H3C F100C防火墙配置IPSEC VPN+PPPOE.doc

[GGGXNanNing]dis cur
#
sysname GGGXNanNing
#
clock timezone beijing add 08:00:00
#
ike local-name GGGXNanNing
#
firewall packet-filter enable
firewall packet-filter default permit
#
insulate
#
dialer-rule 1 ip permit
#
firewall statistic system enable
#
DNS resolve
DNS server 219.141.136.10
DNS server 219.150.32.132
DNS server 221.5.88.88
DNS-proxy enable
#
radius scheme system
server-type extended
#
domain system
#
local-user admin
password cipher %=H"2a4C5);Q=^Q`MAF4<1!!
service-type telnet terminal
level 3
service-type ftp
local-user croco
password cipher %=H"2a4C5);Q=^Q`MAF4<1!!
service-type telnet
level 3
local-user gonggu
password simple gg2009
service-type telnet terminal
level 3
local-user libin
password cipher -[Z17,-WZX;Q=^Q`MAF4<1!!
service-type telnet
level 3
#
ike dpd 1
#
ike peer g_bjdc
exchange-mode aggressive
pre-shared-key gonggu
id-type name
remote-name bjdc
remote-address 219.141.188.57
nat traversal
dpd 1
#
ike peer g_shenzhen
exchange-mode aggressive
pre-shared-key gonggu
id-type name
remote-name shenzhen
remote-address 121.35.247.177
nat traversal
dpd 1
#
ipsec proposal esp-md5-des
#
ipsec policy ikepol 1 isakmp
security acl 3000
pfs dh-group1
ike-peer g_bjdc
proposal esp-md5-des
#
ipsec policy ikepol 2 isakmp
security acl 3001
pfs dh-group1
ike-peer g_shenzhen
proposal esp-md5-des
#
dhcp server ip-pool lan
network 10.80.151.0 mask 255.255.255.0
gateway-list 10.80.151.254
dns-list 10.2.1.1 10.2.1.2 61.139.2.69
#
acl number 3000
rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.0.0.0 0.63.255.25
5 logging
rule 20 deny ip logging
acl number 3001
rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.25
5 logging
rule 20 deny ip logging
acl number 3002
rule 10 deny ip source 10.80.151.0 0.0.0.255 destination 10.0.0.0 0.63.255.255
logging
rule 20 deny ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.255
logging
rule 30 permit ip source 10.80.151.0 0.0.0.255
#
interface Aux0
async mode flow
#
interface Dialer1
link-protocol ppp
ppp pap local-user 07715384406 password simple 11111111
mtu 1400
tcp mss 1300
ip address ppp-negotiate
dialer user fh
dialer-group 1
dialer bundle 1
nat outbound 3002
ipsec policy ikepol
#
interface Ethernet0/0
ip address 10.80.151.254 255.255.255.0
#
interface Ethernet0/1
#
interface Ethernet0/2
#
interface Ethernet0/3
#
interface Ethernet0/4
speed 10
duplex full
pppoe-client dial-bundle-number 1
mtu 1370
tcp mss 1340
ip address dhcp-alloc
#
interface Encrypt1/0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/0
set priority 85
#
firewall zone untrust
add interface Ethernet0/4
add interface Dialer1
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
ddns-server 3322.org
ddns username guangxi01
ddns password 88888888
ddns domainname guangxi01.3322.org
ddns source-interface Dialer1
#
FTP server enable
#
dhcp server forbidden-ip 10.80.151.200 10.80.151.254
#
ip route-static 0.0.0.0 0.0.0.0 Dialer 1 preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
[GGGXNanNing]

********************************************************************************

* Copyright(c) 2004-2009 Hangzhou H3C Technologies Co., Ltd. All rights reserve
d.*
* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

********************************************************************************

User interface con0 is available.

Please press ENTER.

<GGGXNanNing>
%Nov 9 17:03:55:756 2010 GGGXNanNing SHELL/4/LOGIN: Console login from con0
<GGGXNanNing>
<GGGXNanNing>
<GGGXNanNing>dis cur
#
sysname GGGXNanNing
#
clock timezone beijing add 08:00:00
#
ike local-name GGGXNanNing
#
firewall packet-filter enable
firewall packet-filter default permit
#
insulate
#
dialer-rule 1 ip permit
#
firewall statistic system enable
#
DNS resolve
DNS server 219.141.136.10
DNS server 219.150.32.132
DNS server 221.5.88.88
DNS-proxy enable
#
radius scheme system
server-type extended
#
domain system
#
local-user admin
password cipher %=H"2a4C5);Q=^Q`MAF4<1!!
service-type telnet terminal
level 3
service-type ftp
local-user croco
password cipher %=H"2a4C5);Q=^Q`MAF4<1!!
service-type telnet
level 3
local-user gonggu
password simple gg2009
service-type telnet terminal
level 3
local-user libin
password cipher -[Z17,-WZX;Q=^Q`MAF4<1!!
service-type telnet
level 3
#
ike dpd 1
#
ike peer g_bjdc
exchange-mode aggressive
pre-shared-key gonggu
id-type name
remote-name bjdc
remote-address 219.141.188.57
nat traversal
dpd 1
#
ike peer g_shenzhen
exchange-mode aggressive
pre-shared-key gonggu
id-type name
remote-name shenzhen
remote-address 121.35.247.177
nat traversal
dpd 1
#
ipsec proposal esp-md5-des
#
ipsec policy ikepol 1 isakmp
security acl 3000
pfs dh-group1
ike-peer g_bjdc
proposal esp-md5-des
#
ipsec policy ikepol 2 isakmp
security acl 3001
pfs dh-group1
ike-peer g_shenzhen
proposal esp-md5-des
#
dhcp server ip-pool lan
network 10.80.151.0 mask 255.255.255.0
gateway-list 10.80.151.254
dns-list 10.2.1.1 10.2.1.2 61.139.2.69
#
acl number 3000
rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.0.0.0 0.63.255.25
5 logging
rule 20 deny ip logging
acl number 3001
rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.25
5 logging
rule 20 deny ip logging
acl number 3002
rule 10 deny ip source 10.80.151.0 0.0.0.255 destination 10.0.0.0 0.63.255.255
logging
rule 20 deny ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.255
logging
rule 30 permit ip source 10.80.151.0 0.0.0.255
#
interface Aux0
async mode flow
#
interface Dialer1
link-protocol ppp
ppp pap local-user 07715384406 password simple 11111111
mtu 1400
tcp mss 1300
ip address ppp-negotiate
dialer user fh
dialer-group 1
dialer bundle 1
nat outbound 3002
ipsec policy ikepol
#
interface Ethernet0/0
ip address 10.80.151.254 255.255.255.0
#
interface Ethernet0/1
#
interface Ethernet0/2
#
interface Ethernet0/3
#
interface Ethernet0/4
speed 10
duplex full
pppoe-client dial-bundle-number 1
mtu 1370
tcp mss 1340
ip address dhcp-alloc
#
interface Encrypt1/0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/0
set priority 85
#
firewall zone untrust
add interface Ethernet0/4
add interface Dialer1
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
ddns-server 3322.org
ddns username guangxi01
ddns password 88888888
ddns domainname guangxi01.3322.org
ddns source-interface Dialer1
#
FTP server enable
#
dhcp server forbidden-ip 10.80.151.200 10.80.151.254
#
ip route-static 0.0.0.0 0.0.0.0 Dialer 1 preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
<GGGXNanNing>