Copyright 2024 Fsas Technologies Inc

reference
https://www.fujitsu.com/jp/documents/products/network/router/sir/example/internet-vpn/vpn_datac_gx-guide.pdf

****************************************
 Si-R GX500 config
****************************************

ip route 192.168.1.0 255.255.255.0 tunnel 1
ip route 192.168.2.0 255.255.255.0 tunnel 2
!
ip dhcp client-profile DHCPv4
 retries infinity
 ngn enable
exit
!
ipv6 route ::/0 dhcp port-channel 1
!
ipv6 dhcp client-profile DHCPv6
 option-request prefix-delegation
 option-request sip-server
 option-request sip-server-domain
 retries infinity
 ngn enable
exit
!
snmp-server source-interface port-channel 3
!
crypto ipsec udp-encapsulation nat-t
crypto ipsec udp-encapsulation-force
!
crypto ipsec policy P2
 set pfs group5
 set security-association lifetime seconds 3600
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail detail
crypto isakmp negotiation retry timer 5 limit 2 timer-max 5 guard-time 0
crypto isakmp security-association softlimit initiate seconds 90
crypto isakmp security-association softlimit respond seconds 30
!
crypto isakmp policy P1
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 5
 hash sha-256
exit
!
crypto isakmp profile 0222222222
 match identity tel-key-id 0222222222 sha-256
 self-identity tel-key-id 0111111111 sha-256
 set isakmp-policy P1
 set ipsec-policy P2
 set peer sip-profile 0222222222
 ike-version 2
 local-key sir2-key
exit
!
crypto isakmp profile 0333333333
match identity tel-key-id 0333333333 sha-256
self-identity tel-key-id 0111111111 sha-256
set isakmp-policy P1
set ipsec-policy P2
set peer sip-profile 0333333333
ike-version 2
local-key sir2-key
exit
!
crypto session release idle-time 60
!
crypto map 0222222222 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile 0222222222
exit
!
crypto map 0333333333 ipsec-isakmp
 match address SELECTOR
 set isakmp-profile 0333333333
exit
!
ngn sip use enable
ngn sip log session
ngn sip log registrar
ngn sip log session-fail
ngn sip log limit
ngn sip agent 0 bind port-channel 1
!
ngn sip profile 0222222222
 remote dial 0 number 0222222222
 remote dial 0 speed 512k
exit
!
ngn sip profile 0333333333
 remote dial 0 number 0333333333
 remote dial 0 speed 64k
exit
!
interface GigaEthernet 1/1
 channel-group 1
exit
!
interface GigaEthernet 1/3
 channel-group 3
exit
!
interface Port-channel 1
 ip dhcp service client
 ip dhcp client-profile DHCPv4
 ipv6 enable
 ipv6 address dhcp port-channel 1 ::1/64
 ipv6 nd receive-ra
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6
exit
!
interface Port-channel 3
 ip address 192.168.3.254 255.255.255.0
exit
!
interface Tunnel 1
 ip unnumbered port-channel 3
 tunnel mode ipsec map 0222222222
exit
!
interface Tunnel 2
 ip unnumbered port-channel 3
 tunnel mode ipsec map 0333333333
exit
!
end


****************************************
 Si-R 1 config
****************************************

ether 1 1 vlan untag 1001
ether 2 1-4 vlan untag 1002
lan 0 ip dhcp service client
lan 0 ip route 0 default dhcp 1 1
lan 0 ipv6 use on
lan 0 ipv6 address 0 dhcp@lan0::/64
lan 0 ipv6 route 0 default dhcp 1 1
lan 0 ipv6 dhcp service client
lan 0 ipv6 dhcp client option na off
lan 0 ipv6 dhcp client option pd on
lan 0 vlan 1001
lan 1 ip address 192.168.1.254/24 3
lan 1 vlan 1002
remote 1 name GX500
remote 1 shaping on 512k
remote 1 ap 0 name IPsec
remote 1 ap 0 datalink type dataconnect
remote 1 ap 0 dial 0 number 0111111111
remote 1 ap 0 dial 0 speed 512K
remote 1 ap 0 idle 1m
remote 1 ap 0 ipsec type ikev2
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp1536
remote 1 ap 0 ipsec ike lifetime 1h
remote 1 ap 0 ipsec ike esn disable
remote 1 ap 0 ike local-idtype tel_key_id on
remote 1 ap 0 ike remote-idtype tel_key_id on
remote 1 ap 0 ike name local 0222222222
remote 1 ap 0 ike name remote 0111111111
remote 1 ap 0 ike shared key text sir2-key
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp1536
remote 1 ap 0 ike proposal 0 prf hmac-sha256
remote 1 ap 0 ike nat-traversal use on
remote 1 ip route 0 192.168.3.0/24 1 60
remote 1 ip priority 0 any any any any any any express
remote 1 ip msschange 1280
loopback ip address 0 192.168.1.254
ngn sip use on
ngn sip bind lan 0
syslog pri error,warn,info
syslog facility 23
time auto server 0.0.0.0 dhcp
time zone 0900
consoleinfo autologout 8h
telnetinfo autologout 5m
terminal charset SJIS


****************************************
 Si-R 2 config
****************************************

Si-R G_2設定例
ether 1 1 vlan untag 1001
ether 2 1-4 vlan untag 1002
lan 0 ip dhcp service client
lan 0 ip dhcp client option router off
lan 0 ipv6 use on
lan 0 ipv6 address 0 dhcp@lan0::/64
lan 0 ipv6 route 0 default dhcp 1 1
lan 0 ipv6 dhcp service client
lan 0 ipv6 dhcp client option na off
lan 0 ipv6 dhcp client option pd on
lan 0 vlan 1001
lan 1 ip address 192.168.2.254/24 3
lan 1 vlan 1002
remote 1 name GX500
remote 1 shaping on 64k
remote 1 ap 0 name IPsec
remote 1 ap 0 datalink type dataconnect
remote 1 ap 0 dial 0 number 0111111111
remote 1 ap 0 dial 0 speed 64K
remote 1 ap 0 idle 1m
remote 1 ap 0 ipsec type ikev2
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp1536
remote 1 ap 0 ipsec ike lifetime 1h
remote 1 ap 0 ipsec ike esn disable
remote 1 ap 0 ike local-idtype tel_key_id on
remote 1 ap 0 ike remote-idtype tel_key_id on
remote 1 ap 0 ike name local 0333333333
remote 1 ap 0 ike name remote 0111111111
remote 1 ap 0 ike shared key text sir2-key
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp1536
remote 1 ap 0 ike proposal 0 prf hmac-sha256
remote 1 ap 0 ike nat-traversal use on
remote 1 ip route 0 192.168.3.0/24 1 60
remote 1 ip priority 0 any any any any any any express
remote 1 ip msschange 1280
loopback ip address 0 192.168.2.254
ngn sip use on
ngn sip bind lan 0
syslog pri error,warn,info
syslog facility 23
time auto server 0.0.0.0 dhcp
time zone 0900
consoleinfo autologout 8h
telnetinfo autologout 5m
terminal charset SJIS