[index] AT-AR1050V コマンドリファレンス 5.5.4
ISP接続用ユーザー名 | user@isp1 |
ISP接続用パスワード | isppasswd1 |
PPPoEサービス名 | 指定なし |
WAN側IPアドレス | 10.0.0.1/32 |
WAN側物理インターフェース | eth1 |
WAN側(ppp0)IPアドレス | 10.0.0.1/32 |
LAN側(vlan1)IPアドレス | 192.168.1.1/24 |
ローカルセレクター | 192.168.1.0/24 |
リモートセレクター | 172.30.0.0/24 |
IKEバージョン | IKEv2 |
アルゴリズム | AES256 / SHA512 / Group14 |
SA有効期間 | 10時間 |
アルゴリズム | AES256 / SHA1 |
SA有効期間 | 3時間 |
PFS | Group 14 |
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.1.1/24
zone private network lan ip subnet 192.168.1.0/24 network peer ip subnet 172.30.0.0/24 network tunnel ip subnet 192.168.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1
application esp protocol 50
application isakmp protocol udp sport 500 dport 500
application nat-t protocol udp dport 4500
firewall rule 10 permit any from private to private rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit nat-t from public.wan.ppp0 to public.wan rule 60 permit nat-t from public.wan to public.wan.ppp0 rule 70 permit esp from public.wan.ppp0 to public.wan rule 80 permit esp from public.wan to public.wan.ppp0 protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.2
crypto ipsec profile ipsec1 lifetime seconds 10800 pfs 14 transform 1 protocol esp integrity SHA1 encryption AES256
crypto isakmp profile isakmp1 version 2 lifetime 36000 transform 1 integrity SHA512 encryption AES256 group 14
crypto isakmp peer address 10.0.0.2 profile isakmp1
interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.1.0/24 tunnel remote selector 172.30.0.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30
ip route 0.0.0.0/0 ppp0 ip route 172.30.0.0/24 tunnel0 ip route 172.30.0.0/24 null 254
end
copy running-config startup-config
」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
Note詳細はGoogle Cloud Platformのドキュメントをご参照ください。
! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.1.1/24 ! zone private network lan ip subnet 192.168.1.0/24 network peer ip subnet 172.30.0.0/24 network tunnel ip subnet 192.168.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1 ! application esp protocol 50 ! application isakmp protocol udp sport 500 dport 500 ! application nat-t protocol udp dport 4500 ! firewall rule 10 permit any from private to private rule 20 permit any from private to public rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit nat-t from public.wan.ppp0 to public.wan rule 60 permit nat-t from public.wan to public.wan.ppp0 rule 70 permit esp from public.wan.ppp0 to public.wan rule 80 permit esp from public.wan to public.wan.ppp0 protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.2 ! crypto ipsec profile ipsec1 lifetime seconds 10800 pfs 14 transform 1 protocol esp integrity SHA1 encryption AES256 ! crypto isakmp profile isakmp1 version 2 lifetime 36000 transform 1 integrity SHA512 encryption AES256 group 14 ! crypto isakmp peer address 10.0.0.2 profile isakmp1 ! interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.1.0/24 tunnel remote selector 172.30.0.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ! ip route 0.0.0.0/0 ppp0 ip route 172.30.0.0/24 tunnel0 ip route 172.30.0.0/24 null 254 ! end
(C) 2019 - 2024 アライドテレシスホールディングス株式会社
PN: 613-002735 Rev.AD