Copyright 2025 Fsas Technologies Inc
reference
https://www.fujitsu.com/jp/documents/products/network/router/sir/example/flets_prio_ipsec_gx-guide.pdf

****************************************
 Si-RGX500 config
****************************************
ip route 172.16.2.0 255.255.255.0 tunnel 1
ip route 172.16.3.0 255.255.255.0 tunnel 2
ip route 192.168.11.0 255.255.255.0 192.168.10.1
ip route 192.168.12.0 255.255.255.0 192.168.10.1
ip route 0.0.0.0 0.0.0.0 172.16.1.1
!
survey 172.16.2.254 survey-map SURVEY_IPsec source port-channel 5 nexthop tunnel 1 interworking
survey 172.16.3.254 survey-map SURVEY_IPsec source port-channel 5 nexthop tunnel 2 interworking
!
survey-map SURVEY_IPsec
 ttl 255
 timeout 1000
 retry 4
 frequency every 10000
 stability 5 interval 10000
exit
!
crypto ipsec policy phase2
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform esp-aes esp-sha-hmac
 set mtu 1444
 set mss auto
 set ip tos copy
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp policy phase1
 authentication pre-share
 encryption aes
 group 1
 lifetime 86400
 hash sha
 initiate-mode main
exit
!
crypto isakmp profile ISAKMP_PROF_1
 local-address 192.168.10.2
 set isakmp-policy phase1
 set ipsec-policy phase2
 set peer 192.168.11.2
 ike-version 1
 local-key ascii sir-key
exit
!
crypto isakmp profile ISAKMP_PROF_2
 local-address 192.168.10.2
 set isakmp-policy phase1
 set ipsec-policy phase2
 set peer 192.168.12.2
 ike-version 1
 local-key ascii sir-key
exit
!
crypto map IPsec_MAP_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile ISAKMP_PROF_1
exit
!
crypto map IPsec_MAP_2 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile ISAKMP_PROF_2
exit
!
interface GigaEthernet 1/3
 channel-group 3
exit
!
interface GigaEthernet 1/5
 channel-group 5
exit
!
interface Port-channel 3
 ip address 192.168.10.2 255.255.255.0
 mtu 1444
exit
!
interface Port-channel 5
 ip address 172.16.1.254 255.255.255.0
exit
!
interface Tunnel 1
 ip unnumbered port-channel 5
 tunnel mode ipsec map IPsec_MAP_1
exit
!
interface Tunnel 2
 ip unnumbered port-channel 5
 tunnel mode ipsec map IPsec_MAP_2
exit
!
end


****************************************
 Si-R1 config
****************************************
ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 0 mtu 1444
lan 0 ip address 192.168.11.2/24 3
lan 0 ip route 0 192.168.10.0/24 192.168.11.1 1 1
lan 0 vlan 1
lan 1 ip address 172.16.2.254/24 3
lan 1 vlan 2
remote 0 name Center
remote 0 mtu 1374
remote 0 ap 0 datalink type ipsec
remote 0 ap 0 keep connect
remote 0 ap 0 ipsec type ike
remote 0 ap 0 ipsec ike protocol esp
remote 0 ap 0 ipsec ike encrypt aes-cbc-128
remote 0 ap 0 ipsec ike auth hmac-sha1
remote 0 ap 0 ike shared key text sir-key
remote 0 ap 0 ike proposal 0 encrypt aes-cbc-128
remote 0 ap 0 ike proposal 0 hash hmac-sha1
remote 0 ap 0 tunnel local 192.168.11.2
remote 0 ap 0 tunnel remote 192.168.10.2
remote 0 ap 0 sessionwatch address 172.16.2.254 172.16.1.254
remote 0 ip route 0 default 1 60
remote 0 ip msschange 1334
time zone 0900
consoleinfo autologout 1h
telnetinfo autologout 10m
terminal charset SJIS


****************************************
 Si-R2 config
****************************************
ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 0 mtu 1444
lan 0 ip address 192.168.12.2/24 3
lan 0 ip route 0 192.168.10.0/24 192.168.12.1 1 1
lan 0 vlan 1
lan 1 ip address 172.16.3.254/24 3
lan 1 vlan 2
remote 0 name Center
remote 0 mtu 1374
remote 0 ap 0 datalink type ipsec
remote 0 ap 0 keep connect
remote 0 ap 0 ipsec type ike
remote 0 ap 0 ipsec ike protocol esp
remote 0 ap 0 ipsec ike encrypt aes-cbc-128
remote 0 ap 0 ipsec ike auth hmac-sha1
remote 0 ap 0 ike shared key text sir-key
remote 0 ap 0 ike proposal 0 encrypt aes-cbc-128
remote 0 ap 0 ike proposal 0 hash hmac-sha1
remote 0 ap 0 tunnel local 192.168.12.2
remote 0 ap 0 tunnel remote 192.168.10.2
remote 0 ap 0 sessionwatch address 172.16.3.254 172.16.1.254
remote 0 ip route 0 default 1 60
remote 0 ip msschange 1334
time zone 0900
consoleinfo autologout 1h
telnetinfo autologout 10m
terminal charset SJIS