内地办公室 --[加密隧道]--> 互联网 --[加密隧道]--> 香港办公室
        ↳ IPSec封装                ↳ IPSec解封装

! 创建ISAKMP策略
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256 hash sha
 group 2
 lifetime 86400! 设置预共享密钥
tunnel-group 203.0.113.20 type ipsec-l2l
tunnel-group 203.0.113.20 ipsec-attributes
 ikev1 pre-shared-key MySecureKey123!! 定义IPSec转换集
crypto ipsec ikev1 transform-set MYSET esp-aes-256 esp-sha-hmac! 创建加密映射
crypto map MYMAP 10 match address VPN-TRAFFIC
crypto map MYMAP 10 set peer 203.0.113.20
crypto map MYMAP 10 set ikev1 transform-set MYSET
crypto map MYMAP 10 set security-association lifetime seconds 28800! 应用加密映射
crypto map MYMAP interface outside! 定义感兴趣流量
access-list VPN-TRAFFIC extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

# 第一阶段配置ike proposal 10
 encryption aes-256
 integrity sha256
 dh-group 14
 lifetime 86400# 第二阶段配置ipsec proposal MY-PROPOSAL
 encryption aes-256
 integrity sha256
 lifetime 28800# 定义对等体ike peer HONGKONG
 address 203.0.113.10
 pre-shared-key MySecureKey123!
 proposal 10ipsec policy MY-POLICY
 proposal MY-PROPOSAL
 ike-peer HONGKONG# 应用策略ip route 192.168.2.0 255.255.255.0 interface outside policy MY-POLICY

# IPSec VPN连接状态监控脚本function Test-IPSecVPN {
    param(
        [string]$RemoteGateway,
        [int]$TimeoutMs = 5000    )
    
    # 测试基础连通性
    $pingResult = Test-Connection -ComputerName $RemoteGateway -Count 4 -Quiet    if (-not $pingResult) {
        Write-Warning "无法ping通远程网关 $RemoteGateway"
        return $false
    }
    
    # 检查IPSec安全关联（需要本地管理员权限）
    $ipsecSAs = Get-NetIPsecSecurityAssociation | Where-Object {
        $_.RemoteAddress -eq $RemoteGateway
    }
    
    if ($ipsecSAs.Count -eq 0) {
        Write-Warning "未找到与 $RemoteGateway 的IPSec安全关联"
        return $false
    }
    
    Write-Host "IPSec VPN连接正常 - 活动SA数量: $($ipsecSAs.Count)" -ForegroundColor Green    return $true}# 执行监控$vpnStatus = Test-IPSecVPN -RemoteGateway "203.0.113.10"

# IPSec VPN批量配置脚本$VPNConfigs = @(
    @{
        Name = "HK-Office"
        RemoteIP = "203.0.113.10"
        LocalSubnet = "192.168.1.0/24"
        RemoteSubnet = "192.168.2.0/24"
        PreSharedKey = "MySecureKey123!"
    })foreach ($config in $VPNConfigs) {
    try {
        # 创建IPSec策略
        $ipsecPolicy = @{
            Name = "IPSEC-$($config.Name)"
            RemoteAddress = $config.RemoteIP
            LocalSubnet = $config.LocalSubnet
            RemoteSubnet = $config.RemoteSubnet
            PreSharedKey = $config.PreSharedKey        }
        
        # 这里可以扩展为调用具体设备的API或配置模板
        Write-Host "正在配置VPN连接到 $($config.Name)..." -ForegroundColor Yellow        
        # 模拟配置过程
        Start-Sleep -Seconds 2        Write-Host "✓ VPN配置 $($config.Name) 已完成" -ForegroundColor Green        
    } catch {
        Write-Error "配置 $($config.Name) 时出错: $($_.Exception.Message)"
    }}