华为USG防火墙之间做ipsecVPN

配置防火墙策略和nat策略（省.......）

USA：

acl number 3010
 rule 5 permit ip source 192.168.88.0 0.0.0.255 destination 192.168.15.0 0.0.0.255
ike proposal 11
 encryption-algorithm aes-cbc
 dh group2
#
ike peer a2
 pre-shared-key abcqwe
 ike-proposal 11
 remote-address 219.235.18.112
 ipsec proposal tran2
 esp authentication-algorithm sha1
 esp encryption-algorithm aes
 ipsec policy sec_tcslight 11 isakmp
 security acl 3010
 ike-peer a2
 proposal tran2

 配置到对端路由
 ip route-static 192.168.15.0 255.255.255.0 202.14.10.1


 配置不需要进行NAT转换
 nat-policy interzone trust untrust outbound
 policy 1
  action no-nat
  policy source 192.168.88.0 0.0.0.255
  policy destination 192.168.15.0 0.0.0.255


   WAN口应用策略
 interface Ethernet0/0/0
 alias WAN
 ip address 202.14.10.2 255.255.255.248
 ipsec policy sec_tcslight auto-neg
#

interface Vlanif1
 alias LAN
 ip address 192.168.88.1 255.255.255.0
 service-manage enable
 service-manage https permit
 service-manage ping permit
 service-manage ssh permit
 service-manage telnet permit

#

USGB:

acl number 3010
 rule 5 permit ip source 192.168.15.0 0.0.0.255 destination 192.168.88.0 0.0.0.255
#
 ike proposal 11
 encryption-algorithm aes-cbc
 dh group2
 #
ike peer c
 pre-shared-key abcqwe
ike-proposal 11                          
 remote-address 202.14.10.2 
 ipsec proposal tran1                      
 esp authentication-algorithm sha1        
 esp encryption-algorithm aes             
#                  
ipsec policy sec_tcslight 11 isakmp       
 security acl 3010                        
 ike-peer c                               
 proposal tran1 


配置到对端USG路由 
 ip route-static 192.168.88.0 255.255.255.0 219.235.18.111
 
 配置不需要进行NAT转换
 nat-policy interzone trust untrust outbound
 policy 1                                 
  action no-nat                           
  policy source 192.168.15.0 0.0.0.255    
  policy destination 192.168.88.0 0.0.0.255
  
 
 WAN口应用策略
 interface Ethernet0/0/0                   
 alias WAN                                
 ip address 219.235.18.112 255.255.255.248
 ipsec policy sec_tcslight auto-neg       
#                                    


interface Vlanif1                         
 alias LAN                                
 ip address 192.168.15.3 255.255.255.0     
 service-manage enable                    
 service-manage https permit              
 service-manage ping permit               
 service-manage ssh permit                
 service-manage telnet permit    
 
				
					执行displayike sa、display ipsec sa会显示安全联盟的建立情况