[index] AT-AR1050V コマンドリファレンス 5.5.4
(本製品) |
(ARX640S) |
|
ISP接続用ユーザー名 | user@ispA | user@ispB |
ISP接続用パスワード | isppasswdA | isppasswdB |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 10.10.10.1/32 | 10.20.20.1/32 |
WAN側物理インターフェース | eth1 | gigabitEthernet0 |
WAN側(ppp0)IPアドレス | 10.10.10.1/32 | 10.20.20.1/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
IPsecトンネル(tunnel0)IPアドレス | 172.16.0.1/30 | 172.16.0.2/30 |
interface eth1 encapsulation ppp 0
interface ppp0 ppp ipcp dns request keepalive ip address negotiated ppp username user@ispA ppp password isppasswdA ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network lan ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address dynamic interface ppp0
application esp protocol 50
application isakmp protocol udp sport 500 dport 500
firewall rule 10 permit any from private to private rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit esp from public.wan.ppp0 to public.wan rule 60 permit esp from public.wan to public.wan.ppp0 rule 70 permit dns from public.wan.ppp0 to public.wan protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.20.20.1
interface tunnel0 ip address 172.16.0.1/30 tunnel source ppp0 tunnel destination 10.20.20.1 tunnel mode ipsec ipv4 tunnel protection ipsec ip tcp adjust-mss 1260
ip dns forwarding
ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254
end
NoteARX640Sの設定に関する詳細は、ARX640Sのドキュメントをご参照ください。
ip address-up-always
ppp profile pppoe0 my-username user@ispB password isppasswdB
interface gigabitEthernet 0 no shutdown
interface gigabitEthernet 0.1 ip address ipcp ip tcp mss auto no shutdown pppoe enable ppp bind-profile pppoe0 ip napt inside any ip traffic-filter pppoe0-in in ip traffic-filter pppoe0-out out ip ids in protect
interface vlan 1 ip address 192.168.20.1/24 no shutdown
interface tunnel 0 tunnel mode ipsec ip address 172.16.0.2/30 ip tcp mss auto no shutdown tunnel policy vpn
access-list ip extended ipsec permit ip any any
access-list ip extended pppoe0-in dynamic permit udp any interface gigabitEthernet 0.1 eq 500
access-list ip extended pppoe0-out dynamic permit ip any any
isakmp proposal isakmp encryption aes256 prf sha1 hash sha1 group 14 isakmp proposal isakmp lifetime 86400
isakmp policy vpn peer 10.10.10.1 mode ikev2 auth preshared key secret proposal isakmp keepalive enable nat-traversal enable
ipsec proposal ipsec esp encryption aes256 hash sha1 ipsec proposal ipsec lifetime 28800
ipsec policy vpn peer 10.10.10.1 access-list ipsec proposal ipsec always-up-sa
proxydns ip enable
ip route default gigabitEthernet 0.1 ip route 192.168.10.0/24 tunnel 0 ip route 192.168.10.0/24 Null 254
end
copy running-config startup-config
」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
! interface eth1 encapsulation ppp 0 ! interface ppp0 ppp ipcp dns request keepalive ip address negotiated ppp username user@ispA ppp password isppasswdA ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network lan ip subnet 192.168.10.0/24 ip subnet 192.168.20.0/24 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address dynamic interface ppp0 ! application esp protocol 50 ! application isakmp protocol udp sport 500 dport 500 ! firewall rule 10 permit any from private to private rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit esp from public.wan.ppp0 to public.wan rule 60 permit esp from public.wan to public.wan.ppp0 rule 70 permit dns from public.wan.ppp0 to public.wan protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.20.20.1 ! interface tunnel0 ip address 172.16.0.1/30 tunnel source ppp0 tunnel destination 10.20.20.1 tunnel mode ipsec ipv4 tunnel protection ipsec ip tcp adjust-mss 1260 ! ip dns forwarding ! ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254 ! end
NoteARX640Sの設定に関する詳細は、ARX640Sのドキュメントをご参照ください。
! ip address-up-always ! ppp profile pppoe0 my-username user@ispB password isppasswdB ! interface gigabitEthernet 0 no shutdown ! interface gigabitEthernet 0.1 ip address ipcp ip tcp mss auto no shutdown pppoe enable ppp bind-profile pppoe0 ip napt inside any ip traffic-filter pppoe0-in in ip traffic-filter pppoe0-out out ip ids in protect ! interface vlan 1 ip address 192.168.20.1/24 no shutdown ! interface tunnel 0 tunnel mode ipsec ip address 172.16.0.2/30 ip tcp mss auto no shutdown tunnel policy vpn ! access-list ip extended ipsec permit ip any any ! access-list ip extended pppoe0-in dynamic permit udp any interface gigabitEthernet 0.1 eq 500 ! access-list ip extended pppoe0-out dynamic permit ip any any ! isakmp proposal isakmp encryption aes256 prf sha1 hash sha1 group 14 isakmp proposal isakmp lifetime 86400 ! isakmp policy vpn peer 10.10.10.1 mode ikev2 auth preshared key secret proposal isakmp keepalive enable nat-traversal enable ! ipsec proposal ipsec esp encryption aes256 hash sha1 ipsec proposal ipsec lifetime 28800 ! ipsec policy vpn peer 10.10.10.1 access-list ipsec proposal ipsec always-up-sa ! proxydns ip enable ! ip route default gigabitEthernet 0.1 ip route 192.168.10.0/24 tunnel 0 ip route 192.168.10.0/24 Null 254 ! end
(C) 2019 - 2024 アライドテレシスホールディングス株式会社
PN: 613-002735 Rev.AD