华三H3C防火墙配置IPSEC详细配置：

一、网络拓扑：

二、R1配置

[R1]dis cur
#
 version 7.1.064, Release 0427P22
#
 sysname R1
#
interface GigabitEthernet0/1
 ip address 1.1.1.2 255.255.255.252
#
interface GigabitEthernet0/2
 ip address 2.2.2.1 255.255.255.252
#
 ip route-static 172.16.0.0 16 2.2.2.2	#ipsec vpn非必要
 ip route-static 192.168.0.0 16 1.1.1.1	#ipsec vpn非必要
#

三、FW1防火墙配置

[FW1]dis cur
#
 version 7.1.064, Alpha 7164
#
 sysname FW1
#
ospf 1 router-id 3.3.3.3	#ospf路由协议
 default-route-advertise		#把静态默认路由推到ospf中，ipsec用的默认路由
 area 0.0.0.0
  network 192.168.70.2 0.0.0.0
  network 192.168.80.2 0.0.0.0
 area 0.0.0.3
  network 192.168.150.0 0.0.0.255
#
object-group service icmp	#创建服务组用于防火墙放行ping命令（测试用）
 0 service icmp 0	#Echo Reply（应答） 允许ping应答
 10 service icmp 8	#Echo Request（请求）允许ping请求
#
interface GigabitEthernet1/0/2
 ip address 192.168.80.2 255.255.255.252
#
interface GigabitEthernet1/0/3
 ip address 192.168.150.254 255.255.255.0
#
interface GigabitEthernet1/0/4
 ip address 192.168.70.2 255.255.255.252
#
interface GigabitEthernet1/0/23	#nat和ipsec应用在对外接口
 ip address 1.1.1.1 255.255.255.252
nat outbound 3000
 ipsec apply policy h3c
#
security-zone name Trust
 import interface GigabitEthernet1/0/2
 import interface GigabitEthernet1/0/4
#
security-zone name DMZ
 import interface GigabitEthernet1/0/3
#
security-zone name Untrust
 import interface GigabitEthernet1/0/23
#
 ip route-static 0.0.0.0 0 1.1.1.2	#默认路由对外访问
 ip route-static 172.16.0.0 16 GigabitEthernet1/0/23 1.1.1.2	#ipsecVPN用出口路由
#
acl advanced 3000	#nat转换规则
 rule 0 deny ip source 192.168.200.0 0.0.0.255 destination 172.16.0.0 0.0.255.255（拒绝无线网络的流量走ipsec vpn去172.16.0.0网段）
 rule 5 deny ip destination 172.16.0.0 0.0.255.255（走ipsec vpn去172.16网段的流量不通过nat转换）
 rule 10 permit ip（允许其他流量nat转换）
#
acl advanced 3101	#规则用于ipsec vnp使用，控制源和目的可用访问的网段，
 rule 0 permit ip source 192.168.0.0 0.0.255.255 destination 172.16.0.0 0.0.255.255	#通过acl规则控制允许192.168.0.0/16去往172.16.0.0/16网段，
例子：source 192.168.20.0 0.0.0.255 des 172.16.10.0 0.0.0.255 只让192.168.20网段去访问172.16.10网段。
#
ipsec transform-set h3c	#ipsec提议
 esp encryption-algorithm aes-cbc-128
 esp authentication-algorithm sha256
#
ipsec policy h3c 1 isakmp	#ipsec策略
 transform-set h3c	#应用ipse提议
 security acl 3101	#应用acl控制访问（也可通过防火墙对外访问策略控制：trust to untrust）
 local-address 1.1.1.1
 remote-address 2.2.2.2
 ike-profile h3c	#应用ike-profile安全参数
#
ike profile h3c	#ike sa的安全参数
 keychain h3c
 match remote identity address 2.2.2.2 255.255.255.252
 proposal 10
#
ike proposal 10	#ike提议
 encryption-algorithm aes-cbc-128
 dh group14
 authentication-algorithm sha256
#
ike keychain h3c	#ike预共享密钥
 pre-shared-key address 2.2.2.2 255.255.255.252 key simpl h3c123
#

security-policy ip
 rule 0 name ospf	#允许local和trust互通，防火墙和本地互访。
  action pass
  source-zone trust
  destination-zone local
  source-zone local
  destination-zone trust
  service ospf		#仅允许ospf、icmp（icmp用来让主机ping的）通过
  service icmp

 rule 2 name t2u	#让trust去往untrust，内网对外访问。
  action pass
  source-zone trust
  destination-zone untrust

 rule 3 name ipsec	#防火墙允许ipsecVPN local和untrust区域互访，让两防火墙的对外接口允许ipsecvpn互访。
  action pass
  source-zone local
  source-zone untrust
  destination-zone untrust
  destination-zone local
  source-ip-host 1.1.1.1
  source-ip-host 2.2.2.2
  destination-ip-host 1.1.1.1
  destination-ip-host 2.2.2.2

 rule 4 name u2t	#规则允许untrust区域可以访问trust区域，用于让远端172.16.0.0网段区访问本端192.168.0.0网段
  action pass
  source-zone untrust
  destination-zone trust
  source-ip-subnet 172.16.10.0 255.255.255.0	#控制只让172.16.10.0网段的地址访问192.168.0.0网段，172.16.20、30、40网段访问不了。
  destination-ip-subnet 192.168.10.0 255.255.255.0	#控制只让172.16.10.0网段的地址访问192.168.10.0网段192.168.20、30网段访问不了。
#
[FW1]dis ike sa
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
 ID       Profile   Remote               Flag     Remote-Type    Remote-ID
--------------------------------------------------------------------------------
 1        h3c       2.2.2.2              RD       IPV4_ADDR      2.2.2.2 
[FW1]dis ipsec sa
-------------------------------
Interface: GigabitEthernet1/0/23
-------------------------------

  -----------------------------
  IPsec policy: h3c
  Sequence number: 1
  Alias: h3c-1
  Mode: ISAKMP
  -----------------------------
    Tunnel id: 0
    Encapsulation mode: tunnel
    Perfect Forward Secrecy:
    Inside VPN:
    Extended Sequence Numbers enable: N
    Traffic Flow Confidentiality enable: N
    Transmitting entity: Initiator
    Path MTU: 1424
    Tunnel:
        local  address/port: 1.1.1.1/500
        remote address/port: 2.2.2.2/500
    Flow:
        sour addr: 192.168.0.0/255.255.0.0  port: 0  protocol: ip
        dest addr: 172.16.0.0/255.255.0.0  port: 0  protocol: ip

    [Inbound ESP SAs]
      SPI: 1533752099 (0x5b6b3323)
      Connection ID: 4294967296
      Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA256
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/3591
      Max received sequence-number: 4
      Anti-replay check enable: Y
      Anti-replay window size: 64
      UDP encapsulation used for NAT traversal: N
      Status: Active

    [Outbound ESP SAs]
      SPI: 3908749717 (0xe8fac995)
      Connection ID: 4294967297
      Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA256
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/3591
      Max sent sequence-number: 4
      UDP encapsulation used for NAT traversal: N
      Status: Active

四、FW2防火墙配置

[FW2]dis cur
#
 version 7.1.064, Alpha 7164
#
 sysname FW2
#
object-group service icmp
 0 service icmp 0
 10 service icmp 8
#
interface GigabitEthernet1/0/1
 ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/2
 ip address 172.16.50.2 255.255.255.252
#
interface GigabitEthernet1/0/23
 ip address 2.2.2.2 255.255.255.252
 nat outbound 3000
 ipsec apply policy h3c
#
security-zone name Trust
 import interface GigabitEthernet1/0/2
#
security-zone name Untrust
 import interface GigabitEthernet1/0/23
#
 ip route-static 0.0.0.0 0 2.2.2.1	#对外路由
 ip route-static 172.16.0.0 16 172.16.50.1	#对内路由
 ip route-static 192.168.0.0 16 GigabitEthernet1/0/23 2.2.2.1	#ipsec vpn路由
#
acl advanced 3000
 rule 5 deny ip destination 192.168.0.0 0.0.255.255	#目的前往192.168.0.0网段的都通过nat
 rule 10 permit ip
#
acl advanced 3101
 rule 0 permit ip source 172.16.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255
#
ipsec transform-set h3c
 esp encryption-algorithm aes-cbc-128
 esp authentication-algorithm sha256
#
ipsec policy h3c 1 isakmp
 transform-set h3c
 security acl 3101
 local-address 2.2.2.2
 remote-address 1.1.1.1
 ike-profile h3c
#
ike profile h3c
 keychain h3c
 match remote identity address 1.1.1.1 255.255.255.252
 proposal 1
#
ike proposal 1
 encryption-algorithm aes-cbc-128
 dh group14
 authentication-algorithm sha256
#
ike keychain h3c
 pre-shared-key address 1.1.1.1 255.255.255.252 key simple h3c123
#
security-policy ip
 rule 0 name trust2untrust
  action pass
  source-zone trust
  destination-zone untrust
 rule 1 name trust2loacl
  action pass
  source-zone trust
  destination-zone local
  source-zone local
  destination-zone trust 
 rule 3 name ipsec
  action pass
  source-zone local
  source-zone untrust
  destination-zone untrust
  destination-zone local
  source-ip-host 1.1.1.1
  source-ip-host 2.2.2.2
  destination-ip-host 1.1.1.1
  destination-ip-host 2.2.2.2
 rule 4 name u2t
  action pass
  source-zone untrust
  destination-zone trust
#
[FW2]dis ike sa
    Connection-ID   Remote                Flag         DOI
------------------------------------------------------------------
    1               1.1.1.1/500           RD           IPsec
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
[FW2]dis ipsec sa
-------------------------------
Interface: GigabitEthernet1/0/23
-------------------------------

  -----------------------------
  IPsec policy: h3c
  Sequence number: 1
  Mode: ISAKMP
  -----------------------------
    Tunnel id: 0
    Encapsulation mode: tunnel
    Perfect Forward Secrecy:
    Inside VPN:
    Extended Sequence Numbers enable: N
    Traffic Flow Confidentiality enable: N
    Transmitting entity: Responder
    Path MTU: 1424
    Tunnel:
        local  address: 2.2.2.2
        remote address: 1.1.1.1
    Flow:
        sour addr: 172.16.0.0/255.255.0.0  port: 0  protocol: ip
        dest addr: 192.168.0.0/255.255.0.0  port: 0  protocol: ip

    [Inbound ESP SAs]
      SPI: 3908749717 (0xe8fac995)
      Connection ID: 4294967296
      Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA256
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/3564
      Max received sequence-number: 4
      Anti-replay check enable: Y
      Anti-replay window size: 64
      UDP encapsulation used for NAT traversal: N
      Status: Active

    [Outbound ESP SAs]
      SPI: 1533752099 (0x5b6b3323)
      Connection ID: 4294967297
      Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA256
      SA duration (kilobytes/sec): 1843200/3600
      SA remaining duration (kilobytes/sec): 1843199/3564
      Max sent sequence-number: 4
      UDP encapsulation used for NAT traversal: N
      Status: Active