MSR係列路由器IPsec over GRE + OSPF功能的配置舉例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Copyright © 2014杭州華三通信技術有限公司 版權所有，保留一切權利。 非經本公司書麵許可，任何單位和個人不得擅自摘抄、複製本文檔內容的部分或全部， 並不得以任何形式傳播。本文檔中的信息可能變動，恕不另行通知。

 

目  錄

1 簡介

2 配置前提

3 配置舉例

3.1 組網需求

3.2 配置思路

3.3 使用版本

3.4 配置注意事項

3.5 配置步驟

3.5.1 Router A的配置

3.5.2 Router B的配置

3.5.3 Router C的配置

3.6 驗證配置

3.7 配置文件

4 相關資料

 

1  簡介

本文檔介紹MSR路由器IPsec over GRE + OSPF功能的典型配置舉例。

2  配置前提

本文檔不嚴格與具體軟、硬件版本對應，如果使用過程中與產品實際情況有差異，請參考相關產品手冊，或以設備實際情況為準。

本文檔中的配置均是在實驗室環境下進行的配置和驗證，配置前設備的所有參數均采用出廠時的缺省配置。如果您已經對設備進行了配置，為了保證配置效果，請確認現有配置和以下舉例中的配置不衝突。

本文檔假設您已了解IPsec、GRE和OSPF特性。

3  配置舉例

3.1  組網需求

如圖1所示，Router A為某機構總部網關，Router B和Router C為分支網關，要求：

·     總部和分支之間建立GRE隧道。

·     總部和分支之間實現內網的互通。

·     運用IPsec技術對總部和分支內網之間指定的流量進行加密。

圖1 MSR路由器IPsec over GRE + OSPF功能的配置組網圖

 

設備	接口	IP地址	設備	接口	IP地址
Router A	Eth0/0	1.0.0.254/24	Router C	Eth0/0	1.0.0.2/24
	Eth0/1	10.0.0.1/24		Eth0/1	192.168.2.1
	Loop0	192.168.255.255/32		Loop0	192.168.255.2/32
Router B	Eth0/0	1.0.0.1/24
	Eth0/1	192.168.1.1/24
	Loop0	192.168.255.1/32

 

3.2  配置思路

·     將GRE隧道與OSPF結合使用，可以通過GRE來傳遞OSPF路由，從而使企業私網之間可以互通。

·     將IPsec與GRE結合使用，可以對通過GRE隧道的路由即企業私網間的通信進行保護。

·     將ACL中源、目的IP地址與建立GRE隧道的源、目的IP地址配置不相同，並將策略應用在隧道接口下，可以對通過GRE隧道的部分數據流進行保護。

3.3  使用版本

本舉例是在Release 2317版本上進行配置和驗證的。

3.4  配置注意事項

·     要將所有的IPsec策略都綁定在對應的GRE接口上；

·     所有的出接口Ethernet0/0都不使能OSPF，且必須保證總部和分支出接口能互通；

·     ACL一定不要最後添加一條deny ip的規則，該配置會導致不需要加密的流量被丟棄。

3.5  配置步驟

3.5.1  Router A的配置

# 配置接口Ethernet0/1的IP地址。

<RouterA> system-view

[RouterA] interface ethernet 0/1

[RouterA-Ethernet0/1] ip address 10.0.0.1 255.255.255.0

[RouterA-Ethernet0/1] quit

# 配置接口Ethernet0/0的IP地址。

[RouterA] interface ethernet 0/0

[RouterA-Ethernet0/0] ip address 1.0.0.254 255.255.255.0

[RouterA-Ethernet0/0] quit

# 配置OSPF Router ID的Loopback接口地址。

[RouterA] interface loopback 0

[RouterA-LoopBack0] ip address 192.168.255.255 255.255.255.255

[RouterA-LoopBack0] quit

# 配置到branch1的GRE隧道。

[RouterA] interface tunnel 0

[RouterA-Tunnel0] ip address 192.168.0.1 255.255.255.252

[RouterA-Tunnel0] source ethernet 0/0

[RouterA-Tunnel0] destination 1.0.0.1

[RouterA-Tunnel0] quit

# 配置到branch2的GRE隧道。

[RouterA] interface tunnel 1

[RouterA-Tunnel1] ip address 192.168.0.5 255.255.255.252

[RouterA-Tunnel1] source ethernet 0/0

[RouterA-Tunnel1] destination 1.0.0.2

[RouterA-Tunnel1] quit

# 配置OSPF路由協議。

[RouterA] router id 192.168.255.255

[RouterA] ospf 1

[RouterA-ospf-1] area 0

[RouterA-ospf-1-area-0.0.0.0] network 10.0.0.0 0.0.0.255

[RouterA-ospf-1-area-0.0.0.0] network 192.168.255.255 0.0.0.0

[RouterA-ospf-1-area-0.0.0.0] network 192.168.0.0 0.0.0.3

[RouterA-ospf-1-area-0.0.0.0] network 192.168.0.4 0.0.0.3

[RouterA-ospf-1-area-0.0.0.0] quit

# 創建ACL3000,定義與branch1之間需要IPsec保護的數據流。

[RouterA] acl number 3000

[RouterA-acl-adv-3000] rule 0 permit ip source 10.0.0.0 0.255.255.255 destination

 192.168.1.0 0.0.0.255

[RouterA-acl-adv-3000] quit

# 創建ACL3001,定義與branch2之間需要IPsec保護的數據流。

[RouterA] acl number 3001

[RouterA-acl-adv-3001] rule 0 permit ip source 10.0.0.0 0.255.255.255 destination

 192.168.2.0 0.0.0.255

[RouterA-acl-adv-3001] quit

# 配置IKE對等體branch1。

[RouterA] ike peer branch1

[RouterA-ike-peer-branch1] pre-shared-key 123

[RouterA-ike-peer-branch1] remote-address 192.168.0.2

[RouterA-ike-peer-branch1] quit

# 配置IKE對等體branch2。

[RouterA] ike peer branch2

[RouterA-ike-peer-branch2] pre-shared-key 123

[RouterA-ike-peer-branch2] remote-address 192.168.0.6

[RouterA-ike-peer-branch2] quit

# 采用安全提議的缺省配置。

[RouterA] ipsec transform-set def

# 配置ESP協議采用md5認證算法。

[RouterA-ipsec-transform-set-def] esp authentication-algorithm md5

[RouterA-ipsec-transform-set-def] quit

# 創建IPsec安全策略branch1，其協商方式為isakmp。

[RouterA] ipsec policy branch1 1 isakmp

[RouterA-ipsec-policy-isakmp-branch1-1] security acl 3000

[RouterA-ipsec-policy-isakmp-branch1-1] ike-peer branch1

[RouterA-ipsec-policy-isakmp-branch1-1] transform-set def

[RouterA-ipsec-policy-isakmp-branch1-1] quit

# 創建IPsec安全策略branch2，其協商方式為isakmp。

[RouterA] ipsec policy branch2 1 isakmp

[RouterA-ipsec-policy-isakmp-branch2-1] security acl 3001

[RouterA-ipsec-policy-isakmp-branch2-1] ike-peer branch2

[RouterA-ipsec-policy-isakmp-branch2-1] transform-set def

[RouterA-ipsec-policy-isakmp-branch2-1] quit

# 在GRE接口上應用安全策略。

[RouterA] interface tunnel 0

[RouterA-Tunnel0] ipsec policy branch1

[RouterA-Tunnel0] quit

[RouterA] interface tunnel 1

[RouterA-Tunnel1] ipsec policy branch2

[RouterA-Tunnel1] quit

3.5.2  Router B的配置

# 配置接口Ethernet0/1的IP地址。

<RouterB> system-view

[RouterB] interface ethernet 0/1

[RouterB-Ethernet0/1] ip address 192.168.1.1 255.255.255.0

[RouterB-Ethernet0/1] quit

# 配置接口Ethernet0/0的IP地址。

[RouterB]interface ethernet 0/0

[RouterB-Ethernet0/0] ip address 1.0.0.1 255.255.255.0

[RouterB-Ethernet0/0] quit

# 配置OSPF Router ID的Loopback接口地址。

[RouterB] interface loopback 0

[RouterB-LoopBack0] ip address 192.168.255.1 255.255.255.255

[RouterB-LoopBack0] quit

# 配置到center的GRE隧道。

[RouterB] interface tunnel 0

[RouterB-Tunnel0] ip address 192.168.0.2 255.255.255.252

[RouterB-Tunnel0] source ethernet 0/0

[RouterB-Tunnel0] destination 1.0.0.254

[RouterB-Tunnel0] quit

# 配置OSPF路由協議。

[RouterB] router id 192.168.255.1

[RouterB] ospf 1

[RouterB-ospf-1] area 0

[RouterB-ospf-1-area-0.0.0.0] network 192.168.255.1 0.0.0.0

[RouterB-ospf-1-area-0.0.0.0] network 192.168.0.0 0.0.0.3

[RouterB-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255

[RouterB-ospf-1-area-0.0.0.0] quit

# 創建ACL3000,定義需要IPsec保護的數據流。

[RouterB] acl number 3000

[RouterB-acl-adv-3000] rule 0 permit ip source 192.168.1.0 0.0.0.255 destination

10.0.0.0 0.0.0.255

[RouterB-acl-adv-3000] quit

# 配置IKE對等體center。

[RouterB] ike peer center

[RouterB-ike-peer-center] pre-shared-key 123

[RouterB-ike-peer-center] remote-address 192.168.0.1

[RouterB-ike-peer-center] quit

# 采用安全提議的缺省配置。

[RouterB] ipsec transform-set def

# 配置ESP協議采用md5認證算法。

[RouterB-ipsec-transform-set-def] esp authentication-algorithm md5

[RouterB-ipsec-transform-set-def] quit

# 創建IPsec安全策略center，其協商方式為isakmp。

[RouterB] ipsec policy center 1 isakmp

[RouterB-ipsec-policy-isakmp-center-1] security acl 3000

[RouterB-ipsec-policy-isakmp-center-1] ike-peer center

[RouterB-ipsec-policy-isakmp-center-1] transform-set def

[RouterB-ipsec-policy-isakmp-center-1] quit

# 在GRE接口上應用安全策略。

[RouterB] interface tunnel 0

[RouterB-Tunnel0] ipsec policy center

[RouterB-Tunnel0] quit

3.5.3  Router C的配置

# 配置接口Ethernet0/1的IP地址。

<RouterC> system-view

[RouterC] interface ethernet 0/1

[RouterC-Ethernet0/1] ip address 192.168.2.1 255.255.255.0

[RouterC-Ethernet0/1] quit

# 配置接口Ethernet0/0的IP地址。

[RouterC] interface ethernet 0/0

[RouterC-Ethernet0/0] ip address 1.0.0.2 255.255.255.0

[RouterC-Ethernet0/0] quit

# 配置OSPF Router ID的Loopback接口地址。

[RouterC] interface loopback 0

[RouterC-LoopBack0] ip address 192.168.255.2 255.255.255.255

[RouterC-LoopBack0] quit

# 配置到center的GRE隧道。

[RouterC] interface tunnel 0

[RouterC-Tunnel0] ip address 192.168.0.6 255.255.255.252

[RouterC-Tunnel0] source ethernet 0/0

[RouterC-Tunnel0] destination 1.0.0.254

[RouterC-Tunnel0] quit

# 配置OSPF路由協議。

[RouterC] router id 192.168.255.2

[RouterC] ospf 1

[RouterC-ospf-1] area 0

[RouterC-ospf-1-area-0.0.0.0] network 192.168.255.2 0.0.0.0

[RouterC-ospf-1-area-0.0.0.0] network 192.168.0.4 0.0.0.3

[RouterC-ospf-1-area-0.0.0.0] network 192.168.2.0 0.0.0.255

[RouterC-ospf-1-area-0.0.0.0] quit

# 創建ACL3000,定義需要IPsec保護的數據流。

[RouterC] acl number 3000

[RouterC-acl-adv-3000] rule 0 permit ip source 192.168.2.0 0.0.0.255 destination

10.0.0.0 0.255.255.255

[RouterC-acl-adv-3000] quit

# 配置IKE對等體center。

[RouterC] ike peer center

[RouterC-ike-peer-center] pre-shared-key 123

[RouterC-ike-peer-center] remote-address 192.168.0.5

[RouterC-ike-peer-center] quit

# 采用安全提議的缺省配置。

[RouterC] ipsec transform-set def

# 配置ESP協議采用md5認證算法。

[RouterC-ipsec-transform-set-def] esp authentication-algorithm md5

[RouterC-ipsec-transform-set-def] quit

# 創建IPsec安全策略center，其協商方式為isakmp。

[RouterC] ipsec policy center 1 isakmp

[RouterC-ipsec-policy-isakmp-center-1] security acl 3000

[RouterC-ipsec-policy-isakmp-center-1] ike-peer center

[RouterC-ipsec-policy-isakmp-center-1] transform-set def

[RouterC-ipsec-policy-isakmp-center-1] quit

# 在GRE接口上應用安全策略。

[RouterC] interface tunnel 0

[RouterC-Tunnel0] ipsec policy center

[RouterC-Tunnel0] quit

3.6  驗證配置

完成以上配置後，總部與分支的所有內網之間可以互通，且隻有ACL定義的流量被加密。

這裏以Router B為例進行驗證，Router A和Router B驗證方法相同。

# 通過以下顯示信息可以看到，Router B和Router C的內網之間可以互通。

  <RouterB> ping -a 192.168.1.1 192.168.2.1

  PING 192.168.2.1: 56  data bytes, press CTRL_C to break

    Reply from 192.168.2.1: bytes=56 Sequence=0 ttl=254 time=3 ms

    Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=254 time=2 ms

    Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=254 time=2 ms

    Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=254 time=2 ms

    Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=254 time=3 ms

 

  --- 192.168.2.1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 2/2/3 ms

# 通過以下顯示信息可以看到，由於Router B和Router C內網的流量不屬於ACL定義的需加密的流量，因此，不能觸發IPsec。

<RouterB> dis ike sa

    total phase-1 SAs:  0

    connection-id  peer                    flag        phase   doi

  ----------------------------------------------------------------

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK--REKEY

<RouterB> dis ipsec sa

# 通過以下顯示信息可以看到，Router B和Router A之間的內網之間可以互通。

<RouterB> ping -a 192.168.1.1 10.0.0.1

  PING 10.0.0.1: 56  data bytes, press CTRL_C to break

    Request time out

    Reply from 10.0.0.1: bytes=56 Sequence=1 ttl=255 time=3 ms

    Reply from 10.0.0.1: bytes=56 Sequence=2 ttl=255 time=3 ms

    Reply from 10.0.0.1: bytes=56 Sequence=3 ttl=255 time=2 ms

    Reply from 10.0.0.1: bytes=56 Sequence=4 ttl=255 time=2 ms

 

  --- 10.0.0.1 ping statistics ---

    5 packet(s) transmitted

    4 packet(s) received

    20.00% packet loss

round-trip min/avg/max = 2/2/3 ms

# 由於Router B和Router A內網的流量已在ACL中定義為需加密保護的流量，因此將觸發IPsec進行加密。可以通過如下顯示信息看到，IKE協商成功，生成了兩個階段的SA。

<RouterB> display ike sa

    total phase-1 SAs:  1

    connection-id  peer                    flag        phase   doi

  ----------------------------------------------------------------

     1             192.168.0.1             RD|ST       1       IPSEC

     2             192.168.0.1             RD|ST       2       IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT RK—REKEY

# 可以通過如下顯示信息查看協商生成的IPsec SA。

<RouterB> display ipsec sa

===============================

Interface: Tunnel0

    path MTU: 1476

===============================

 

  -----------------------------

  IPsec policy name: "center"

  sequence number: 1

  acl version: ACL4

  mode: isakmp

  -----------------------------

    PFS: N, DH group: none

    tunnel:

        local  address: 192.168.0.2

        remote address: 192.168.0.1

    flow:

        sour addr: 192.168.1.0/255.255.255.0  port: 0  protocol: IP

        dest addr: 10.0.0.0/255.255.255.0  port: 0  protocol: IP

 

    [inbound ESP SAs]

      spi: 0xD37AE9A4(3548047780)

      transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 1

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843199/3539

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 0x86700DE2(2255490530)

      transform: ESP-ENCRYPT-NULL ESP-AUTH-MD5

      in use setting: Tunnel

      connection id: 2

      sa duration (kilobytes/sec): 1843200/3600

      sa remaining duration (kilobytes/sec): 1843199/3539

      anti-replay detection: Enabled

        anti-replay window size(counter based): 32

      udp encapsulation used for nat traversal: N

# 可以通過如下顯示信息查看GRE隧道的建立情況。

<RouterB> display interface tunnel0

Tunnel0 current state: UP

Line protocol current state: UP

Description: Tunnel0 Interface

The Maximum Transmit Unit is 1476

Internet Address is 192.168.0.2/30 Primary

Encapsulation is TUNNEL, service-loopback-group ID not set.

Tunnel source 1.0.0.1 (Ethernet0/0), destination 1.0.0.254

Tunnel bandwidth 64 (kbps)

Tunnel keepalive disabled

Tunnel protocol/transport GRE/IP

    GRE key disabled

    Checksumming of GRE packets disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

 Last clearing of counters:  Never

    Last 300 seconds input:  8 bytes/sec, 0 packets/sec

    Last 300 seconds output:  8 bytes/sec, 0 packets/sec

    184 packets input,  13716 bytes

    0 input error

    174 packets output,  12812 bytes

0 output error

# 可以通過如下顯示信息查看OSPF路由表和鄰居建立情況。

<RouterB> display ospf routing

 

          OSPF Process 1 with Router ID 192.168.255.1

                   Routing Tables

 

 Routing for Network

 Destination        Cost     Type    NextHop         AdvRouter       Area

 192.168.255.255/32 1562     Stub    192.168.0.1     192.168.255.255 0.0.0.0

 10.0.0.1/32        1562     Stub    192.168.0.1     192.168.255.255 0.0.0.0

 192.168.0.0/30     1562     Stub    192.168.0.2     192.168.255.1   0.0.0.0

 192.168.0.4/30     3124     Stub    192.168.0.1     192.168.255.255 0.0.0.0

 192.168.1.1/32     0        Stub    192.168.1.1     192.168.255.1   0.0.0.0

 192.168.2.1/32     3124     Stub    192.168.0.1     192.168.255.2   0.0.0.0

 192.168.255.1/32   0        Stub    192.168.255.1   192.168.255.1   0.0.0.0

 192.168.255.2/32   3124     Stub    192.168.0.1     192.168.255.2   0.0.0.0

 

 Total Nets: 8

 Intra Area: 8  Inter Area: 0  ASE: 0  NSSA: 0

 

<RouterB> display ospf lsdb

 

          OSPF Process 1 with Router ID 192.168.255.1

                  Link State Database

 

                          Area: 0.0.0.0

 Type      LinkState ID    AdvRouter          Age  Len   Sequence   Metric

 Router    192.168.255.255 192.168.255.255   1281  96    80000006       0

 Router    192.168.255.2   192.168.255.2     1266  72    80000004       0

 Router    192.168.255.1   192.168.255.1     1355  72    80000004       0

 

<RouterB> display ospf peer

 

                   OSPF Process 1 with Router ID 192.168.255.1

                        Neighbor Brief Information

 

 Area: 0.0.0.0

 Router ID       Address         Pri  Dead-Time  Interface       State

 192.168.255.255 192.168.0.1     1    31         Tun0            Full/ -

3.7  配置文件

·     Router A：

#

 router id 192.168.255.255

#

acl number 3000

 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.1.0 0.0.0.25

5

acl number 3001

 rule 0 permit ip source 10.0.0.0 0.255.255.255 destination 192.168.2.0 0.0.0.25

5

#

ike peer branch1

 pre-shared-key cipher $c$3$Hrwy5G5GJ4yA62gpcP5+JqEtifSvmw==

 remote-address 192.168.0.2

#

ike peer branch2

 pre-shared-key cipher $c$3$wogCOxJn/Yt9/Ix/bpcub18oq0kLXA==

 remote-address 192.168.0.6

#

ipsec transform-set def

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

#

ipsec policy branch1 1 isakmp

 security acl 3000

 ike-peer branch1

 transform-set def

#

ipsec policy branch2 1 isakmp

 security acl 3001

 ike-peer branch2

 transform-set def

#

interface Ethernet0/1

 port link-mode route

ip address 10.0.0.1 255.255.255.0

#

interface Ethernet0/0

 port link-mode route

 ip address 1.0.0.254 255.255.255.0

#

interface LoopBack0

 ip address 192.168.255.255 255.255.255.255

#

interface Tunnel0

 ip address 192.168.0.1 255.255.255.252

 source Ethernet0/0

 destination 1.0.0.1

 ipsec policy branch1

#

interface Tunnel1

 ip address 192.168.0.5 255.255.255.252

 source Ethernet0/0

 destination 1.0.0.2

 ipsec policy branch2

#

ospf 1

 area 0.0.0.0

  network 10.0.0.0 0.0.0.255

  network 192.168.255.255 0.0.0.0

  network 192.168.0.0 0.0.0.3

  network 192.168.0.4 0.0.0.3

#

·     Router B：

#

 router id 192.168.255.1

#

acl number 3000

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 10.0.0.0 0.0.0.255

#

ike peer center

 pre-shared-key cipher $c$3$pR4XoeELsbjG9RfWfrm5GT3Ro3EsOQ==

 remote-address 192.168.0.1

#

ipsec transform-set def

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

#

ipsec policy center 1 isakmp

 security acl 3000

 ike-peer center

 transform-set def

#

interface Ethernet0/1

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface Ethernet0/0

 port link-mode route

 ip address 1.0.0.1 255.255.255.0

#

interface LoopBack0

 ip address 192.168.255.1 255.255.255.255

#

interface Tunnel0

 ip address 192.168.0.2 255.255.255.252

 source Ethernet0/0

 destination 1.0.0.254

 ipsec policy center

#

ospf 1

 area 0.0.0.0

  network 192.168.255.1 0.0.0.0

  network 192.168.0.0 0.0.0.3

  network 192.168.1.0 0.0.0.255

#

·     Router C：

#

 router id 192.168.255.2

#

acl number 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 10.0.0.0 0.255.255.25

5

#

ike peer center

 pre-shared-key cipher $c$3$b/tFRG/i1Mg/80d4fZWThzLcNzcVag==

 remote-address 192.168.0.5

#

ipsec transform-set def

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

#

ipsec policy center 1 isakmp

 security acl 3000

 ike-peer center

 transform-set def

#

interface Ethernet0/1

 port link-mode route

ip address 192.168.2.1 255.255.255.0

#

interface Ethernet0/0

 port link-mode route

ip address 1.0.0.2 255.255.255.0

#

interface LoopBack0

 ip address 192.168.255.2 255.255.255.255

#

interface Tunnel0

 ip address 192.168.0.6 255.255.255.252

 source Ethernet0/0

 destination 1.0.0.254

 ipsec policy center

#

ospf 1

 area 0.0.0.0

  network 192.168.255.2 0.0.0.0

  network 192.168.0.4 0.0.0.3

  network 192.168.2.0 0.0.0.255

#

4  相關資料

·     H3C MSR 係列路由器 命令參考(V5)-R2311

·     H3C MSR 係列路由器 配置指導(V5)-R2311