(c) 2024 Fsas Technologies Inc

reference
https://www.fujitsu.com/jp/documents/products/network/router/sir/example/internet-vpn/vpn_furukawa_ikev2-guide.pdf

****************************************
 FITELnet config
****************************************

access-list 100 permit udp any eq 500 any eq 500
access-list 100 permit 50 any any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip route 192.168.2.0 255.255.255.0 tunnel 1
ip scp server enable
ip sftp server enable
!
logging buffer level informational
!
crypto ipsec policy P2-POLI
 set pfs group14
 set security-association lifetime seconds 3600
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1500
 set ip tos copy
 set ip df-bit 0
 set ip fragment post
 set esn enable
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
crypto isakmp policy P1-POLI
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 28800
 hash sha-256
exit
!
crypto isakmp profile PROF
 match identity host kyoten1
 local-address 203.0.113.2
 set isakmp-policy P1-POLI
 set ipsec-policy P2-POLI
 ike-version 2
 local-key test
exit
!
crypto map KYOTEN ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
exit
!
interface Port-channel 1
 ip address 192.168.1.1 255.255.255.0
exit
!
interface Port-channel 2
 ip address 203.0.113.2 255.255.255.252
exit
!
interface Tunnel 1
 ip unnumbered port-channel 2
 tunnel mode ipsec map KYOTEN
exit
!
end


****************************************
 Si-R config
****************************************

ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 1 ip address 192.168.2.1/24 3
lan 1 vlan 2
remote 0 name PPPoE
remote 0 mtu 1454
remote 0 ap 0 name PPPoE
remote 0 ap 0 datalink bind vlan 1
remote 0 ap 0 ppp auth send id@isp pwd@isp
remote 0 ap 0 keep connect
remote 0 ppp ipcp vjcomp disable
remote 0 ip route 0 203.0.113.2/32 1 1
remote 0 ip nat mode multi any 1 5m
remote 0 ip nat static 0 192.168.2.1 500 any 500 17
remote 0 ip nat static 1 192.168.2.1 any any any 50
remote 0 ip msschange 1414
remote 1 name FITELnet
remote 1 ap 0 name F220
remote 1 ap 0 datalink type ipsec
remote 1 ap 0 ipsec type ikev2
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp2048
remote 1 ap 0 ipsec ike lifetime 1h
remote 1 ap 0 ike local-idtype fqdn
remote 1 ap 0 ike remote-idtype address
remote 1 ap 0 ike name local kyoten1
remote 1 ap 0 ike shared key text test
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp2048
remote 1 ap 0 ike proposal 0 prf hmac-sha256
remote 1 ap 0 ike proposal 0 lifetime 8h
remote 1 ap 0 ike initial connect
remote 1 ap 0 ike dpd use on
remote 1 ap 0 tunnel remote 203.0.113.2
remote 1 ap 0 sessionwatch address 192.168.2.1 192.168.1.1
remote 1 ip route 0 192.168.1.0/24 1 1
remote 1 ip msschange 1300
syslog pri error,warn,info
syslog facility 23
time zone 0900
consoleinfo autologout 8h
telnetinfo autologout 5m
terminal charset SJIS