[index] AT-AR1050V コマンドリファレンス 5.5.4
Note本設定例は、IKEv1を利用したIPsec VPNの一構成例であり、NEC IXシリーズとの接続性を保証するものではありません。
Note以下に述べる手順は一例です。使用するファームウェアのバージョンなどによっては、以下の手順で接続できない可能性もあります。詳しくは、各製品のマニュアルなどをご参照ください。
(本製品) |
(IX2215) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | GigaEthernet0 |
WAN側(ppp0)IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 192.168.10.0/24 | 192.168.20.0/24 |
リモートセレクター | 192.168.20.0/24 | 192.168.10.0/24 |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | 始点アドレス(デフォルト) | 始点アドレス |
SA有効期間 | ||
アルゴリズム |
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1
application esp protocol 50
application isakmp protocol udp sport 500 dport 500
firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.2
crypto ipsec profile ipsec1 lifetime seconds 3600 transform 1 protocol esp integrity SHA256 encryption AES128
crypto isakmp profile isakmp1 version 1 mode main lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2
crypto isakmp peer address 10.0.0.2 profile isakmp1
interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.10.0/24 tunnel remote selector 192.168.20.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300
ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254
end
copy running-config startup-config
」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
NoteIX2215の設定に関する詳細は、IX2215のドキュメントをご参照ください。
ppp profile ppp authentication myname user@isp2 authentication password user@isp2 isppasswd2
interface GigaEthernet0.1 encapsulation pppoe auto-connect ppp binding ppp ip address 10.0.0.2/32 ip tcp adjust-mss auto ip napt enable ip napt static GigaEthernet0.1 udp 500 ip napt static GigaEthernet0.1 50 no shutdown
interface GigaEthernet2.0 ip address 192.168.20.1/24 no shutdown
ip access-list sec-list permit ip src any dest any
ike proposal ike-prop encryption aes hash sha2-256 group 1024-bit lifetime 3600 ike policy ike-policy peer 10.0.0.1 key secret ike-prop
ipsec autokey-proposal ipsec-prop esp-aes esp-sha2-256 lifetime time 3600 ipsec autokey-map ipsec-policy sec-list peer 10.0.0.1 ipsec-prop ipsec local-id ipsec-policy 192.168.20.0/24 ipsec remote-id ipsec-policy 192.168.10.0/24
interface Tunnel0.0 tunnel mode ipsec ip unnumbered GigaEthernet2.0 ip tcp adjust-mss auto ipsec policy tunnel ipsec-policy out no shutdown
ip ufs-cache enable
ip route default GigaEthernet0.1 ip route 192.168.10.0/24 Tunnel0.
! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1 ! application esp protocol 50 ! application isakmp protocol udp sport 500 dport 500 ! firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.2 ! crypto ipsec profile ipsec1 lifetime seconds 3600 transform 1 protocol esp integrity SHA256 encryption AES128 ! crypto isakmp profile isakmp1 version 1 mode main lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2 ! crypto isakmp peer address 10.0.0.2 profile isakmp1 ! interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.10.0/24 tunnel remote selector 192.168.20.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300 ! ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254 ! end
(本製品) |
(IX2215) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 動的割り当て(IPCP) | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | GigaEthernet0 |
WAN側(ppp0)IPアドレス | 接続時にISPから取得 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 192.168.10.0/24 | 192.168.20.0/24 |
リモートセレクター | 192.168.20.0/24 | 192.168.10.0/24 |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | client | 始点アドレス |
SA有効期間 | ||
アルゴリズム |
crypto isakmp profile isakmp1 version 1 mode aggressive lifetime 3600 transform 1 integrity SHA256 encryption AES128 group 2
interface tunnel0 tunnel source ppp0 tunnel local name client
ike policy ike-policy peer any key secret mode aggressive ike-prop ike keepalive ike-policy 10 3 ike remote-id ike-policy fqdn client
ipsec dynamic-map dyna-map sec-list ipsec-prop ike ike-policy
interface Tunnel0.0 ipsec policy tunnel dyna-map out
(C) 2019 - 2024 アライドテレシスホールディングス株式会社
PN: 613-002735 Rev.AD