Ipsec vpn

Skill nanxiaoyao/network-huawei-skills/ipsec-vpn

Huawei network device (USG firewall + S/CE switch) CLI skills pack for OpenClaw AI agent — also usable as a standalone cheatsheet.

Install

npx -y skills add nanxiaoyao/network-huawei-skills --skill ipsec-vpn

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

This skill should be used when the user asks to configure or troubleshoot IPSec VPN tunnels on Huawei USG6000E series firewalls. Covers IKEv1/IKEv2 negotiation, IPSec SA, pre-shared key and certificate authentication, point-to-point and template mode, smart-link multi-link, NAT traversal, and L2L scenarios. Applicable platforms USG6000E V600R007C20+ and USG6000/USG9500/NGFW Module V500R005C20+ (CLI syntax identical between versions).

SKILL.md

7.7 KB, ~2.6k tokens by cl100k_base, as published. Nobody here has run it

华为 USG IPSec VPN 配置技能 (ipsec-vpn)

适用平台 USG6000E 系列适用版本 V600R007C20+ 文档来源 HUAWEI USG6000E V600R007C20 产品文档

IPSec VPN 是企业站点到站点 site-to-site 安全互联的标准方案 USG 支持 IKEv1/IKEv2 预共享密钥/证书多种封装模式模板方式智能选路等高级特性

触发场景

配置 IPSec VPN 隧道
总部与分支站点互联
IPSec 隧道建不起来
IKE 协商失败
NAT 穿越 NAT-T
智能选路多链路备份
IPSec 模板方式总部对接多个分支
查看 IKE/IPSec SA

IPSec 协商两阶段

第一阶段 IKE SA

建立安全管理通道
协商 IKE 安全提议加密验证 DH 组
模式 main 主模式 / aggressive 野蛮模式
认证预共享密钥 PSK / RSA 证书

第二阶段 IPSec SA

建立数据传输通道
协商 IPSec 安全提议封装协议算法
封装 tunnel 隧道模式 / transport 传输模式
协议 ESP 加密+完整性 / AH 仅完整性

配置六步走

1 接口 IP 和安全区域必须先配置 2 安全策略必须放通三组域间策略

内网 trust 与外网 untrust 双向加密前后流量
local 与 untrust 双向 IKE 协商报文 3 IPSec 提议安全参数 4 IKE 提议与对等体 5 IPSec 策略与待加密数据流 ACL 6 应用策略到接口

命令体系

1 IPSec 提议 ipsec proposal

system-view ipsec proposal <proposal-name> transform { esp | ah | ah-esp } esp encryption-algorithm aes-256 esp authentication-algorithm sha2-256 ah authentication-algorithm sha2-256 encapsulation-mode tunnel quit

2 IKE 提议

ike proposal <number> encryption-algorithm aes-256 authentication-algorithm sha2-256 dh group14 authentication-method pre-share | rsa-signature sa duration 86400 prf hmac-sha2-256 quit

3 IKE 对等体

4 ACL 定义待加密数据流

acl number 3000 rule permit ip source <local-net> <mask> destination <remote-net> <mask> quit

5 IPSec 策略

ipsec policy <policy-name> <seq-number> isakmp security acl 3000 ike-peer <peer-name> proposal <proposal-name> pfs dh-group14 sa duration time-based 3600 sa duration traffic-based 1843200 quit

6 应用到接口

interface GigabitEthernet 0/0/1 ipsec policy <policy-name> quit

7 模板方式总部端适配多分支

ipsec policy-template <template-name> <seq> ike-peer <peer-name> proposal <proposal-name> quit ipsec policy <policy-name> <seq> isakmp template <template-name>

配置完整示例站点到站点

拓扑

FW_A 总部内网 10.1.1.0/24 公网 1.1.3.1 FW_B 分支内网 10.1.2.0/24 公网 1.1.5.1

FW_A 总部配置

system-view sysname FW_A

接口

interface GigabitEthernet 0/0/1 ip address 1.1.3.1 24 quit interface GigabitEthernet 0/0/3 ip address 10.1.1.1 24 quit firewall zone trust add interface GigabitEthernet 0/0/3 quit firewall zone untrust add interface GigabitEthernet 0/0/1 quit

默认路由

ip route-static 0.0.0.0 0 1.1.3.254

安全策略三组

security-policy rule name lan_to_lan source-zone trust destination-zone untrust source-address 10.1.1.0 24 destination-address 10.1.2.0 24 action permit rule name lan_from_lan source-zone untrust destination-zone trust source-address 10.1.2.0 24 destination-address 10.1.1.0 24 action permit rule name ike_out source-zone local destination-zone untrust source-address 1.1.3.1 32 destination-address 1.1.5.1 32 action permit rule name ike_in source-zone untrust destination-zone local source-address 1.1.5.1 32 destination-address 1.1.3.1 32 action permit

ACL

acl number 3000 rule 5 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 quit

IPSec 提议

ipsec proposal prop1 esp encryption-algorithm aes-256 esp authentication-algorithm sha2-256 quit

IKE 提议

ike proposal 10 encryption-algorithm aes-256 authentication-algorithm sha2-256 dh group14 quit

IKE 对等体

ike peer fw_b ike-proposal 10 pre-shared-key cipher Admin@123 remote-address 1.1.5.1 quit

IPSec 策略

ipsec policy map1 10 isakmp security acl 3000 ike-peer fw_b proposal prop1 quit

应用到出接口

interface GigabitEthernet 0/0/1 ipsec policy map1 quit

return save

FW_B 分支配置

同样思路修改方向内外网 IP 对调 ACL 源目对调

查看命令

display ike sa 查看 IKE SA display ike sa peer <ip> verbose 查看指定对等体 IKE SA 详情 display ike peer 查看 IKE 对等体配置 display ike proposal 查看 IKE 提议 display ipsec sa 查看 IPSec SA display ipsec sa policy <name> 查看指定策略 SA display ipsec sa brief IPSec SA 摘要 display ipsec policy [<name>] 查看 IPSec 策略 display ipsec proposal 查看 IPSec 提议 display ipsec statistics IPSec 统计 display ipsec smart-link profile 智能选路状态

重置

reset ike sa [<conn-id>] 删除 IKE SA reset ipsec sa 删除所有 IPSec SA reset ipsec sa policy <name> 删除指定策略 SA reset ipsec statistics 清统计

排错指南

IKE 第一阶段失败

症状 display ike sa 看不到对应 peer

检查项 1 安全策略 local-untrust 双向放通 IKE 2 ike proposal 两端必须完全一致 3 pre-shared-key 两端必须一致 4 对端 IP 是否可达 ping 验证 5 exchange-mode 主模式两端必须一致 6 抓包 untrust 口看 UDP 500 是否到达抓包命令 capture-packet interface <if> destination-port 500 file-name ike.pcap

IPSec 第二阶段失败

症状 IKE SA up 但 IPSec SA 起不来

检查项 1 ipsec proposal 两端必须一致 ESP/AH 算法相同 2 ACL 必须双向镜像源目对调 3 PFS 配置两端一致 4 SA 生存周期合理时间和流量 5 查 IPSec 错误统计 display ipsec statistics

隧道建好但流量不通

检查项 1 流量必须命中 ACL 否则不进隧道测试 ping -a <local-net-ip> <remote-net-ip> 2 安全策略 trust-untrust 双向放通业务流量 3 路由远端网段必须有路由指向本地隧道接口或公网出口 4 NAT 优先级问题 NAT 不应转换 IPSec 加密前流量通常需在 NAT 策略前加 no-nat 规则匹配 IPSec 流量

NAT 穿越问题

症状中间有 NAT 设备 IKE 协商失败

解决 1 ike peer 下配置 nat-traversal 2 安全策略放通 UDP 4500 3 中间 NAT 设备开启 IPSec ALG 或保留 UDP 500/4500

DPD 与心跳

配置 ike peer <name> dpd interval 30 timeout 120 查看 display ike sa peer <ip> verbose 看 DPD 状态

与其他技能关联

security-policy 必须放通三组域间策略
interface-config 接口 IP 和 zone 是前提
nat-config IPSec 流量需要 no-nat 规则
ha-hrp 双机时 IPSec 隧道自动主备同步

参考文档

references/ipsec-commands.md 命令速查
references/ipsec-troubleshooting.md 详细排错
产品文档 admin/sec_admin_ipsec_.html admin/sec_case_ipsec_.html
CLI 案例 admin/sec_admin_ipsec_example_cli_0031.html