ipsec两端内网同网段实现访问（本端进行源网段转换）
1.组网
2.需求
客户两端的内网网段一样，并且由于某些原因无法更改内网网段，现在需要通过ipsec VPN实现A端设备10.1.1.2要能访问对端内网的10.1.1.3，并不要求对端能访问自己。
配置思路：
由于两端内网一样，互访的流量根本不会到达防火墙上面，从而无法触发ipsec隧道建立，所以需要在A端防火墙的入接口上面配置源和目的地址转换，将本端的内网转换成别的网段，同时为了使ping对端内网的流量到达防火墙，需要在入接口上做一个目的地址转换,先用别的IP来代替对端的ip，在防火墙上为了让流量从出接口出去，入接口上还需要配置PBR。
3.关键配置
FWA
#
nat address-group 0
address 10.1.2.1 10.1.2.1
#
policy-based-route huqi permit node 0
if-match acl 3003
apply next-hop 2.2.2.2
#
interface GigabitEthernet1/0/1
description LAN
port link-mode route
combo enable copper
ip address 10.1.1.1 255.255.255.0
nat inbound 3002 address-group 0
nat server global 10.1.3.1 inside 10.1.1.3
//将流量从外网口扔出去，不然做完转换后会发到内网，无法触发隧道建立
ip policy-based-route huqi
#
interface GigabitEthernet1/0/2
description WAN
port link-mode route
combo enable copper
ip address 2.2.2.1 255.255.255.0
nat outbound 3001
ipsec apply policy map1
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
#
ip route-static 0.0.0.0 0 2.2.2.2
//将返回的流量扔到内网，用来触发在内网接口进行源和目的地址转换
ip route-static 10.1.2.0 24 10.1.1.2
#
acl advanced 3000
rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
acl advanced 3001
rule 0 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
rule 5 permit ip
#
acl advanced 3002
rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.3.0 0.0.0.255
#
acl advanced 3003
rule 0 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
ipsec transform-set tran1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#
ipsec policy map1 10 isakmp
transform-set tran1
security acl 3000
remote-address 2.2.3.1
ike-profile profile1
#
ike logging negotiation enable
#
ike profile profile1
keychain keychain1
local-identity address 2.2.2.1
match remote identity address 2.2.3.1 255.255.255.255
proposal 1
#
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
#
ike keychain keychain1
pre-shared-key address 2.2.3.1 255.255.255.0 key cipher $c$3$LXO7Pf3k1FxL1jfkO3moC7K747FDXR8fSg==
#
security-policy ip
rule 0 name AllPass
action pass
#
Return
FWB
#
interface GigabitEthernet1/0/1
description LAN
port link-mode route
combo enable copper
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/2
description WAN
port link-mode route
combo enable copper
ip address 2.2.3.1 255.255.255.0
nat outbound 3001
ipsec apply policy use1
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
#
ip route-static 0.0.0.0 0 2.2.3.2
#
acl advanced 3000
rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
#
acl advanced 3001
rule 0 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
rule 5 permit
#
ipsec transform-set tran1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#
ipsec policy use1 10 isakmp
transform-set tran1
security acl 3000
local-address 2.2.3.1
remote-address 2.2.2.1
ike-profile profile1
#
ike profile profile1
keychain keychain1
local-identity address 2.2.3.1
match remote identity address 2.2.2.1 255.255.255.255
proposal 1
#
ike proposal 1
encryption-algorithm 3des-cbc
authentication-algorithm md5
#
ike keychain keychain1
pre-shared-key address 2.2.2.1 255.255.255.0 key cipher $c$3$ENS6gWDmdnktKQfRKaaMhCy7tBTExUQLzA==
#
security-policy ip
rule 0 name allpass
action pass
#
return
4.测试
A端可以访问B端
在A端查看：
[H3C]dis ike sa
Connection-ID Remote Flag DOI
------------------------------------------------------------------
1 2.2.3.1 RD IPsec
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
[H3C]dis ipsec sa
-------------------------------
Interface: GigabitEthernet1/0/2
-------------------------------
-----------------------------
IPsec policy: map1
Sequence number: 10
Mode: ISAKMP
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect Forward Secrecy:
Inside VPN:
Extended Sequence Numbers enable: N
Traffic Flow Confidentiality enable: N
Path MTU: 1444
Tunnel:
local address: 2.2.2.1
remote address: 2.2.3.1
Flow:
sour addr: 10.1.2.0/255.255.255.0 port: 0 protocol: ip
dest addr: 10.1.1.0/255.255.255.0 port: 0 protocol: ip
[Inbound ESP SAs]
SPI: 906099782 (0x3601fc46)
Connection ID: 4294967296
Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843196/1681
Max received sequence-number: 37
Anti-replay check enable: Y
Anti-replay window size: 64
UDP encapsulation used for NAT traversal: N
Status: Active
[Outbound ESP SAs]
SPI: 446997740 (0x1aa4a4ec)
Connection ID: 4294967297
Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5
SA duration (kilobytes/sec): 1843200/3600
SA remaining duration (kilobytes/sec): 1843197/1681
Max sent sequence-number: 24
UDP encapsulation used for NAT traversal: N
Status: Active
Ipsec建立过程中防火墙的debug信息：
<H3C>*Dec 24 19:34:31:636 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;
Receiving, interface = GigabitEthernet1/0/1
version = 4, headlen = 20, tos = 0
pktlen = 84, pktid = 48, offset = 0, ttl = 255, protocol = 1
checksum = 41844, s = 10.1.1.2, d = 10.1.3.1
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Receiving IP packet from interface GigabitEthernet1/0/1.
Payload: ICMP
type = 8, code = 0, checksum = 0x151c.
//先在内网接口进行源地址和目的地址的转换
*Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP
10.1.1.2: 176 - 10.1.3.1: 2048(VPN: 0) ------>
10.1.2.1: 23 - 10.1.3.1: 2048(VPN: 0)
*Dec 24 19:34:31:636 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP
10.1.2.1: 23 - 10.1.3.1: 2048(VPN: 0) ------>
10.1.2.1: 23 - 10.1.1.3: 2048(VPN: 0)
//转换完成匹配PBR，将流量扔到公网
*Dec 24 19:34:31:636 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; Policy: huqi, Node: 0, match succeeded.
*Dec 24 19:34:31:637 2019 H3C PBR4/7/PBR Forward Info: -COntext=1; apply next-hop 2.2.2.2.
*Dec 24 19:34:31:637 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;
Sending, interface = GigabitEthernet1/0/2
version = 4, headlen = 20, tos = 252
pktlen = 224, pktid = 52, offset = 0, ttl = 255, protocol = 17
checksum = 45271, s = 2.2.2.1, d = 2.2.3.1
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
//触发ipsec协商
prompt: Sending IP packet from local at interface GigabitEthernet1/0/2.
Payload: UDP
source port = 500, destination port = 500
checksum = 0x0f40, length = 204.
//收到对端的回包
*Dec 24 19:34:31:639 2019 H3C IPFW/7/IPFW_PACKET: -COntext=1;
Receiving, interface = GigabitEthernet1/0/2
version = 4, headlen = 20, tos = 252
pktlen = 164, pktid = 64, offset = 0, ttl = 254, protocol = 17
checksum = 45575, s = 2.2.3.1, d = 2.2.2.1
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
prompt: Receiving IP packet from interface GigabitEthernet1/0/2.
Payload: UDP
source port = 500, destination port = 500
checksum = 0xf4cb, length = 144.
…(后面的协商过程的debug信息省略)
隧道建立后ping对端内网的NAT转换信息：
[H3C]*Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP
10.1.1.2: 173 - 10.1.3.1: 2048(VPN: 0) ------>
10.1.2.1: 20 - 10.1.3.1: 2048(VPN: 0)
*Dec 24 19:21:12:931 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP
10.1.2.1: 20 - 10.1.3.1: 2048(VPN: 0) ------>
10.1.2.1: 20 - 10.1.1.3: 2048(VPN: 0)
//要写这条路由ip route-static 10.1.2.0 24 10.1.1.2，才会进行下面的转换
*Dec 24 19:21:12:934 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP
10.1.1.3: 20 - 10.1.2.1: 0(VPN: 0) ------>
10.1.3.1: 173 - 10.1.2.1: 0(VPN: 0)
*Dec 24 19:21:12:935 2019 H3C NAT/7/COMMON: -COntext=1;
PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP
10.1.3.1: 173 - 10.1.2.1: 0(VPN: 0) ------>
10.1.3.1: 173 - 10.1.1.2: 0(VPN: 0)
5.总结
1实际测试对端无法通过10.1.2.1这个地址访问过来。
2. ip route-static 10.1.2.0 24 10.1.1.2 这条路由一定要写，目的是为了让返回的流量在内网接口上面匹配会话做源和目的转换。