\r\n\r\n \r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n
\r\n
\r\n\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n \r\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n
\r\n Error:\r\n
\r\n
\r\n
\r\n An unexpected error has occurred. Please contact support.\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n Your role is limited and you do not have access to case management. Please contact a super user on your account.\r\n
\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n \r\n \r\n\r\n \r\n\r\n\r\n","searchPageUrl":null,"searchHub":"CSPSearch","organization":"paloaltonetworksintranet"}; //Escape the HTML Strings in the Object for(var key in PortalContext) { if(PortalContext[key] != null && typeof PortalContext[key] == 'string') { PortalContext[key] = unescapeHTML(PortalContext[key]); } } isAuthenticated = (unescapeHTML('svc-kbsiteguest@paloaltonetworks.com') && parseInt(PortalContext.supportAccountId)>0); console.log('PortalContext KB =', PortalContext ,typeof PortalContext); var kbUrl = 'https://sso.paloaltonetworks.com/app/panw-ciam_sfdcknowledgecommunity_1/exk3jjgpeeZioKZWj0j6/sso/saml'; var isKB = window.location.href.includes("knowledgebase.paloaltonetworks.com") || window.location.href.includes("/knowledgebase"); if (!isAuthenticated && isKB && window.location.href.toLowerCase().indexOf('relaystate=') === -1) { if (document.cookie.indexOf('support_kb_okta_lck') !== -1) { document.write('Please Wait...'); window.location.href = kbUrl + '?RelayState=' + window.location.href; return; } } });
如何使用 CLI 配置路由和隧道配置的 IPSEC VPN

如何使用 CLI 配置路由和隧道配置的 IPSEC VPN

106515
Created On 09/25/18 17:41 PM - Last Modified 01/30/25 22:51 PM


Resolution


概述

此文档提供 CLI 命令, 用于在帕洛阿尔托网络防火墙上创建 IPSec VPN, 包括隧道和路由配置。在运行命令之前, 请确保在防火墙上配置了 IKE 和 IPSec 加密配置文件。

注意:对于本文档中列出的命令, 建议对新的 IPSec 隧道使用相同的 IKE 和 ipsec cryptos.

详细

以下信息用作命令的示例数据。

  隧道：隧道 10 (区域 = vpn)
  隧道名称:纽约 VPN
  虚拟路由器:虚拟路由器1
  IKE 加密:ike-加密-配置文件 IKE_Profile
  IKE 网关:纽约 VPN
  IPsec 加密:ipsec 加密配置文件 IPsec_Profile
  对等 IP 地址:100.100.100。1
  隧道另一侧的子网:192.168.3. 0/24

下面的命令应按列出的顺序执行。

>>配置

# 设置网络接口隧道单元隧道. 10 ipv6 启用 no

# 设置网络接口隧道单元隧道. 10 ipv6 接口-id EUI-64

# 设置网络接口隧道单元隧道. 10 评论 "纽约 VPN"

# 设置区域 vpn 网络 layer3 隧道10

# 设置网络虚拟路由器 "虚拟路由器 1" 接口 [ethernet1/1 ethernet1/2 ethernet1/3 ethernet1/4 隧道. 10]

# 设置网络 ike 网关纽约 VPN 协议 ikev1 dpd 启用 no

# 设置网络 ike 网关纽约 VPN 协议 ikev1 dpd 间隔5

# 设置网络 ike 网关纽约 VPN 协议 ikev1 dpd 重试

# 设置网络 ike 网关纽约 VPN 协议 ikev1 ike 加密配置文件 IKE_Profile

# 设置网络 ike 网关纽约 VPN 协议 ikev1 交换模式自动

# 设置网络 ike 网关纽约 VPN 身份验证预共享密钥 paloalto

# 设置网络 ike 网关纽约 VPN 协议-公用 nat 遍历启用 no

# 设置网络 ike 网关纽约 VPN 协议-通用无源模式 no

# 设置网络 ike 网关纽约 VPN 对等地址 ip 100.100.100。1

# 设置网络 ike 网关纽约 VPN 本地地址接口 ethernet1/1

# 设置网络隧道 ipsec 纽约 vpn 自动键 ike 网关纽约 vpn

# 设置网络隧道 ipsec 纽约 VPN 自动密钥 ipsec-加密配置文件 IPsec_Profile

# 设置网络隧道 ipsec 纽约 VPN 隧道-显示器启用 no

# 设置网络隧道 ipsec 纽约 VPN 反重播是

# 设置网络隧道 ipsec 纽约 VPN 副本-tos no

# 设置网络隧道 ipsec 纽约 VPN 隧道-接口隧道. 10

# 设置网络虚拟路由器 "虚拟路由器 1" 路由表 ip 静态路由 Route_to_NewYork 接口隧道10

# 设置网络虚拟路由器 "虚拟路由器 1" 路由表 ip 静态路由 Route_to_NewYork 公制10

# 设置网络虚拟路由器 "虚拟路由器 1" 路由表 ip 静态路由 Route_to_NewYork 目标 192.168.3. 0/24

注意:由于克隆功能在 web UI 中不可用, 上面的命令可用于在同一防火墙上克隆 IPSec 隧道或复制到另一台帕洛阿尔托网络防火墙.

若要查看现有配置, 请使用相应的选项运行 "显示" 命令.

例如：

# 显示网络 ike

# 显示网络隧道 ipsec

所有者： 柯达
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHsCAK&lang=zh_CN&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language
\r\n\r\n \r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n
\r\n
\r\n\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n \r\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n
\r\n Error:\r\n
\r\n
\r\n
\r\n An unexpected error has occurred. Please contact support.\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n Your role is limited and you do not have access to case management. Please contact a super user on your account.\r\n
\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n \r\n \r\n\r\n \r\n\r\n\r\n","searchPageUrl":null,"searchHub":"CSPSearch","organization":"paloaltonetworksintranet"}; //Escape the HTML Strings in the Object for(var key in PortalContext) { if(PortalContext[key] != null && typeof PortalContext[key] == 'string') { PortalContext[key] = unescapeHTML(PortalContext[key]); } } console.log('PortalContext =', PortalContext ,typeof PortalContext , PortalContext.supportAccountId); \r\n\r\n \r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n
\r\n
\r\n\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n \r\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n
\r\n Error:\r\n
\r\n
\r\n
\r\n An unexpected error has occurred. Please contact support.\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n Your role is limited and you do not have access to case management. Please contact a super user on your account.\r\n
\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n \r\n \r\n\r\n \r\n\r\n\r\n","searchPageUrl":null,"searchHub":"CSPSearch","organization":"paloaltonetworksintranet"}; //Escape the HTML Strings in the Object for(var key in PortalContext) { if(PortalContext[key] != null && typeof PortalContext[key] == 'string') { PortalContext[key] = unescapeHTML(PortalContext[key]); } } console.log('PortalContext =', PortalContext ,typeof PortalContext , PortalContext.supportAccountId); authUser = PortalContext.authUser; uemail = PortalContext.userEmail; companyName = PortalContext.supportAccountName; if(authUser == '' || authUser == 'false') { uemail = ""; companyName = ""; } var webData = { "eMail": uemail, "pageName": "", "siteSection": "", "subSiteSection": "", "langCountry": "en_us", "companyName":companyName }; (function(h,o,t,j,a,r){ h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)}; h._hjSettings={hjid:647720,hjsv:6}; a=o.getElementsByTagName('head')[0]; r=o.createElement('script');r.async=1; r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv; a.appendChild(r); })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');