H3C配置IPSECVPN思路跟思科差不多，无非就是命令不一样的，下面就演示一下
拓扑：
RT1背后有个1.1.1.1网段，RT3背后有个3.3.3.3网段，ISP没有这两条路由
RT2:
system-view
SystemView:returntoUserViewwithCtrl+Z.
[RT2]intg0/0/0
[RT2-GigabitEthernet0/0/0]ipadd12.1.1.224
[RT2-GigabitEthernet0/0/0]quit
[RT2]intg0/0/1
[RT2-GigabitEthernet0/0/1]ipadd23.1.1.224
[RT2-GigabitEthernet0/0/1]quit
RT1:
aclnumber3000
rule0permitipsource1.1.1.00.0.0.255destination3.3.3.00.0.0.255
ikeproposal1
encryption-algorithm3des-cbc
authentication-algorithmmd5
authentication-metodpre-share
dhgroup2
ikepeercisco
id-typeip
pre-shared-keysimplecisco
remote-address23.1.1.3
local-address12.1.1.1
#
ipsecproposalcisco
transformesp
espauthentication-algorithmmd5
espencryption-algorithm3des
ipsecpolicycisco10isakmp
securityacl3000
ike-peercisco
proposalcisco
intg0/0/0
ipsecpolicycisco
iproute-static0.0.0.00.0.0.012.1.1.2
RT3:
aclnumber3000
rule0permitipsource3.3.3.00.0.0.255destination1.1.1.00.0.0.255
ikeproposal1
encryption-algorithm3des-cbc
authentication-algorithmmd5
authentication-metodpre-share
dhgroup2
ikepeercisco
id-typeip
pre-shared-keysimplecisco
remote-address12.1.1.1
local-address23.1.1.3
#
ipsecproposalcisco
transformesp
espauthentication-algorithmmd5
espencryption-algorithm3des
ipsecpolicycisco10isakmp
securityacl3000
ike-peercisco
proposalcisco
intg0/0/1
ipsecpolicycisco
iproute-static0.0.0.00.0.0.023.1.1.2
效果：