[index] AT-AR1050V コマンドリファレンス 5.5.4
Note本設定例は、IKEv1を利用したIPsec VPNの一構成例であり、YAMAHA RTXシリーズとの接続性を保証するものではありません。
Note以下に述べる手順は一例です。使用するファームウェアのバージョンなどによっては、以下の手順で接続できない可能性もあります。詳しくは、各製品のマニュアルなどをご参照ください。
(本製品) |
(RTX1210) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | LAN2 |
WAN側(ppp0)IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 0.0.0.0/0(デフォルト) | なし |
リモートセレクター | 0.0.0.0/0(デフォルト) | なし |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | 始点アドレス(デフォルト) | 始点アドレス |
SA有効期間 | ||
アルゴリズム |
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1
application esp protocol 50
application isakmp protocol udp sport 500 dport 500
firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.2
crypto ipsec profile ipsec1 lifetime seconds 3600 transform 1 protocol esp integrity SHA256 encryption AES128
crypto isakmp profile isakmp1 version 1 mode main lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2
crypto isakmp peer address 10.0.0.2 profile isakmp1
interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300
ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254
end
copy running-config startup-config
」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
NoteRTX1210の設定に関する詳細は、RTX1210のドキュメントをご参照ください。
pp select 1 pp always-on on pppoe use lan2 pp auth accept pap chap pp auth myname user@isp2 isppasswd2 ppp lcp mru on 1454 ppp ccp type none ip pp address 10.0.0.2/32 ip pp mtu 1454 ip pp secure filter in 1010 1020 1030 1040 ip pp secure filter out 3000 ip pp nat descriptor 1 pp enable 1
ip lan1 address 192.168.20.1/24
ip filter source-route on ip filter directed-broadcast on ip filter 1010 pass * 192.168.20.0/24 icmp ip filter 1020 pass 10.0.0.1 * udp * 500 ip filter 1030 pass 10.0.0.1 * esp ip filter 1040 pass 10.0.0.1 * udp * 4500 ip filter 3000 pass * *
nat descriptor type 1 masquerade nat descriptor address outer 1 10.0.0.2 nat descriptor address inner 1 10.0.0.2 192.168.20.1-192.168.20.254 nat descriptor masquerade static 1 1 10.0.0.2 udp 500 nat descriptor masquerade static 1 2 10.0.0.2 esp nat descriptor masquerade static 1 3 10.0.0.2 udp 4500
tunnel select 1 ipsec tunnel 101 ipsec sa policy 101 1 esp aes-cbc sha256-hmac ipsec ike duration ipsec-sa 1 3600 ipsec ike duration isakmp-sa 1 3600 ipsec ike encryption 1 aes-cbc ipsec ike group 1 modp1024 ipsec ike hash 1 sha256 ipsec ike keepalive use 1 on dpd ipsec ike local address 1 10.0.0.2 ipsec ike local id 1 0.0.0.0/0 ipsec ike nat-traversal 1 on ipsec ike pre-shared-key 1 text secret ipsec ike remote address 1 10.0.0.1 ipsec ike remote id 1 0.0.0.0/0 tunnel enable 1 ipsec auto refresh on
ip route default gateway pp 1 ip route 192.168.10.0/24 gateway tunnel 1
! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1 ! application esp protocol 50 ! application isakmp protocol udp sport 500 dport 500 ! firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.2 ! crypto ipsec profile ipsec1 lifetime seconds 3600 transform 1 protocol esp integrity SHA256 encryption AES128 ! crypto isakmp profile isakmp1 version 1 mode main lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2 ! crypto isakmp peer address 10.0.0.2 profile isakmp1 ! interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300 ! ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254 ! end
(本製品) |
(RTX1210) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 動的割り当て(IPCP) | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | LAN2 |
WAN側(ppp0)IPアドレス | 接続時にISPから取得 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 192.168.10.0/24 | なし |
リモートセレクター | 192.168.20.0/24 | なし |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | client | 始点アドレス |
SA有効期間 | ||
アルゴリズム |
crypto isakmp profile isakmp1 version 1 mode aggressive lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2
interface tunnel0 tunnel source ppp0 tunnel local name client tunnel local selector 192.168.10.0/24 tunnel remote selector 192.168.20.0/24
pp select 1 ppp ipv6cp use off
ipsec sa policy 101 1 local-id=192.168.20.0/24 remote-id=192.168.10.0/24
ipsec ike payload type 1 3
ipsec ike remote address 1 any
ip filter 1020 pass * * udp * 500 ip filter 1030 pass * * esp ip filter 1040 pass * * udp * 4500
(C) 2019 - 2024 アライドテレシスホールディングス株式会社
PN: 613-002735 Rev.AD