Copyright 2024 Fsas Technologies Inc

reference
https://www.fujitsu.com/jp/documents/products/network/router/sir/example/internet-vpn/vpn_aggressive_multi_gx-guide.pdf

****************************************
 Si-R 1 config
****************************************

ip route 0.0.0.0 0.0.0.0 202.248.0.2
ip route 172.16.2.0 255.255.255.0 tunnel 1
ip route 172.16.3.0 255.255.255.0 tunnel 2
!
survey 172.16.2.254 survey-map SURVEY_IPsec source port-channel 3 nexthop tunnel 1 interworking
survey 172.16.3.254 survey-map SURVEY_IPsec source port-channel 3 nexthop tunnel 2 interworking
!
survey-map SURVEY_IPsec
 ttl 255
 timeout 1000
 retry 4
 frequency every 10000
 stability 5 interval 10000
exit
!
crypto ipsec policy phase2
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set mss auto
 set ip tos copy
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy phase1
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile ISAKMP_PROF_1
 match identity host kyotenA
 local-address 203.0.113.1
 set isakmp-policy phase1
 set ipsec-policy phase2
 ike-version 1
 local-key ascii sir-key1
exit
!
crypto isakmp profile ISAKMP_PROF_2
 match identity host kyotenB
 local-address 203.0.113.1
 set isakmp-policy phase1
 set ipsec-policy phase2
 ike-version 1
 local-key ascii sir-key2
exit
!
crypto map IPsec_MAP_1 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile ISAKMP_PROF_1
exit
!
crypto map IPsec_MAP_2 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile ISAKMP_PROF_2
exit
!
interface GigaEthernet 1/1
 channel-group 1
exit
!
interface GigaEthernet 1/3
 channel-group 3
exit
!
interface Management 1
 ip address 192.168.1.1 255.255.255.0
exit
!
interface Port-channel 1
 ip address 203.0.113.1 255.255.255.252
exit
!
interface Port-channel 3
 ip address 172.16.1.254 255.255.255.0
exit
!
interface Tunnel 1
 ip unnumbered port-channel 1
 tunnel mode ipsec map IPsec_MAP_1
exit
!
interface Tunnel 2
 ip unnumbered port-channel 1
 tunnel mode ipsec map IPsec_MAP_2
exit
!


****************************************
 Si-R 2 config
****************************************

ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 1 ip address 172.16.2.254/24 3
lan 1 vlan 2
remote 0 name internet
remote 0 mtu 1454
remote 0 ap 0 name pppoe
remote 0 ap 0 datalink bind vlan 1
remote 0 ap 0 ppp auth send id-a@isp pwd-a@isp
remote 0 ap 0 keep connect
remote 0 ppp ipcp vjcomp disable
remote 0 ip route 0 default 1 1
remote 0 ip nat mode multi any 1 5m
remote 0 ip nat static 0 172.16.2.254 500 any 500 17
remote 0 ip nat static 1 172.16.2.254 any any any 50
remote 0 ip msschange 1414
remote 1 name Si-R_1
remote 1 ap 0 name ipsec
remote 1 ap 0 datalink type ipsec
remote 1 ap 0 keep connect
remote 1 ap 0 ipsec type ike
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp2048
remote 1 ap 0 ike mode aggressive
remote 1 ap 0 ike name local kyotenA
remote 1 ap 0 ike shared key text sir-key1
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp2048
remote 1 ap 0 tunnel remote 203.0.113.1
remote 1 ap 0 sessionwatch address 172.16.2.254 172.16.1.254
remote 1 ip route 0 172.16.1.0/24 1 1
remote 1 ip msschange 1300
syslog facility 23
time zone 0900
consoleinfo autologout 1h
telnetinfo autologout 10m
terminal charset SJIS


****************************************
 Si-R 3 config
****************************************

ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 1 ip address 172.16.3.254/24 3
lan 1 vlan 2
remote 0 name internet
remote 0 mtu 1454
remote 0 ap 0 name pppoe
remote 0 ap 0 datalink bind vlan 1
remote 0 ap 0 ppp auth send id-b@isp pwd-b@isp
remote 0 ap 0 keep connect
remote 0 ppp ipcp vjcomp disable
remote 0 ip route 0 default 1 1
remote 0 ip nat mode multi any 1 5m
remote 0 ip nat static 0 172.16.3.254 500 any 500 17
remote 0 ip nat static 1 172.16.3.254 any any any 50
remote 0 ip msschange 1414
remote 1 name Si-R_1
remote 1 ap 0 name ipsec
remote 1 ap 0 datalink type ipsec
remote 1 ap 0 keep connect
remote 1 ap 0 ipsec type ike
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp2048
remote 1 ap 0 ike mode aggressive
remote 1 ap 0 ike name local kyotenB
remote 1 ap 0 ike shared key text sir-key2
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp2048
remote 1 ap 0 tunnel remote 203.0.113.1
remote 1 ap 0 sessionwatch address 172.16.3.254 172.16.1.254
remote 1 ip route 0 172.16.1.0/24 1 1
remote 1 ip msschange 1300
syslog facility 23
time zone 0900
consoleinfo autologout 1h
telnetinfo autologout 10m
terminal charset SJIS