CISCO设备（PIX/ASA/ROUTER）:外网口ip：1.1.1.1内网服务器：192.168.1.1H3C secpath：外网口ip：2.2.2.2内网服务器：192.168.2.2通过ipsec vpn，允许两台服务器之间通讯CISCO配置：#步骤1crypto isakmp policy 10authentication pre-shareencryption 3deshash shagroup 2lifetime 86400#步骤2crypto ipsec transform-setMyset esp-des esp-sha-hmac crypto map Myvpn 1 matchaddress VPNcrypto map Myvpn 1 set peer 2.2.2.2crypto map Myvpn 1 settransform-set Mysetcrypto map Myvpn interfaceoutsidecrypto isakmp identity addresscrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption 3deshash shagroup 2lifetime 86400tunnel-group 2.2.2.2 type ipsec-l2ltunnel-group 2.2.2.2 ipsec-attributespre-shared-key 123456#定义感兴趣流量access-list VPN extendedpermit ip host 192.168.1.1 host 192.168.2.2 H3C的配置：#ike peer peermtompre-shared-key 123456remote-address 1.1.1.1local-address 2.2.2.2#对应cisco的步骤1（蓝色标记的参数两边必须一致）ike proposal 1authentication-algorithm shaauthentication-method pre-shareencryption-algorithm 3des-cbcdh group2sa duration 86400#对应cisco的步骤2（蓝色标记的参数两边必须一致）ipsec proposal promtomencapsulation-mode tunnel transform espesp encryption-algorithm 3desesp authentication-algorithm sha1#ipsec policy policymtom 10 isakmpsecurity acl 3333ike-peer peermtomproposal promtom#定义感兴趣流量（必须与cisco中定义的感兴趣流量互为镜像）acl number 3333rule 0 permit ip source 192.168.2.2 0destination 192.168.1.1 0rule 5 deny ip#将内网服务器地址从nat转换列表中去除(应尽量放在第一行)假设防火墙上用于NAT转换的acl为2000：acl number 2000rule 0 deny source 192.168.2.2 0# 配置到对方内网服务器的静态路由ip route-static 192.168.1.1 32g1/0 (g1/0为防火墙外网口)#在外网接口上应用ipsec#int g1/0ipsecpolicy policymtom配置完成后，在防火墙上用以下命令查看vpn是否建立：dis ike sa ；若ike协商成功，再用以下命令查看dis ipsec sa；若有输出信息，是否成功你一看就知道了。哈哈