VPN Gateway:Configure um firewall H3C

Saída única + roteamento estático

No cenário de saída única com um único endereço IP público, vincule a saída do dispositivo H3C a duas interfaces Tunnel e configure perfis IPsec diferentes para conectá-las aos túneis ativo e em standby na Alibaba Cloud.

Etapa 1: Configuração de interface e rede

Configure os endereços IP e as zonas de segurança das interfaces pública e privada do dispositivo H3C e, em seguida, configure as rotas.

# Configure a public interface.
interface GigabitEthernet 2/0
 ip addr 10.32.0.175 24
 quit

# Configure a private interface.
interface GigabitEthernet 4/0
 ip addr 10.34.0.10 24
 quit

# Add the public and private interfaces to their respective security zone.
security-zone name Untrust
 import interface GigabitEthernet 2/0
 quit
security-zone name Trust
 import interface GigabitEthernet 4/0
 quit

# Configure a route for peer VPN gateway public IP (Internet egress).
ip route-static 39.XX.XX.17 32 10.32.0.173
ip route-static 39.XX.XX.10 32 10.32.0.173
ip route-static 10.0.0.0 8 10.34.0.253
ip route-static 10.0.0.0 8 10.34.0.253

Etapa 2: Configuração do túnel

Crie duas interfaces de túnel para conectar-se aos túneis ativo e em standby na cloud.

# Configure the tunnel interfaces and apply IPsec to the tunnel interfaces.
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit

# Add the tunnel interfaces to the Untrust security zone.
security-zone name Untrust
 import interface Tunnel 1
 import interface Tunnel 2
 quit

Etapa 3: Configuração do conjunto de transformação e da política IPsec

Configure o IPsec e o IKE. Se necessário, defina o valor baseado em tráfego para o máximo. Certifique-se de que as configurações sejam idênticas às da Alibaba Cloud.

# Configure the IPsec transform set
ipsec transform-set to-ali-trans
 encapsulation-mode tunnel
 protocol esp
 esp authentication-algorithm sha256
 esp encryption-algorithm aes-cbc-256
 pfs dh-group14
 quit

# Configure the IKEv2 proposal and the IKE security policy
ikev2 proposal to-ali-prop
 dh group14
 encryption aes-cbc-256
 integrity sha256
 prf sha256
 quit
ikev2 policy to-ali-policy
 priority 1
 proposal to-ali-prop
 quit

# Configure the IKE keychain. The two peers correspond to the two tunnels on Alibaba Cloud, and address specifies the public IP address on Alibaba Cloud.
ikev2 keychain to_ali_key1
 peer to-ali-peer1
  address 39.XX.XX.17 32
  identity address 39.XX.XX.17
  pre-shared-key plaintext ChangeMe****
  quit
 quit
ikev2 keychain to_ali_key2
 peer to-ali-peer2
  address 39.XX.XX.10 32
  identity address 39.XX.XX.10
  pre-shared-key plaintext ChangeMe****
  quit
 quit

# Configure the IKEv2 profile. The two peers correspond to the two tunnels on Alibaba Cloud.
ikev2 profile to-ali-profile1
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key1
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.17 32
 sa duration 86400
 dpd interval 30 periodic
 quit
 
ikev2 profile to-ali-profile2
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key2
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.10 32
 sa duration 86400
 dpd interval 30 periodic
 quit

# Configure the IPsec profile, which references the IKEv2 profile created above.
# We recommend that you use only the time-based mode for the SA duration. If you need to configure the traffic-based mode, set the traffic-based value to the maximum.
ipsec profile to-ali-profile1 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile1
 sa duration time-based 86400
 quit

ipsec profile to-ali-profile2 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile2
 sa duration time-based 86400
 quit
 
# Configure the tunnel interface and apply the IPsec policy to the tunnel interface.
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile1
 source 10.32.0.175
 destination 39.XX.XX.17
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile2
 source 10.32.0.175
 destination 39.XX.XX.10
 quit

# Configure a route to the private CIDR block of the peer to point to the tunnel interface. tunnel1 is the active tunnel and has a higher route priority.
ip route-static 192.168.0.0 16 Tunnel 1 preference 10
ip route-static 192.168.0.0 16 Tunnel 2 preference 20

Etapa 4: Configuração da política de segurança

Configure uma lista de controle de acesso (ACL) para permitir a negociação IKE e o tráfego de dados IPsec.

# Configure an ACL to allow IKE negotiation packets and IPsec data packets between the Untrust security zone and any other zone. In this example, the configurations are simplified. You can configure a fine-grained ACL based on your business requirements.
acl advanced 3001
 rule 0 permit ip
 quit
zone-pair security source any destination any
 packet-filter 3001
 quit

Etapa 5: Verificar os resultados

No data center, após configurar as rotas do servidor para o dispositivo H3C, teste a conectividade de rede entre o data center e a VPC da Alibaba Cloud e verifique o failover.

1. Teste a conectividade entre o data center e a VPC: Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server>. Se você receber um pacote de resposta do servidor do data center, a comunicação estará normal.

2. Teste a alta disponibilidade da conexão IPsec-VPN.

   1. Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server> -c 10000 para enviar pacotes de acesso continuamente ao data center.

   2. Interrompa o túnel ativo da conexão IPsec-VPN: modifique a chave pré-compartilhada do túnel ativo. O túnel será interrompido porque as chaves pré-compartilhadas nas duas extremidades ficarão inconsistentes.

   3. Após a interrupção do túnel ativo, observe o status de comunicação da instância ECS na VPC. Se o tráfego for recuperado após uma breve interrupção, isso indica que o tráfego passou a se comunicar automaticamente pelo túnel em standby.

Saída única + roteamento BGP

No cenário com um único endereço IP público e saída única, vincule a saída do dispositivo H3C a duas interfaces Tunnel e configure um perfil IPsec diferente para cada interface, conectando o dispositivo H3C aos túneis ativo e em standby da Alibaba Cloud.

Etapa 1: Configuração de interface e rede

Configure os endereços IP e as zonas de segurança das interfaces pública e privada do dispositivo H3C e, em seguida, configure as rotas.

#Public interface
interface GigabitEthernet 2/0
 ip addr 10.32.0.175 24
 quit

#Private interface
interface GigabitEthernet 4/0
 ip addr 10.34.0.10 24
 quit

#Add the interfaces to security zones
security-zone name Untrust
 import interface GigabitEthernet 2/0
 quit
security-zone name Trust
 import interface GigabitEthernet 4/0
 quit

#Configure the route to the public IP address of the peer Alibaba Cloud, with the next hop pointing to the Internet
ip route-static 39.XX.XX.17 32 10.32.0.173
ip route-static 39.XX.XX.10 32 10.32.0.173
#Configure the route to the internal CIDR block on the local side, with the next hop pointing to the private network
ip route-static 10.0.0.0 8 10.34.0.253

Etapa 2: Configuração do túnel

Crie duas interfaces Tunnel para conectar-se aos túneis ativo e em standby na cloud.

#Configure the Tunnel interfaces and apply the IPsec security framework to the Tunnel interfaces
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit

# Add the tunnel interface to a security zone
security-zone name Untrust
 import interface Tunnel 1
 import interface Tunnel 2
 quit

Etapa 3: Configuração do conjunto de transformação e da política IPsec

Configure o IPsec e o IKE. Certifique-se de que as configurações sejam consistentes com as da Alibaba Cloud.

# Configure the IPsec transform set
ipsec transform-set to-ali-trans
 encapsulation-mode tunnel
 protocol esp
 esp authentication-algorithm sha256
 esp encryption-algorithm aes-cbc-256
 pfs dh-group14
 quit

# Configure the IKEv2 proposal and IKE security policy
ikev2 proposal to-ali-prop
 dh group14
 encryption aes-cbc-256
 integrity sha256
 prf sha256
 quit
ikev2 policy to-ali-policy
 priority 1
 proposal to-ali-prop
 quit

# Configure the IKE keychain. The two peers correspond to the two tunnels on Alibaba Cloud, and address is the public IP address on Alibaba Cloud.
ikev2 keychain to_ali_key1
 peer to-ali-peer1
  address 39.XX.XX.17 32
  identity address 39.XX.XX.17
  pre-shared-key plaintext ChangeMe****
  quit
 quit
ikev2 keychain to_ali_key2
 peer to-ali-peer2
  address 39.XX.XX.10 32
  identity address 39.XX.XX.10
  pre-shared-key plaintext ChangeMe****
  quit
 quit

# Configure the IKEv2 profile. The two peers correspond to the two tunnels on Alibaba Cloud.
ikev2 profile to-ali-profile1
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key1
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.17 32
 sa duration 86400
 dpd interval 30 periodic
 quit
 
ikev2 profile to-ali-profile2
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key2
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.10 32
 sa duration 86400
 dpd interval 30 periodic
 quit

# Configure the IPsec profile and reference the IKEv2 profile created above
# We recommend that you use only time-based SA duration. If you need to configure traffic-based SA duration, set the traffic-based value to the maximum.
ipsec profile to-ali-profile1 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile1
 sa duration time-based 86400
 quit

ipsec profile to-ali-profile2 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile2
 sa duration time-based 86400
 quit
 
# Configure the tunnel interface and apply the IPsec policy to the tunnel interface
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile1
 source 10.32.0.175
 destination 39.XX.XX.17
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile2
 source 10.32.0.175
 destination 39.XX.XX.10
 quit

# Configure routes to the peer private CIDR blocks to point to the tunnel interfaces. tunnel1 is the active tunnel and has a higher route priority.
ip route-static 192.168.0.0 16 Tunnel 1 preference 10
ip route-static 192.168.0.0 16 Tunnel 2 preference 20

Etapa 4: Configuração da política de segurança

Configure uma política de segurança para permitir a passagem do tráfego do protocolo IKE e de dados IPsec.

#Configure the security zone to allow IKE negotiation packets and IPsec data packets. The configuration here is simplified. Add fine-grained rules as needed.
acl advanced 3001
 rule 0 permit ip
 quit
zone-pair security source any destination any
 packet-filter 3001
 quit

Etapa 5: Configuração do roteamento dinâmico BGP

# Configure IP addresses for the tunnel interfaces to establish BGP peering with the VPN gateway on Alibaba Cloud.
interface tunnel 1 mode ipsec
 ip address 169.254.10.2 30
 quit
interface tunnel 2 mode ipsec
 ip address 169.254.20.2 30
 quit

# Delete the static routes that point to the tunnels in the static routing scenario.
undo ip route-static 192.168.0.0 16 Tunnel 1 preference 10
undo ip route-static 192.168.0.0 16 Tunnel 2 preference 20

# Configure BGP dynamic routing. The H3C firewall advertises 10.0.0.0/8 to the VPN gateway on Alibaba Cloud.
bgp 65500
peer 169.254.10.1 as-number 65535
peer 169.254.20.1 as-number 65535
address-family ipv4 unicast
peer 169.254.10.1 enable
peer 169.254.20.1 enable
network 10.0.0.0 8  # Advertise the CIDR block 10.0.0.0/8.

Após concluir a configuração, ative os peers, exclua as rotas estáticas e visualize a conexão BGP:

Visualize as rotas BGP:

Visualize a tabela de roteamento:

Etapa 6: Verificar os resultados

No data center, após configurar a rota do cliente para o dispositivo H3C, teste a conectividade de rede entre o data center e a VPC da Alibaba Cloud e verifique o failover.

1. Teste a conectividade entre o data center e a VPC: Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server>. Se você receber um pacote de resposta do servidor do data center, a comunicação estará normal.

2. Teste a alta disponibilidade da conexão IPsec-VPN.

   1. Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server> -c 10000 para enviar pacotes de acesso continuamente ao data center.

   2. Interrompa o túnel ativo da conexão IPsec-VPN: modifique a chave pré-compartilhada do túnel ativo. O túnel será interrompido porque as chaves pré-compartilhadas nas duas extremidades ficarão inconsistentes.

   3. Após a interrupção do túnel ativo, observe o status de comunicação da instância ECS na VPC. Se o tráfego for recuperado após uma breve interrupção, isso indica que o tráfego passou a se comunicar automaticamente pelo túnel em standby.

Saídas duplas + roteamento estático

No cenário com endereços IP públicos e saídas duplas, vincule as duas saídas do dispositivo H3C a duas interfaces Tunnel e configure perfis IPsec diferentes para conectá-las aos túneis ativo e em standby da Alibaba Cloud.

Etapa 1: Configure interfaces e rede

Configure os endereços IP e as zonas de segurança da interface voltada para a Internet e da interface privada e, em seguida, configure as rotas.

# Configure Public Interface 1.
interface GigabitEthernet 2/0
 ip addr 10.32.0.175 24
 quit

# Configure Public Interface 2.
interface GigabitEthernet 3/0
 ip addr 10.33.0.238 24
 quit
 
# Configure a private interface.
interface GigabitEthernet 4/0
 ip addr 10.34.0.10 24
 quit

# Add the public and private interfaces to their respective security zone.
security-zone name Untrust
 import interface GigabitEthernet 2/0
 import interface GigabitEthernet 3/0
 quit
security-zone name Trust
 import interface GigabitEthernet 4/0
 quit

# Configure 32-bit routes for peer VPN gateway public IPs (Internet).
ip route-static 39.XX.XX.17 32 10.32.0.173
ip route-static 39.XX.XX.10 32 10.33.0.236
# Configure a route for the local internal network CIDR block.
ip route-static 10.0.0.0 8 10.34.0.253

Etapa 2: Configuração do túnel

Crie duas interfaces Tunnel para conectar-se aos túneis ativo e em standby na cloud.

#Configure the tunnel interface and apply the IPsec security framework to the tunnel interface
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 3/0
 quit

#Add the tunnel interface to the security zone
security-zone name Untrust
 import interface Tunnel 1
 import interface Tunnel 2
 quit

Etapa 3: Configuração do conjunto de transformação e da política IPsec

Configure o IPsec e o IKE e certifique-se de que as configurações sejam consistentes com as da Alibaba Cloud.

#Configure the IPsec transform set
ipsec transform-set to-ali-trans
 encapsulation-mode tunnel
 protocol esp
 esp authentication-algorithm sha256
 esp encryption-algorithm aes-cbc-256
 pfs dh-group14
 quit

#Configure the IKEv2 proposal and IKE security policy
ikev2 proposal to-ali-prop
 dh group14
 encryption aes-cbc-256
 integrity sha256
 prf sha256
 quit
ikev2 policy to-ali-policy
 priority 1
 proposal to-ali-prop
 quit

#Configure the IKE keychain. The two peers correspond to the two tunnels on Alibaba Cloud, and address is the public IP address on Alibaba Cloud
ikev2 keychain to_ali_key1
 peer to-ali-peer1
  address 39.XX.XX.17 32
  identity address 39.XX.XX.17
  pre-shared-key plaintext ChangeMe****
  quit
 quit
ikev2 keychain to_ali_key2
 peer to-ali-peer2
  address 39.XX.XX.10 32
  identity address 39.XX.XX.10
  pre-shared-key plaintext ChangeMe****
  quit
 quit

#Configure the IKEv2 profile. The two peers correspond to the two tunnels on Alibaba Cloud
ikev2 profile to-ali-profile1
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key1
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.17 32
 sa duration 86400
 dpd interval 30 periodic
 quit
 
ikev2 profile to-ali-profile2
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key2
 identity local address 116.XX.XX.68
 match remote identity address 39.XX.XX.10 32
 sa duration 86400
 dpd interval 30 periodic
 quit

#Configure the IPsec profile and reference the IKEv2 profile created above
#We recommend that you use only time-based SA duration. If you need to set a traffic-based value, set the traffic-based value to the maximum
ipsec profile to-ali-profile1 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile1
 sa duration time-based 86400
 quit

ipsec profile to-ali-profile2 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile2
 sa duration time-based 86400
 quit
 
#Configure the tunnel interface and apply the IPsec policy to the tunnel interface
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile1
 source 10.32.0.175
 destination 39.XX.XX.17
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 3/0
 tunnel protection ipsec profile to-ali-profile2
 source 10.33.0.238
 destination 39.XX.XX.10
 quit

#Configure a route for the peer private CIDR block to point to the tunnel interface. tunnel1 is the active tunnel and has a higher route priority
ip route-static 192.168.0.0 16 Tunnel 1 preference 10
ip route-static 192.168.0.0 16 Tunnel 2 preference 20

Etapa 4: Configuração da política de segurança

Configure uma política de segurança para permitir a passagem do tráfego do protocolo IKE e de dados IPsec.

#Configure the security zone to allow IKE negotiation packets and IPsec data packets. The configuration is simplified here. If you need fine-grained rules, add them as needed.
acl advanced 3001
 rule 0 permit ip
 quit
zone-pair security source any destination any
 packet-filter 3001
 quit

Etapa 5: Verificar os resultados

No data center, após configurar a rota do cliente para o dispositivo H3C, teste a conectividade de rede entre o data center e a VPC da Alibaba Cloud e verifique o failover.

1. Teste a conectividade entre o data center e a VPC: Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server>. Se você receber um pacote de resposta do servidor do data center, a comunicação estará normal.

2. Teste a alta disponibilidade da conexão IPsec-VPN.

   1. Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server> -c 10000 para enviar pacotes de acesso continuamente ao data center.

   2. Interrompa o túnel ativo da conexão IPsec-VPN: modifique a chave pré-compartilhada do túnel ativo. O túnel será interrompido porque as chaves pré-compartilhadas nas duas extremidades ficarão inconsistentes.

   3. Após a interrupção do túnel ativo, observe o status de comunicação da instância ECS na VPC. Se o tráfego for recuperado após uma breve interrupção, isso indica que o tráfego passou a se comunicar automaticamente pelo túnel em standby.

Saídas duplas + roteamento BGP

No cenário com IPs públicos e saídas duplas, vincule as duas saídas do dispositivo H3C a duas interfaces Tunnel e configure perfis IPsec diferentes para conectá-las aos túneis ativo e em standby da Alibaba Cloud.

Etapa 1: Configure interfaces e rede

Configure os endereços IP e as zonas de segurança da interface voltada para a Internet e da interface privada e, em seguida, configure as rotas.

# Configure Public Interface 1.
interface GigabitEthernet 2/0
 ip addr 10.32.0.175 24
 quit

# Configure Public Interface 2.
interface GigabitEthernet 3/0
 ip addr 10.33.0.238 24
 quit
 
# Configure a private interface.
interface GigabitEthernet 4/0
 ip addr 10.34.0.10 24
 quit

# Add the public and private interfaces to their respective security zone.
security-zone name Untrust
 import interface GigabitEthernet 2/0
 import interface GigabitEthernet 3/0
 quit
security-zone name Trust
 import interface GigabitEthernet 4/0
 quit

# Configure 32-bit routes for peer VPN gateway public IPs (Internet).
ip route-static 39.XX.XX.17 32 10.32.0.173
ip route-static 39.XX.XX.10 32 10.33.0.236
# Configure a route for the local internal network CIDR block.
ip route-static 10.0.0.0 8 10.34.0.253

Etapa 2: Configuração do túnel

Crie duas interfaces Tunnel para conectar-se aos túneis ativo e em standby na cloud.

# Configure the tunnel interfaces and apply IPsec to the tunnel interfaces.
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 3/0
 quit

# Add the tunnel interfaces to the Untrust security zone.
security-zone name Untrust
 import interface Tunnel 1
 import interface Tunnel 2
 quit

Etapa 3: Configuração do conjunto de transformação e da política IPsec

Configure o IPsec e o IKE e certifique-se de que as configurações sejam consistentes com as da Alibaba Cloud.

#Configure the IPsec transform set
ipsec transform-set to-ali-trans
 encapsulation-mode tunnel
 protocol esp
 esp authentication-algorithm sha256
 esp encryption-algorithm aes-cbc-256
 pfs dh-group14
 quit

#Configure the IKEv2 proposal and IKE security policy
ikev2 proposal to-ali-prop
 dh group14
 encryption aes-cbc-256
 integrity sha256
 prf sha256
 quit
ikev2 policy to-ali-policy
 priority 1
 proposal to-ali-prop
 quit

#Configure the IKE keychain. The two peers correspond to the two tunnels on Alibaba Cloud respectively, and the address is the public IP address on Alibaba Cloud
ikev2 keychain to_ali_key1
 peer to-ali-peer1
  address 39.XX.XX.17 32
  identity address 39.XX.XX.17
  pre-shared-key plaintext ChangeMe****
  quit
 quit
ikev2 keychain to_ali_key2
 peer to-ali-peer2
  address 39.XX.XX.10 32
  identity address 39.XX.XX.10
  pre-shared-key plaintext ChangeMe****
  quit
 quit

#Configure the IKEv2 profile. The two peers correspond to the two tunnels on Alibaba Cloud respectively
ikev2 profile to-ali-profile1
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key1
 identity local address 8.XX.XX.3
 match remote identity address 39.XX.XX.17 32
 sa duration 86400
 dpd interval 30 periodic
 quit
 
ikev2 profile to-ali-profile2
 authentication-method local pre-share
 authentication-method remote pre-share
 keychain to_ali_key2
 identity local address 116.XX.XX.68
 match remote identity address 39.XX.XX.10 32
 sa duration 86400
 dpd interval 30 periodic
 quit

#Configure the IPsec profile and reference the IKEv2 profile created above
#We recommend that you use only time-based SA duration. If you need to configure traffic-based duration, set the traffic-based value to the maximum
ipsec profile to-ali-profile1 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile1
 sa duration time-based 86400
 quit

ipsec profile to-ali-profile2 isakmp
 transform-set to-ali-trans
 ikev2-profile to-ali-profile2
 sa duration time-based 86400
 quit
 
#Configure the tunnel interface and apply the IPsec policy to the tunnel interface
interface tunnel 1 mode ipsec
 ip address unnumbered interface GigabitEthernet 2/0
 tunnel protection ipsec profile to-ali-profile1
 source 10.32.0.175
 destination 39.XX.XX.17
 quit
interface tunnel 2 mode ipsec
 ip address unnumbered interface GigabitEthernet 3/0
 tunnel protection ipsec profile to-ali-profile2
 source 10.33.0.238
 destination 39.XX.XX.10
 quit

#Configure a route for the peer intranet CIDR block that points to the tunnel interface. Tunnel1 is the active tunnel and has a higher route priority
ip route-static 192.168.0.0 16 Tunnel 1 preference 10
ip route-static 192.168.0.0 16 Tunnel 2 preference 20

Etapa 4: Configuração da política de segurança

Configure uma política de segurança para permitir a passagem do tráfego do protocolo IKE e de dados IPsec.

#Configure the security zone to allow IKE negotiation packets and IPsec data packets. The configuration here is simplified. Add fine-grained rules as needed
acl advanced 3001
 rule 0 permit ip
 quit
zone-pair security source any destination any
 packet-filter 3001
 quit

Etapa 5: Configuração do roteamento dinâmico BGP

# Configure IP addresses for the tunnel interfaces to establish BGP peering with the VPN gateway on Alibaba Cloud.
interface tunnel 1 mode ipsec
 ip address 169.254.10.2 30
 quit
interface tunnel 2 mode ipsec
 ip address 169.254.20.2 30
 quit

# Delete the static routes that point to the tunnels in the static routing scenario.
undo ip route-static 192.168.0.0 16 Tunnel 1 preference 10
undo ip route-static 192.168.0.0 16 Tunnel 2 preference 20

# Configure BGP dynamic routing. The H3C firewall advertises 10.0.0.0/8 to the VPN gateway on Alibaba Cloud.
bgp 65500
peer 169.254.10.1 as-number 65535
peer 169.254.20.1 as-number 65535
address-family ipv4 unicast
peer 169.254.10.1 enable
peer 169.254.20.1 enable
network 10.0.0.0 8  # Advertise the CIDR block 10.0.0.0/8.

Após concluir a configuração, ative os peers, exclua as rotas estáticas e visualize a conexão BGP:

Visualize o roteamento dinâmico BGP.

Visualize a tabela de rotas.

Etapa 6: Verificar os resultados

No data center, após configurar a rota do cliente para o dispositivo H3C, teste a conectividade de rede entre o data center e a VPC da Alibaba Cloud e verifique o failover.

1. Teste a conectividade entre o data center e a VPC: Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server>. Se você receber um pacote de resposta do servidor do data center, a comunicação estará normal.

2. Teste a alta disponibilidade da conexão IPsec-VPN.

   1. Faça login em uma instância ECS na VPC e execute ping <private IP address of the data center server> -c 10000 para enviar pacotes de acesso continuamente ao data center.

   2. Interrompa o túnel ativo da conexão IPsec-VPN: modifique a chave pré-compartilhada do túnel ativo. O túnel será interrompido porque as chaves pré-compartilhadas nas duas extremidades ficarão inconsistentes.

   3. Após a interrupção do túnel ativo, observe o status de comunicação da instância ECS na VPC. Se o tráfego for recuperado após uma breve interrupção, isso indica que o tráfego passou a se comunicar automaticamente pelo túnel em standby.