HILLSTONE FW & CISCO ASA IKEV1 IPSEC VPN山石防火墙 思科ASA IKEV1 IPSEC VPN

hsfwa# show configuration

zone “ipsecvpn“
  vrouter “trust-vr”
exit
hostname “hsfwa”
isakmp proposal “psk-md5-3des-g2“
  hash md5
exit
isakmp peer “ciscoasa“
  mode aggressive
  isakmp-proposal “psk-md5-3des-g2“
  pre-share “123456“
  peer 20.5.5.1
  nat-traversal
  accept-all-peer-id
  interface ethernet0/1
exit
ipsec proposal “esp-md5-3des-g2“
  hash md5
  encryption 3des
  group 2
exit
tunnel ipsec “ciscoasa” auto
  isakmp-peer “ciscoasa“
  ipsec-proposal “esp-md5-3des-g2“
  auto-connect
  id local 10.1.1.0/24 remote 172.16.5.0/24 service “any”
exit
interface ethernet0/0
  zone  “trust”
  ip address 10.1.1.254 255.255.255.0
  manage ssh
exit     
interface ethernet0/1
  zone  “untrust”
  ip address 20.0.0.1 255.255.255.0
  manage ping
exit
interface tunnel70
  zone  “ipsecvpn“
  manage ping
  tunnel ipsec “ciscoasa“
  reverse-route prefer
exit
ip vrouter “trust-vr”
  snatrule id 1 from “10.1.1.0/24” to “Any” service “Any” trans-to eif-ip mode dynamicport
  ip route 0.0.0.0/0 20.0.0.100
  ip route 172.16.5.0/24 “tunnel70“
exit
rule id 1
  action permit
  src-zone “trust”
  dst-zone “untrust”
  src-addr “Any”
  dst-addr “Any”
  service “Any”
exit
rule id 71
  action permit
  src-zone “trust”
  dst-zone “ipsecvpn”
  src-addr “Any”
  dst-addr “Any”
  service “Any”
exit
rule id 72
  action permit
  src-zone “ipsecvpn”
  dst-zone “trust”
  src-addr “Any”
  dst-ip 10.1.1.0/24
  service “Any”
exit
End

ciscoasa# show run

ASA Version 8.2(1)
!
hostname ciscoasa
!
interface Vlan10
 nameif inside
 security-level 100
 ip address 172.16.5.254 255.255.255.0
!
interface Vlan20
 nameif outside
 security-level 0
 ip address 20.5.5.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 10
!
interface Ethernet0/1
 switchport access vlan 20
!
access-list ipsecvpn extended permit ip 172.16.5.0 255.255.255.0 10.1.1.0 255.255.255.0

global (outside) 1 interface
nat (inside) 0 access-list ipsecvpn
nat (inside) 1 172.16.5.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 20.5.5.100 1

crypto ipsec transform-set hsfwa esp-3des esp-md5-hmac
crypto map vpnmap 10 match address ipsecvpn
crypto map vpnmap 10 set pfs
crypto map vpnmap 10 set peer 20.0.0.1
crypto map vpnmap 10 set transform-set hsfwa
crypto map vpnmap interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

tunnel-group 20.0.0.1 type ipsec-l2l
tunnel-group 20.0.0.1 ipsec-attributes
 pre-shared-key 123456
!
: end
ciscoasa#