你需要认清自己是谁、想要什么、愿意做什么，然后你会发现，解决自己特有问题的方案是需要量身定制的。
明明是一篇讲技术的文章，为什么用这样的开头呢？因为在追求技术的道路上，我也有这样的感受，有时候我们会苦苦追寻某个问题的答案，用了很多了时间和精力，甚至忘了吃饭，但找到的东西却不是令自己满意的，你会发现你所在的场景，没有人遇到过，他们无法给你确切的答案，你不得以必须踏上一条未知的道路，当你忍受着各种痛苦在这条路走了一段时间后，又会有一种新的感受：自己以前这么笨！这么简单的问题都想不明白。我想很多同道中人都会有像我一样的感受。
GRE-VPN
原理
下面来讲一下，GRE VPN 的原理和配置，没错，上来就说点干的，不以路由器为例子，因为现在路由器非常少见了，我们见到的大部分设备都是有路由功能的防火墙。
原始报文进入防火墙之后，要先路由，路由将其指引到一个tunnel接口，tunnel接口要给原始报文加一个GRE头，然后再加一个新的IP头，然后再路由。
上面这段话至关重要，因为这段话不仅是GRE VPN的基本原理，还将你应该如何配置VPN也给体现出来了，最关键的是这是自己的理解。原始报文进入防火墙之后，要先路由，就意味着这一条路由得我们手动添加一下，将其指引到tunnel接口，tunnel接口默认不存在，我们也要配置，给这个接口配置IP地址，尽管这个地方没什么用，而且还要给这个接口配置源IP和目标IP，用于给报文加一个IP头，然后还要再添加一个路由，这一条路由应该是默认路由。
配置
路由器的相关配置
###R1
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysn R1
[R1]un in e
Info: Information center is disabled.
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 1.1.1.2 24
[R1-GigabitEthernet0/0/0]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 3.3.3.1 24
[R1-GigabitEthernet0/0/1]ospf
[R1-ospf-1]are 1
[R1-ospf-1-area-0.0.0.1]network 1.1.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.1]network 3.3.3.0 0.0.0.255
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in e
Info: Information center is disabled.
[Huawei]sysn R2
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 3.3.3.2 24
[R2-GigabitEthernet0/0/0]int g0/0/1
[R2-GigabitEthernet0/0/1]ip add 4.4.4.1 24
[R2-GigabitEthernet0/0/1]ospf
[R2-ospf-1]area 1
[R2-ospf-1-area-0.0.0.1]network 3.3.3.0 0.0.0.255
[R2-ospf-1-area-0.0.0.1]network 4.4.4.0 0.0.0.255
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in e
Info: Information center is disabled.
[Huawei]sysn R3
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ip add 4.4.4.2 24
[R3-GigabitEthernet0/0/0]int g0/0/1
[R3-GigabitEthernet0/0/1]ip add 2.2.2.1 24
[R3-GigabitEthernet0/0/1]ospf
[R3-ospf-1]ar 1
[R3-ospf-1-area-0.0.0.1]network 4.4.4.0 0.0.0.255
[R3-ospf-1-area-0.0.0.1]network 2.2.2.0 0.0.0.255
FW1的相关配置
# 给接口配置IP地址
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]portswitch
[FW1-GigabitEthernet1/0/0]port link-ty tr
[FW1-GigabitEthernet1/0/0]port tr all vlan all
[FW1-GigabitEthernet1/0/0]vlan 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[FW1-vlan20]int vlan20
[FW1-Vlanif20]ip add 192.168.20.1 24
[FW1-Vlanif20]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 1.1.1.1 24
# 将接口加入到相应的区域
[FW1]firewall zone trust
[FW1-zone-trust]add int vlan 20
[FW1-zone-trust]qu
[FW1]firewall zone untrust
[FW1-zone-untrust]add int g1/0/1
[FW1-zone-untrust]qu
# 配置tunnel接口
interface Tunnel0
ip address 6.6.6.6 255.255.255.0
tunnel-protocol gre
source 1.1.1.1
destination 2.2.2.2
[FW1]firewall zone dmz
[FW1-zone-dmz]add int tunnel 0
# 配置两条路由
[FW1]ip route-static 192.168.40.0 24 Tunnel 0
[FW1]ip route-static 0.0.0.0 0 1.1.1.2
# 放行所有策略
[FW1-policy-security]rule name any_any_permit
[FW1-policy-security-rule-any_any_permit]source-zone any
[FW1-policy-security-rule-any_any_permit]destination-zone any
[FW1-policy-security-rule-any_any_permit]ac pe
FW2的相关配置
# 给接口配置IP地址
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]ip add 2.2.2.2 24
[FW2-GigabitEthernet1/0/0]int g1/0/1
[FW2-GigabitEthernet1/0/1]portsw
[FW2-GigabitEthernet1/0/1]portswitch
[FW2-GigabitEthernet1/0/1]port link-ty tr
[FW2-GigabitEthernet1/0/1]port tr all vlan all
[FW2]vlan 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[FW2-vlan40]int vlan40
[FW2-Vlanif40]ip add 192.168.40.1 24
# 将接口加入到相应的区域
[FW2]firewall zone untrust
[FW2-zone-untrust]add int g1/0/0
[FW2]firewall zone trust
[FW2-zone-trust]add int Vlanif 40
# 配置tunnel接口，加入到相应的区域
interface Tunnel0
ip address 6.6.6.7 255.255.255.0
tunnel-protocol gre
source 2.2.2.2
destination 1.1.1.1
firewall zone dmz
add interface Tunnel0
# 路由
[FW2]ip route-static 192.168.20.0 24 Tunnel 0
[FW2]ip route-static 0.0.0.0 0 2.2.2.1
# 放行所有策略
[FW2]security-policy
[FW2-policy-security]rule name any_any_permit
[FW2-policy-security-rule-any_any_permit]source-zone any
[FW2-policy-security-rule-any_any_permit]destination-zone any
# 检查
通过dis interface tunnel 0，看到两个up，说明隧道已经建立好了
策略
左边的网段到右边的网段
FW1的策略
[FW1]dis firewall session table verbose
2020-06-14 13:48:55.240
Current Total Sessions : 4
icmp VPN: public --> public ID: c387f848e9e62d851c5ee62aac
Zone: trust --> dmz TTL: 00:00:20 Left: 00:00:01
Recv Interface: Vlanif20
Interface: Tunnel0 NextHop: 192.168.40.2 MAC: 0000-0000-0000
<--packets: 1 bytes: 60 --> packets: 1 bytes: 60
192.168.20.2:43561 --> 192.168.40.2:2048 PolicyName: any_any_permit
gre VPN: public --> public ID: c487f848e9ee20035955ee62a01
Zone: untrust --> local TTL: 00:10:00 Left: 00:09:43
Recv Interface: GigabitEthernet1/0/1
Interface: InLoopBack0 NextHop: 127.0.0.1 MAC: 0000-0000-0000
<--packets: 0 bytes: 0 --> packets: 147 bytes: 12,348
2.2.2.2:0 --> 1.1.1.1:0 PolicyName: any_any_permit
FW2的策略
[FW2]dis firewall session table verbose
2020-06-14 13:50:49.700
Current Total Sessions : 3
icmp VPN: public --> public ID: c387fa20286c638a115ee62b35
Zone: dmz --> trust TTL: 00:00:20 Left: 00:00:17
Recv Interface: Tunnel0
Interface: Vlanif40 NextHop: 192.168.40.2 MAC: 5489-98a7-2e60
<--packets: 1 bytes: 60 --> packets: 1 bytes: 60
192.168.20.2:7978 --> 192.168.40.2:2048 PolicyName: any_any_permit
gre VPN: public --> public ID: c487fa20287405020185ee629fe
Zone: untrust --> local TTL: 00:10:00 Left: 00:09:57
Recv Interface: GigabitEthernet1/0/0
Interface: InLoopBack0 NextHop: 127.0.0.1 MAC: 0000-0000-0000
<--packets: 0 bytes: 0 --> packets: 151 bytes: 12,684
1.1.1.1:0 --> 2.2.2.2:0 PolicyName: any_any_permit
### 生成策略
FW1：trust 到 dmz的 192.168.20.0 到192.168.40.0
FW1：untrust 到local的2.2.2.2 到1.1.1.1
FW2：untrust 到 local的1.1.1.1到2.2.2.2
FW：dmz到trust的192.168.20.0 到192.168.40.0
然后删除any 到 any的默认策略
[FW1-policy-security]dis th
2020-06-14 14:06:21.790
#
security-policy
rule name trust_dmz
source-zone trust
destination-zone dmz
source-address 192.168.20.0 mask 255.255.255.0
destination-address 192.168.40.0 mask 255.255.255.0
action permit
rule name untrust_local
source-zone untrust
destination-zone local
source-address 2.2.2.2 mask 255.255.255.255
destination-address 1.1.1.1 mask 255.255.255.255
action permit
[FW2-policy-security]dis th
2020-06-14 14:10:47.150
#
security-policy
rule name untrust_local
source-zone untrust
destination-zone local
source-address 1.1.1.1 mask 255.255.255.255
destination-address 2.2.2.2 mask 255.255.255.255
action permit
rule name dmz_trust
source-zone dmz
destination-zone trust
source-address 192.168.20.0 mask 255.255.255.0
destination-address 192.168.40.0 mask 255.255.255.0
action permit
#
return
重点是领会思路，先放行所有，然后通过看会话制定精细的策略。
