场景说明：A区域和B区域通过防火墙互联， 防火墙单机部署， 中间交换机模拟互联网，两端防火墙通过建立IPSec VPN隧道打通私网互访，并提供加密功能，形成负载场景。防火墙与内部交换机之间运行OSPF。

防火墙配置：

sysname FW-1
#这里配置DPD，用于感知IPSEC VPN故障后，删除IPSEC SA和IKE SA
ike dpd type periodic
ike dpd idle-time 10
ike dpd retransmit-interval 2
ike dpd msg seq-notify-hash
#定义感兴趣流
acl number 3000 
 rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
#创建IPSEC安全提议
ipsec proposal A
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
#创建IKE安全提议
ike proposal 1
 encryption-algorithm aes-256
 dh group14
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#创建IKE对等体
ike peer A
 pre-shared-key %^%#<Yz_-9h[45BY|K2f]LdRYB}-#L4"I-'|me#AROx&%^%#
 ike-proposal 1
 remote-address 100.1.2.1
#创建IPSEC策略
ipsec policy A 1 isakmp
 security acl 3000
 ike-peer A
 proposal A
 sa trigger-mode auto //配置IPSEC隧道触发方式为自动触发
 route inject dynamic //配置根据感兴趣流自动注入unr路由
#
interface GigabitEthernet1/0/0
 undo shutdown
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 100.0.0.2 255.255.255.252
 service-manage ping permit
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 10.0.11.1 255.255.255.252
 ospf network-type p2p
 service-manage ping permit
#
interface GigabitEthernet1/0/3
 undo shutdown
#
interface GigabitEthernet1/0/4
 undo shutdown
 ip address 10.0.12.1 255.255.255.252
 ospf network-type p2p
 service-manage ping permit
#
interface Tunnel0
 ip address 100.1.1.1 255.255.255.255
 tunnel-protocol ipsec
 ipsec policy A
#
firewall zone local
 set priority 100
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface GigabitEthernet1/0/4
 add interface GigabitEthernet1/0/2
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet1/0/1
 add interface Tunnel0
#
firewall zone dmz
 set priority 50
#
ospf 1
 default-route-advertise
 import-route unr
 area 0.0.0.0
  network 10.0.11.0 0.0.0.3
  network 10.0.12.0 0.0.0.3
  network 100.1.1.1 0.0.0.0
#
ip route-static 0.0.0.0 0.0.0.0 100.0.0.1
#
security-policy
 rule name Trust_Untrust_Permit
  source-zone trust
  destination-zone untrust
  action permit
 rule name Untrust&Local_IPSec_Permit
  source-zone local
  source-zone untrust
  destination-zone local
  destination-zone untrust
  source-address 100.0.0.0 mask 255.255.255.252
  source-address 100.0.0.4 mask 255.255.255.252
  source-address 100.1.1.0 mask 255.255.255.0
  source-address 100.1.2.0 mask 255.255.255.0
  source-address 200.0.0.0 mask 255.255.255.252
  source-address 200.0.0.4 mask 255.255.255.252
  source-address 200.1.1.0 mask 255.255.255.0
  source-address 200.1.2.0 mask 255.255.255.0
  destination-address 100.0.0.0 mask 255.255.255.252
  destination-address 100.0.0.4 mask 255.255.255.252
  destination-address 100.1.1.0 mask 255.255.255.0
  destination-address 100.1.2.0 mask 255.255.255.0
  destination-address 200.0.0.0 mask 255.255.255.252
  destination-address 200.0.0.4 mask 255.255.255.252
  destination-address 200.1.1.0 mask 255.255.255.0
  destination-address 200.1.2.0 mask 255.255.255.0
  action permit
 rule name Untrust_Trust_Permit
  source-zone untrust
  destination-zone trust
  source-address 192.168.20.0 mask 255.255.255.0
  destination-address 192.168.10.0 mask 255.255.255.0
  action permit
#
return