(c) 2024 Fsas Technologies Inc

reference
https://www.fujitsu.com/jp/documents/products/network/router/sir/example/internet-vpn/vpn_nec_ikev2-guide.pdf

****************************************
 IX2207 config
****************************************

timezone +09 00
!
ip ufs-cache enable
ip route default GigaEthernet0.1
ip route 192.168.2.0/24 Tunnel0.0
!
ikev2 authentication psk id fqdn kyoten1 key char test
!
ppp profile isp
  authentication myname id-a@isp
  authentication password id-a@isp pwd-a@isp
!
interface GigaEthernet0.0
  no ip address
  shutdown
!
interface GigaEthernet1.0
  no ip address
  shutdown
!
interface GigaEthernet2.0
  ip address 192.168.1.1/24
  no shutdown
!
interface GigaEthernet0.1
  encapsulation pppoe
  auto-connect
  ppp binding isp
  ip address 203.0.113.1/32
  ip tcp adjust-mss auto
  ip napt enable
  ip napt static GigaEthernet0.1 udp 500
  ip napt static GigaEthernet0.1 50
  no shutdown
!
interface Tunnel0.0
  tunnel mode ipsec-ikev2
  ip unnumbered GigaEthernet2.0
  ip tcp adjust-mss auto
  ikev2 child-lifetime 3600
  ikev2 dpd interval 10
  ikev2 local-authentication psk id ipv4 203.0.113.1
  ikev2 negotiation-direction responder
  ikev2 outgoing-interface GigaEthernet0.1
  ikev2 sa-lifetime 28800
  ikev2 peer any authentication psk id fqdn kyoten1
  no shutdown


****************************************
 Si-R config
****************************************

ether 1 1 vlan untag 1
ether 2 1-4 vlan untag 2
lan 1 ip address 192.168.2.1/24 3
lan 1 vlan 2
remote 0 name PPPoE
remote 0 mtu 1454
remote 0 ap 0 name PPPoE
remote 0 ap 0 datalink bind vlan 1
remote 0 ap 0 ppp auth send id-b@isp pwd-b@isp
remote 0 ap 0 keep connect
remote 0 ppp ipcp vjcomp disable
remote 0 ip route 0 203.0.113.1/32 1 1
remote 0 ip nat mode multi any 1 5m
remote 0 ip nat static 0 192.168.2.1 500 any 500 17
remote 0 ip nat static 1 192.168.2.1 any any any 50
remote 0 ip msschange 1414
remote 1 name IX
remote 1 ap 0 name IX
remote 1 ap 0 datalink type ipsec
remote 1 ap 0 ipsec type ikev2
remote 1 ap 0 ipsec ike protocol esp
remote 1 ap 0 ipsec ike encrypt aes-cbc-256
remote 1 ap 0 ipsec ike auth hmac-sha256
remote 1 ap 0 ipsec ike pfs modp2048
remote 1 ap 0 ipsec ike lifetime 1h
remote 1 ap 0 ipsec ike esn disable
remote 1 ap 0 ike local-idtype fqdn
remote 1 ap 0 ike remote-idtype address
remote 1 ap 0 ike name local kyoten1
remote 1 ap 0 ike shared key text test
remote 1 ap 0 ike proposal 0 encrypt aes-cbc-256
remote 1 ap 0 ike proposal 0 hash hmac-sha256
remote 1 ap 0 ike proposal 0 pfs modp2048
remote 1 ap 0 ike proposal 0 prf hmac-sha256
remote 1 ap 0 ike proposal 0 lifetime 8h
remote 1 ap 0 ike initial connect
remote 1 ap 0 ike dpd use on
remote 1 ap 0 tunnel remote 203.0.113.1
remote 1 ap 0 sessionwatch address 192.168.2.1 192.168.1.1
remote 1 ip route 0 default 1 1
remote 1 ip msschange 1350
syslog facility 23
time zone 0900
consoleinfo autologout 8h
telnetinfo autologout 5m
terminal charset SJIS