FW1000

您好，ssl vpn 登录时候提示建立vpn隧道失败，以下是排查要点，请参考：

1、检查到SSL VPN网关的路由是否可达。

2、检查SSL VPN的SSL-AC1接口是否已加入安全域并放通安全策略或域间策略。

3、进一步检查SSL VPN的配置，参考配置如下：

[SSL_VPN]acl advanced 3000

[SSL_VPN-acl-ipv4-adv-3000]rule 0 permit ip source any

[SSL_VPN-acl-ipv4-adv-3000]quit

[SSL_VPN]sslvpn ip address-pool weijianing 172.16.1.2 172.16.1.254

[SSL_VPN]int SSLVPN-AC 1

[SSL_VPN-SSLVPN-AC1]ip address 172.16.1.1 24

[SSL_VPN-SSLVPN-AC1]quit

[SSL_VPN]sslvpn gateway james

[SSL_VPN-sslvpn-gateway-james]ip address 192.168.200.200

[SSL_VPN-sslvpn-gateway-james]service enable

[SSL_VPN-sslvpn-gateway-james]quit

[SSL_VPN]sslvpn context james

[SSL_VPN-sslvpn-context-james]gateway james

[SSL_VPN-sslvpn-context-james]ip-tunnel address-pool weijianing mask 24

[SSL_VPN-sslvpn-context-james]ip-tunnel interface SSLVPN-AC 1

[SSL_VPN-sslvpn-context-james]ip-route-list james

[SSL_VPN-sslvpn-context-james-route-list-james]include 10.0.0.0 24

[SSL_VPN-sslvpn-context-james-route-list-james]quit

[SSL_VPN-sslvpn-context-james]policy-group ip

[SSL_VPN-sslvpn-context-james-policy-group-ip]filter ip-tunnel acl 3000

[SSL_VPN-sslvpn-context-james-policy-group-ip]ip-tunnel access-route ip-route-list james

[SSL_VPN-sslvpn-context-james-policy-group-ip]quit

[SSL_VPN-sslvpn-context-james]service enable

[SSL_VPN-sslvpn-context-james]quit

[SSL_VPN]local-user weijianing class network

New local user added.

[SSL_VPN-luser-network-weijianing]password simple weijianing

[SSL_VPN-luser-network-weijianing]service-type sslvpn

[SSL_VPN-luser-network-weijianing]authorization-attribute sslvpn-policy-group ip

[SSL_VPN-luser-network-weijianing]quit

[SSL_VPN]security-zone name Untrust

[SSL_VPN-security-zone-Untrust]import interface SSLVPN-AC 1

[SSL_VPN-security-zone-Untrust]quit