一 组网说明如上图：防火墙1和防火墙2建立IPSEC vpn，使用ikev1协议，并且防火墙侧放通明细的防火墙策略二 设备配置2.1 FW1设备配置sysname FW1#ip unreachables enableip ttl-expires enable#lldp global enable#acl advanced 3000//NAT转换数据流description NATrule 0 deny ip source 192.168.10.1 0 destination 192.168.20.1 0rule 100 permit ip#acl advanced 3001//IPSEC数据流description IPSECrule 0 permit ip source 192.168.10.1 0 destination 192.168.20.1 0#interface GigabitEthernet1/0/0port link-mode routecombo enable copperip address 202.1.1.1 255.255.255.0nat outbound 3000//出接口调用nat和ipsecipsec apply policy 1#interface GigabitEthernet1/0/1port link-mode routecombo enable copperip address 192.168.1.254 255.255.255.0#ike keychain FW2//ipsec第一阶段配置pre-shared-key address 203.1.1.1 255.255.255.255 key simple 123#ike proposal 1encryption-algorithm 3des-cbcauthentication-algorithm md5#ike profile FW2keychain FW2match remote identity address 203.1.1.1 255.255.255.255proposal 1#ipsec transform-set 1//ipsec第二阶段配置esp encryption-algorithm 3des-cbcesp authentication-algorithm md5#ipsec policy 1 1 isakmptransform-set 1security acl 3001remote-address 203.1.1.1ike-profile FW2//调用ikev1-profile#security-zone name Trust//接口加入安全域import interface GigabitEthernet1/0/1#security-zone name Untrustimport interface GigabitEthernet1/0/0#ip route-static 0.0.0.0 0 202.1.1.2ip route-static 192.168.10.1 32 192.168.1.1#security-policy iprule 0 name trust-to-untrust//snat内网访问外网的策略 action pass source-zone trust destination-zone untrustrule 1 name local-to-untrust//互联网接口建立ipsec，协议ike、esp、ah等 action pass source-zone local destination-zone untrust service ike service ipsec-esp service ipsec-ahrule 2 name untrust-to-local action pass source-zone untrust destination-zone local service ike service ipsec-esp service ipsec-ahrule 3 name untrust-to-trust//配置最终业务互访策略，内网访问外网（前面rule 0已经配置），外网访问内网的rule 3策略 action pass source-zone untrust