配置贝锐花生壳域名

技术案例重庆市酷美科技有限公司www.
corem.
com.
cn1/6华为ARG3路由DDNS+IPSECVPN配置实例(两端均为动态IP)涉及产品:华为ARG3路由器V300R001涉及技术:DDNS+IPSECVPN工程师:冉正锋E-MAIL:rzf@corem.
com.
cn一、需求如上图所示:两个局域网采用华为ARG3系列路由器通过ADSL拨号连接到Internet,总部服务器端局域网地址为192.
168.
9.
0/24,分支机构客户端局域网地址为192.
168.
10.
0/24,需要在两台AR上配置IPSEC实现互通.
二、配置思路1、服务器端申请花生壳DDNS,自动更新DNS解析.
2、客户端发起IPSEC连接.
三、配置步骤1、配置DDNS,首先在花生壳网站申请DDNS,申请方法详见官网,记下用户名、密码、域名;Username:test2013,密码tese_2013(密码不能有@),域名:test2013.
oicp.
net2、在服务器端路由器配置DDNS:脚本如下:dnsresolvednsserver61.
128.
128.
68ddnspolicyorayurloray://test2013:test_2013@phddnsdev.
oray.
net//注意用户名和密码技术案例重庆市酷美科技有限公司www.
corem.
com.
cn2/6interfaceDialer1link-protocolppppppchapusertelecomtestadslpppchappasswordcipher%$%$LSkydisddnspolicyPolicyname:orayPolicyintervaltime:3600PolicyURL:oray://test2013:test_2013@phddnsdev.
oray.
netPolicybindcount:1=====interfaceDialer1======Statuses:ESTABLISH(2)//ESTABLISH表示更新成功Refresh:enable4、配置IPSEC,服务器端采用模板方式.
配置如下:服务器端:aclnumber3002rule5denyipsource192.
168.
9.
00.
0.
0.
255destination192.
168.
10.
00.
0.
0.
255//VPN数据不进行Nat转换rule10permitipsource192.
168.
9.
00.
0.
0.
255技术案例重庆市酷美科技有限公司www.
corem.
com.
cn3/6#ipsecproposalp1//ipsec安全提议,默认即可ikepeerserverv2//IKE对等体V2pre-shared-keysimplehuaweivpn//共享密钥dpdtypeperiodic//定时DPDdpdretransmit-interval5//每隔5秒一个周期ipsecpolicy-templatetemp1ike-peerserverproposalp1#ipsecpolicypolicy9910isakmptemplatetemp#interfaceDialer1ipsecpolicypolicy99//应用Ipsec策略natoutbound3002#客户端:aclnumber3001rule5permitipsource192.
168.
10.
00.
0.
0.
255destination192.
168.
9.
00.
0.
0.
255//配置Ipsec兴趣流#aclnumber3002rule5denyipsource192.
168.
10.
00.
0.
0.
255destination192.
168.
9.
00.
0.
0.
255rule10permitipsource192.
168.
10.
00.
0.
0.
255#ipsecproposalp1#ikepeertoserverv2pre-shared-keysimplehuaweivpndpdtypeperiodicdpdretransmit-interval5技术案例重庆市酷美科技有限公司www.
corem.
com.
cn4/6remote-addresstest2013.
oicp.
net//此处为域名#ipsecpolicypolicy9910isakmpsecurityacl3001ike-peertoserverproposalp1#interfaceDialer1ipsecpolicypolicy99natoutbound3002三、验证结果1、查看IPSECSAdisipsecsaInterface:Dialer1PathMTU:1492IPSecpolicyname:"policy99"Sequencenumber:10AclGroup:3001Aclrule:5Mode:ISAKMPConnectionID:148Encapsulationmode:Tunnel技术案例重庆市酷美科技有限公司www.
corem.
com.
cn5/6Tunnellocal:113.
249.
121.
1Tunnelremote:14.
104.
236.
9Flowsource:192.
168.
10.
0/255.
255.
255.
00/0Flowdestination:192.
168.
9.
0/255.
255.
255.
00/0Qospre-classify:Disable[OutboundESPSAs]SPI:1973192363(0x759c86ab)Proposal:ESP-ENCRYPT-DES-64ESP-AUTH-MD5SAremainingkeyduration(bytes/sec):1887427558/2246Maxsentsequence-number:99UDPencapsulationusedforNATtraversal:N[InboundESPSAs]SPI:2220370819(0x84582b83)Proposal:ESP-ENCRYPT-DES-64ESP-AUTH-MD5SAremainingkeyduration(bytes/sec):1887431546/2246Maxreceivedsequence-number:80Anti-replaywindowsize:32UDPencapsulationusedforNATtraversal:N2、Ping测试ping-a192.
168.
10.
1192.
168.
9.
1PING192.
168.
9.
1:56databytes,pressCTRL_CtobreakReplyfrom192.
168.
9.
1:bytes=56Sequence=1ttl=255time=15msReplyfrom192.
168.
9.
1:bytes=56Sequence=2ttl=255time=14msReplyfrom192.
168.
9.
1:bytes=56Sequence=3ttl=255time=16msReplyfrom192.
168.
9.
1:bytes=56Sequence=4ttl=255time=17msReplyfrom192.
168.
9.
1:bytes=56Sequence=5ttl=255time=15ms---192.
168.
9.
1pingstatistics---技术案例重庆市酷美科技有限公司www.
corem.
com.
cn6/65packet(s)transmitted5packet(s)received0.
00%packetlossround-tripmin/avg/max=14/15/17ms四、配置注意事项1、NatOutbound必须将兴趣流Deny掉2、必须配置DPD,如果不配置DPD,造成一端掉线,另一端SA没有清除.