-peer-fw] remote-address 10.1.1.1
[FW-B-ike-peer-fw] quit
[FW-B]ipsec proposal 10
[FW-B-ipsec-proposal-10] transform esp
[FW-B-ipsec-proposal-10] encapsulation-mode tunnel
[FW-B-ipsec-proposal-10] esp authentication-algorithm sha2-512
[FW-B-ipsec-proposal-10] esp encryption-algorithm aes-256
[FW-B-ipsec-proposal-10] quit
[FW-B]ipsec policy ipsec 1 isakmp
[FW-B-ipsec-policy-isakmp-ipsec-1] security acl 3000
[FW-B-ipsec-policy-isakmp-ipsec-1] ike-peer fw
[FW-B-ipsec-policy-isakmp-ipsec-1]
[FW-B-ipsec-policy-isakmp-ipsec-1] proposal 10
[FW-B-ipsec-policy-isakmp-ipsec-1] quit
[FW-B]interface GigabitEthernet1/0/0
[FW-B-GigabitEthernet1/0/0] ipsec policy ipsec
[FW-B-GigabitEthernet1/0/0] quit
[FW-B]security-policy
[FW-B-policy-security] rule name local_remote
[FW-B-policy-security-rule-local_remote] source-zone local
[FW-B-policy-security-rule-local_remote] destination-zone untrust
[FW-B-policy-security-rule-local_remote] source-address 20.1.1.1 0.0.0.0
[FW-B-policy-security-rule-local_remote] destination-address 10.1.1.1 0.0.0.0
[FW-B-policy-security-rule-local_remote] action permit
[FW-B-policy-security-rule-local_remote] q
[FW-B-policy-security] rule name remote_local
[FW-B-policy-security-rule-remote_local] source-zone untrust
[FW-B-policy-security-rule-remote_local] destination-zone local
[FW-B-policy-security-rule-remote_local] source-address 10.1.1.1 0.0.0.0
[FW-B-policy-security-rule-remote_local] destination-address 20.1.1.1 0.0.0.0
[FW-B-policy-security-rule-remote_local] action permit
[FW-B-policy-security-rule-remote_local] q
[FW-B-policy-security]rule name neiwang_b-neiwang_ac
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] source-zone trust
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] destination-zone gre
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] source-address 172.16.20.0 mask 255.255.255.0
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] destination-address 172.16.10.0 mask 255.255.255.0
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] action permit
[FW-B-policy-security-rule-neiwang_b-neiwang_ac] q
[FW-B-policy-security] rule name neiwang_ac-neiwang_b
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] source-zone gre
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] destination-zone trust
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] source-address 172.16.10.0 mask 255.255.255.0
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] destination-address 172.16.20.0 mask 255.255.255.0
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] action permit
[FW-B-policy-security-rule-neiwang_ac-neiwang_b] q
[FW-B-policy-security]q
抓包验证
普通gre tunnel抓取到的数据包 没有加密
Gre over ipsec 抓取到的数据包 经过加密
