h3c 防火墙SSL VPN 如何配置 radius+ otp验证登录

  RADIUS认证、授权配置举例

1. 组网需求

Device为SSL VPN网关设备，连接公网用户和企业私有网络。用户通过Device可以通过IP接入方式安全地访问私有网络内的Server。Device通过RADIUS server采用远程认证和授权方式对用户进行认证和授权。

2. 组网图

图1-24 RADIUS认证、授权配置组网图

‌

3. 配置步骤

(1)     配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 1.1.1.2 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

(2)     创建SSL VPN AC接口，用于转发IP接入流量

# 创建SSL VPN AC接口1，配置该接口的IP地址为10.1.1.100/24。

[Device] interface sslvpn-ac 1

[Device-SSLVPN-AC1] ip address 10.1.1.100 24

[Device-SSLVPN-AC1] quit

(3)     配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达Server的下一跳IP地址为2.2.2.3，到达User的下一跳IP地址为1.1.1.3实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 20.2.2.2 24 2.2.2.3

[Device] ip route-static 40.1.1.1 24 1.1.1.3

(4)     配置接口加入安全域。

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] import interface sslvpn-ac 1

[Device-security-zone-Untrust] quit

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] import interface gigabitethernet 1/0/3

[Device-security-zone-Trust] quit

(5)     配置安全策略放行Untrust与Local安全域、Untrust与Trust安全域之间的流量，用于用户访问SSL VPN网关设备和Server。

# 配置名称为sslvpnlocalout1的安全策略规则，使Device可以向用户发送报文，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name sslvpnlocalout1

[Device-security-policy-ip-1-sslvpnlocalout1] source-zone local

[Device-security-policy-ip-1-sslvpnlocalout1] destination-zone untrust

[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 1.1.1.2

[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 10.1.1.100

[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-host 40.1.1.1

[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-1-sslvpnlocalout1] action pass

[Device-security-policy-ip-1-sslvpnlocalout1] quit

# 配置名称为sslvpnlocalin1的安全策略规则，使用户可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin1

[Device-security-policy-ip-2-sslvpnlocalin1] source-zone untrust

[Device-security-policy-ip-2-sslvpnlocalin1] destination-zone local

[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host 40.1.1.1

[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host subnet 10.1.1.0 24

[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 1.1.1.2

[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 10.1.1.100

[Device-security-policy-ip-2-sslvpnlocalin1] action pass

[Device-security-policy-ip-2-sslvpnlocalin1] quit

# 配置名称为sslvpnlocalout2的安全策略规则，使Device可以向Server发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalout2

[Device-security-policy-ip-3-sslvpnlocalout2] source-zone local

[Device-security-policy-ip-3-sslvpnlocalout2] destination-zone trust

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 2.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 3.3.3.1

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 20.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 3.3.3.2

[Device-security-policy-ip-3-sslvpnlocalout2] action pass

[Device-security-policy-ip-3-sslvpnlocalout2] quit

# 配置名称为sslvpnlocalin2的安全策略规则，使Server可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin2

[Device-security-policy-ip-4-sslvpnlocalin2] source-zone trust

[Device-security-policy-ip-4-sslvpnlocalin2] destination-zone local

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 20.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 3.3.3.2

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 2.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 3.3.3.1

[Device-security-policy-ip-4-sslvpnlocalin2] action pass

[Device-security-policy-ip-4-sslvpnlocalin2] quit

# 配置名称为untrust-trust的安全策略规则，使用户可以通过SSL VPN AC接口访问Server，具体配置步骤如下。

[Device-security-policy-ip] rule name untrust-trust

[Device-security-policy-ip-5-untrust-trust] source-zone untrust

[Device-security-policy-ip-5-untrust-trust] destination-zone trust

[Device-security-policy-ip-5-untrust-trust] source-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-5-untrust-trust] destination-ip-host 20.2.2.2

[Device-security-policy-ip-5-untrust-trust] action pass

[Device-security-policy-ip-5-untrust-trust] quit

# 配置名称为trust-untrust的安全策略规则，使Server可以通过SSL VPN AC接口向用户发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-6-trust-untrust] source-zone trust

[Device-security-policy-ip-6-trust-untrust] destination-zone untrust

[Device-security-policy-ip-6-trust-untrust] source-ip-host 20.2.2.2

[Device-security-policy-ip-6-trust-untrust] destination-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-6-trust-untrust] action pass

[Device-security-policy-ip-6-trust-untrust] quit

[Device-security-policy-ip] quit

(6)     配置PKI域，设置证书申请所需的相关参数

[Device] pki domain sslvpn

[Device-pki-domain-sslvpn] public-key rsa general name sslvpn

[Device-pki-domain-sslvpn] undo crl check  enable

[Device-pki-domain-sslvpn] quit

[Device] pki import domain sslvpn der ca filename ca.cer

[Device] pki import domain sslvpn p12 local filename server.pfx

(7)     配置SSL服务器端策略，引用PKI域

[Device] ssl server-policy ssl

[Device-ssl-server-policy-ssl] pki-domain sslvpn

[Device-ssl-server-policy-ssl] quit

(8)     配置SSL VPN网关，为用户提供访问SSL VPN网关的入口

# 配置SSL VPN网关gw的IP地址为1.1.1.2，端口号为2000，并引用SSL服务器端策略ssl。

[Device] sslvpn gateway gw

[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000

[Device-sslvpn-gateway-gw] ssl server-policy ssl

[Device-sslvpn-gateway-gw] service enable

[Device-sslvpn-gateway-gw] quit

(9)     创建SSL VPN客户端地址池，用于为IP接入客户端分配IP地址

# 创建地址池ippool，指定IP地址范围为10.1.1.1～10.1.1.10。

[Device] sslvpn ip address-pool ippool 10.1.1.1 10.1.1.10

(10)     配置RADIUS，用于远程认证SSL VPN用户

# 配置Radius方案rscheme，指定认证和授权服务器地址均为3.3.3.2、认证和授权的共享密钥均为123456、发送给RADIUS服务器的用户名格式为不携带ISP域名。

[Device] radius scheme rscheme

[Device-radius-rscheme] primary authentication 3.3.3.2

[Device-radius-rscheme] primary accounting 3.3.3.2

[Device-radius-rscheme] accounting-on enable

[Device-radius-rscheme] key authentication simple 123456

[Device-radius-rscheme] key accounting simple 123456

[Device-radius-rscheme] user-name-format without-domain

[Device-radius-rscheme] quit

(11)     配置用户组，基于用户组对用户进行授权

# 配置用户组group1，授权给该用户组的策略组为pgroup。

[Device] user-group group1

[Device-ugroup-group1] authorization-attribute sslvpn-policy-group pgroup

[Device-ugroup-group1] quit

(12)     配置ISP域，通过ISP域对SSL VPN用户进行认证

# 配置ISP域domain1，指定用户授权属性为用户组group1，认证、授权和计费使用的RADIUS方案为rscheme。

[Device] domain domain1

[Device-isp-domain1] authorization-attribute user-group group1

[Device-isp-domain1] authentication sslvpn radius-scheme rscheme

[Device-isp-domain1] authorization sslvpn radius-scheme rscheme

[Device-isp-domain1] accounting sslvpn radius-scheme rscheme

[Device-isp-domain1] quit

(13)     配置SSL VPN访问实例，为用户提供不同的SSL VPN服务

# 配置SSL VPN访问实例ctx引用SSL VPN网关gw。

[Device] sslvpn context ctx

[Device-sslvpn-context-ctx] gateway gw

[Device-sslvpn-context-ctx] aaa domain domain1

[Device-sslvpn-context-ctx] ip-route-list rtlist

[Device-sslvpn-context-ctx-route-list-rtlist] include 20.2.2.0 255.255.255.0

[Device-sslvpn-context-ctx-route-list-rtlist] quit

[Device-sslvpn-context-ctx] uri-acl uriacl

[Device-sslvpn-context-ctx-uri-acl-uriacl] rule 1 permit uri icmp://20.2.2.0

[Device-sslvpn-context-ctx-uri-acl-uriacl] quit

[Device-sslvpn-context-ctx] ip-tunnel interface sslvpn-ac 1

[Device-sslvpn-context-ctx] ip-tunnel address-pool ippool mask 255.255.255.0

[Device-sslvpn-context-ctx] policy-group pgroup

[Device-sslvpn-context-ctx-policy-group-pgroup] ip-tunnel access-route ip-route-list rtlist

[Device-sslvpn-context-ctx-policy-group-pgroup] filter ip-tunnel uri-acl uriacl

[Device-sslvpn-context-ctx-policy-group-pgroup] quit

[Device-sslvpn-context-ctx] service enable

[Device-sslvpn-context-ctx] quit