防火墙是F1020，如何配置ssl vpn
- 0关注
- 0收藏，83浏览
问题描述：
防火墙是F1020，如何配置ssl vpn
组网及组网描述：
AVG.163.com/TOPIC/DETAIL/9308819
AVG.163.com/TOPIC/DETAIL/9308821
AVG.163.com/TOPIC/DETAIL/9308817
AVG.163.com/TOPIC/DETAIL/9308858
AVG.163.com/TOPIC/DETAIL/9303820
AVG.163.com/TOPIC/DETAIL/9303882
AVG.163.com/TOPIC/DETAIL/9308819
AVG.163.com/TOPIC/DETAIL/9308821
AVG.163.com/TOPIC/DETAIL/9308817
AVG.163.com/TOPIC/DETAIL/9308858
AVG.163.com/TOPIC/DETAIL/9303820
AVG.163.com/TOPIC/DETAIL/9303882
AVG.163.com/TOPIC/DETAIL/9303936
AVG.163.com/TOPIC/DETAIL/9304315
AVG.163.com/TOPIC/DETAIL/9304640
AVG.163.com/TOPIC/DETAIL/9305476
AVG.163.com/TOPIC/DETAIL/9305831
AVG.163.com/TOPIC/DETAIL/9306184
AVG.163.com/TOPIC/DETAIL/9306524
AVG.163.com/TOPIC/DETAIL/9306826
AVG.163.com/TOPIC/DETAIL/9307146
AVG.163.com/TOPIC/DETAIL/9307314
AVG.163.com/TOPIC/DETAIL/9307453
AVG.163.com/TOPIC/DETAIL/9307468
AVG.163.com/TOPIC/DETAIL/9307522
AVG.163.com/TOPIC/DETAIL/9307572
AVG.163.com/TOPIC/DETAIL/9307667
AVG.163.com/TOPIC/DETAIL/9307758
AVG.163.com/TOPIC/DETAIL/9307800
AVG.163.com/TOPIC/DETAIL/9307867
AVG.163.com/TOPIC/DETAIL/9307949
AVG.163.com/TOPIC/DETAIL/9308035
AVG.163.com/TOPIC/DETAIL/9308114
AVG.163.com/TOPIC/DETAIL/9308138
AVG.163.com/TOPIC/DETAIL/9308205
AVG.163.com/TOPIC/DETAIL/9308268
AVG.163.com/TOPIC/DETAIL/9308370
AVG.163.com/TOPIC/DETAIL/9308409
AVG.163.com/TOPIC/DETAIL/9303822
AVG.163.com/TOPIC/DETAIL/9303884
AVG.163.com/TOPIC/DETAIL/9303941
AVG.163.com/TOPIC/DETAIL/9304343
AVG.163.com/TOPIC/DETAIL/9304655
AVG.163.com/TOPIC/DETAIL/9305062
AVG.163.com/TOPIC/DETAIL/9305475
AVG.163.com/TOPIC/DETAIL/9305845
AVG.163.com/TOPIC/DETAIL/9306304
AVG.163.com/TOPIC/DETAIL/9306541
AVG.163.com/TOPIC/DETAIL/9306917
AVG.163.com/TOPIC/DETAIL/9307186
AVG.163.com/TOPIC/DETAIL/9307326
AVG.163.com/TOPIC/DETAIL/9307452
AVG.163.com/TOPIC/DETAIL/9307467
AVG.163.com/TOPIC/DETAIL/9307523
AVG.163.com/TOPIC/DETAIL/9307577
AVG.163.com/TOPIC/DETAIL/9307669
AVG.163.com/TOPIC/DETAIL/9307685
AVG.163.com/TOPIC/DETAIL/9307787
AVG.163.com/TOPIC/DETAIL/9307805
AVG.163.com/TOPIC/DETAIL/9307872
AVG.163.com/TOPIC/DETAIL/9307955
AVG.163.com/TOPIC/DETAIL/9308003
AVG.163.com/TOPIC/DETAIL/9308089
AVG.163.com/TOPIC/DETAIL/9308149
AVG.163.com/TOPIC/DETAIL/9308206
AVG.163.com/TOPIC/DETAIL/9308287
AVG.163.com/TOPIC/DETAIL/9308371
AVG.163.com/TOPIC/DETAIL/9308410
AVG.163.com/TOPIC/DETAIL/9303816
AVG.163.com/TOPIC/DETAIL/9303880
AVG.163.com/TOPIC/DETAIL/9303933
AVG.163.com/TOPIC/DETAIL/9304286
AVG.163.com/TOPIC/DETAIL/9304642
AVG.163.com/TOPIC/DETAIL/9305048
AVG.163.com/TOPIC/DETAIL/9305535
AVG.163.com/TOPIC/DETAIL/9305792
AVG.163.com/TOPIC/DETAIL/9305983
AVG.163.com/TOPIC/DETAIL/9306453
AVG.163.com/TOPIC/DETAIL/9306820
AVG.163.com/TOPIC/DETAIL/9307142
AVG.163.com/TOPIC/DETAIL/9307313
AVG.163.com/TOPIC/DETAIL/9307465
AVG.163.com/TOPIC/DETAIL/9307519
AVG.163.com/TOPIC/DETAIL/9307567
AVG.163.com/TOPIC/DETAIL/9307629
AVG.163.com/TOPIC/DETAIL/9307682
AVG.163.com/TOPIC/DETAIL/9307741
AVG.163.com/TOPIC/DETAIL/9307797
AVG.163.com/TOPIC/DETAIL/9307862
AVG.163.com/TOPIC/DETAIL/9307943
AVG.163.com/TOPIC/DETAIL/9308081
AVG.163.com/TOPIC/DETAIL/9308132
AVG.163.com/TOPIC/DETAIL/9308202
AVG.163.com/TOPIC/DETAIL/9308265
AVG.163.com/TOPIC/DETAIL/9308350
AVG.163.com/TOPIC/DETAIL/9308401
AVG.163.com/TOPIC/DETAIL/9303785
AVG.163.com/TOPIC/DETAIL/9303883
AVG.163.com/TOPIC/DETAIL/9303937
AVG.163.com/TOPIC/DETAIL/9304326
AVG.163.com/TOPIC/DETAIL/9304514
AVG.163.com/TOPIC/DETAIL/9305053
AVG.163.com/TOPIC/DETAIL/9305478
AVG.163.com/TOPIC/DETAIL/9305861
AVG.163.com/TOPIC/DETAIL/9306188
AVG.163.com/TOPIC/DETAIL/9306478
AVG.163.com/TOPIC/DETAIL/9307032
AVG.163.com/TOPIC/DETAIL/9307177
AVG.163.com/TOPIC/DETAIL/9307454
AVG.163.com/TOPIC/DETAIL/9307521
AVG.163.com/TOPIC/DETAIL/9307574
AVG.163.com/TOPIC/DETAIL/9307665
AVG.163.com/TOPIC/DETAIL/9307684
AVG.163.com/TOPIC/DETAIL/9307786
AVG.163.com/TOPIC/DETAIL/9307804
AVG.163.com/TOPIC/DETAIL/9307866
AVG.163.com/TOPIC/DETAIL/9307950
AVG.163.com/TOPIC/DETAIL/9307987
AVG.163.com/TOPIC/DETAIL/9308086
AVG.163.com/TOPIC/DETAIL/9308139
AVG.163.com/TOPIC/DETAIL/9308204
AVG.163.com/TOPIC/DETAIL/9308271
AVG.163.com/TOPIC/DETAIL/9308375
AVG.163.com/TOPIC/DETAIL/9308408
AVG.163.com/TOPIC/DETAIL/9303817
AVG.163.com/TOPIC/DETAIL/9303881
AVG.163.com/TOPIC/DETAIL/9303935
AVG.163.com/TOPIC/DETAIL/9304294
AVG.163.com/TOPIC/DETAIL/9304656
AVG.163.com/TOPIC/DETAIL/9305044
AVG.163.com/TOPIC/DETAIL/9305460
AVG.163.com/TOPIC/DETAIL/9305808
AVG.163.com/TOPIC/DETAIL/9306174
AVG.163.com/TOPIC/DETAIL/9306471
AVG.163.com/TOPIC/DETAIL/9307140
AVG.163.com/TOPIC/DETAIL/9307315
AVG.163.com/TOPIC/DETAIL/9307412
AVG.163.com/TOPIC/DETAIL/9307466
AVG.163.com/TOPIC/DETAIL/9307520
AVG.163.com/TOPIC/DETAIL/9307571
AVG.163.com/TOPIC/DETAIL/9307632
AVG.163.com/TOPIC/DETAIL/9307742
AVG.163.com/TOPIC/DETAIL/9307799
AVG.163.com/TOPIC/DETAIL/9307864
AVG.163.com/TOPIC/DETAIL/9307945
AVG.163.com/TOPIC/DETAIL/9308030
AVG.163.com/TOPIC/DETAIL/9308083
AVG.163.com/TOPIC/DETAIL/9308203
AVG.163.com/TOPIC/DETAIL/9308267
AVG.163.com/TOPIC/DETAIL/9308402
AVG.163.com/TOPIC/DETAIL/9308429
AVG.163.com/TOPIC/DETAIL/9303808
AVG.163.com/TOPIC/DETAIL/9303879
AVG.163.com/TOPIC/DETAIL/9303924
AVG.163.com/TOPIC/DETAIL/9304206
AVG.163.com/TOPIC/DETAIL/9304622
AVG.163.com/TOPIC/DETAIL/9305012
AVG.163.com/TOPIC/DETAIL/9305415
AVG.163.com/TOPIC/DETAIL/9305767
AVG.163.com/TOPIC/DETAIL/9306148
AVG.163.com/TOPIC/DETAIL/9306431
AVG.163.com/TOPIC/DETAIL/9307029
AVG.163.com/TOPIC/DETAIL/9307083
AVG.163.com/TOPIC/DETAIL/9307306
AVG.163.com/TOPIC/DETAIL/9307402
AVG.163.com/TOPIC/DETAIL/9307455
AVG.163.com/TOPIC/DETAIL/9307509
AVG.163.com/TOPIC/DETAIL/9307561
AVG.163.com/TOPIC/DETAIL/9307623
AVG.163.com/TOPIC/DETAIL/9307677
AVG.163.com/TOPIC/DETAIL/9307729
AVG.163.com/TOPIC/DETAIL/9307794
AVG.163.com/TOPIC/DETAIL/9307932
AVG.163.com/TOPIC/DETAIL/9307968
AVG.163.com/TOPIC/DETAIL/9308020
AVG.163.com/TOPIC/DETAIL/9308074
AVG.163.com/TOPIC/DETAIL/9308127
AVG.163.com/TOPIC/DETAIL/9308195
AVG.163.com/TOPIC/DETAIL/9308249
AVG.163.com/TOPIC/DETAIL/9308318
AVG.163.com/TOPIC/DETAIL/9308437
AVG.163.com/TOPIC/DETAIL/9303809
AVG.163.com/TOPIC/DETAIL/9303870
AVG.163.com/TOPIC/DETAIL/9303925
AVG.163.com/TOPIC/DETAIL/9304222
AVG.163.com/TOPIC/DETAIL/9304618
AVG.163.com/TOPIC/DETAIL/9305015
AVG.163.com/TOPIC/DETAIL/9305383
AVG.163.com/TOPIC/DETAIL/9305757
AVG.163.com/TOPIC/DETAIL/9306136
AVG.163.com/TOPIC/DETAIL/9306414
AVG.163.com/TOPIC/DETAIL/9306491
AVG.163.com/TOPIC/DETAIL/9307077
AVG.163.com/TOPIC/DETAIL/9307305
AVG.163.com/TOPIC/DETAIL/9307403
AVG.163.com/TOPIC/DETAIL/9307459
AVG.163.com/TOPIC/DETAIL/9307514
AVG.163.com/TOPIC/DETAIL/9307560
AVG.163.com/TOPIC/DETAIL/9307622
AVG.163.com/TOPIC/DETAIL/9307675
AVG.163.com/TOPIC/DETAIL/9307728
AVG.163.com/TOPIC/DETAIL/9307793
AVG.163.com/TOPIC/DETAIL/9307841
AVG.163.com/TOPIC/DETAIL/9307928
AVG.163.com/TOPIC/DETAIL/9308016
AVG.163.com/TOPIC/DETAIL/9308084
AVG.163.com/TOPIC/DETAIL/9308112
AVG.163.com/TOPIC/DETAIL/9308208
AVG.163.com/TOPIC/DETAIL/9308244
AVG.163.com/TOPIC/DETAIL/9308319
AVG.163.com/TOPIC/DETAIL/9303811
AVG.163.com/TOPIC/DETAIL/9303875
AVG.163.com/TOPIC/DETAIL/9303929
AVG.163.com/TOPIC/DETAIL/9304225
AVG.163.com/TOPIC/DETAIL/9304632
AVG.163.com/TOPIC/DETAIL/9305025
AVG.163.com/TOPIC/DETAIL/9305428
AVG.163.com/TOPIC/DETAIL/9305776
AVG.163.com/TOPIC/DETAIL/9306289
AVG.163.com/TOPIC/DETAIL/9306772
AVG.163.com/TOPIC/DETAIL/9307107
AVG.163.com/TOPIC/DETAIL/9307307
AVG.163.com/TOPIC/DETAIL/9307406
AVG.163.com/TOPIC/DETAIL/9307464
AVG.163.com/TOPIC/DETAIL/9307517
AVG.163.com/TOPIC/DETAIL/9307563
AVG.163.com/TOPIC/DETAIL/9307625
AVG.163.com/TOPIC/DETAIL/9307679
AVG.163.com/TOPIC/DETAIL/9307737
AVG.163.com/TOPIC/DETAIL/9307743
AVG.163.com/TOPIC/DETAIL/9307851
AVG.163.com/TOPIC/DETAIL/9307936
AVG.163.com/TOPIC/DETAIL/9308023
AVG.163.com/TOPIC/DETAIL/9308078
AVG.163.com/TOPIC/DETAIL/9308133
AVG.163.com/TOPIC/DETAIL/9308197
AVG.163.com/TOPIC/DETAIL/9308256
AVG.163.com/TOPIC/DETAIL/9308330
AVG.163.com/TOPIC/DETAIL/9303810
AVG.163.com/TOPIC/DETAIL/9303871
AVG.163.com/TOPIC/DETAIL/9303926
AVG.163.com/TOPIC/DETAIL/9304224
AVG.163.com/TOPIC/DETAIL/9304629
AVG.163.com/TOPIC/DETAIL/9305352
AVG.163.com/TOPIC/DETAIL/9305409
AVG.163.com/TOPIC/DETAIL/9305773
AVG.163.com/TOPIC/DETAIL/9306153
AVG.163.com/TOPIC/DETAIL/9306764
AVG.163.com/TOPIC/DETAIL/9307091
AVG.163.com/TOPIC/DETAIL/9307308
AVG.163.com/TOPIC/DETAIL/9307461
AVG.163.com/TOPIC/DETAIL/9307504
AVG.163.com/TOPIC/DETAIL/9307570
AVG.163.com/TOPIC/DETAIL/9307624
AVG.163.com/TOPIC/DETAIL/9307678
AVG.163.com/TOPIC/DETAIL/9307795
AVG.163.com/TOPIC/DETAIL/9307846
AVG.163.com/TOPIC/DETAIL/9308017
AVG.163.com/TOPIC/DETAIL/9308059
AVG.163.com/TOPIC/DETAIL/9308077
AVG.163.com/TOPIC/DETAIL/9308131
AVG.163.com/TOPIC/DETAIL/9308198
AVG.163.com/TOPIC/DETAIL/9308252
AVG.163.com/TOPIC/DETAIL/9308322
AVG.163.com/TOPIC/DETAIL/9308396
AVG.163.com/TOPIC/DETAIL/9303866
AVG.163.com/TOPIC/DETAIL/9303927
AVG.163.com/TOPIC/DETAIL/9304616
AVG.163.com/TOPIC/DETAIL/9304998
AVG.163.com/TOPIC/DETAIL/9305396
AVG.163.com/TOPIC/DETAIL/9305751
AVG.163.com/TOPIC/DETAIL/9306404
AVG.163.com/TOPIC/DETAIL/9306757
AVG.163.com/TOPIC/DETAIL/9307143
AVG.163.com/TOPIC/DETAIL/9307304
AVG.163.com/TOPIC/DETAIL/9307458
AVG.163.com/TOPIC/DETAIL/9307462
AVG.163.com/TOPIC/DETAIL/9307510
AVG.163.com/TOPIC/DETAIL/9307569
AVG.163.com/TOPIC/DETAIL/9307621
AVG.163.com/TOPIC/DETAIL/9307674
AVG.163.com/TOPIC/DETAIL/9307725
AVG.163.com/TOPIC/DETAIL/9307791
AVG.163.com/TOPIC/DETAIL/9307839
AVG.163.com/TOPIC/DETAIL/9307925
AVG.163.com/TOPIC/DETAIL/9308015
AVG.163.com/TOPIC/DETAIL/9308065
AVG.163.com/TOPIC/DETAIL/9308126
AVG.163.com/TOPIC/DETAIL/9308196
AVG.163.com/TOPIC/DETAIL/9308317
AVG.163.com/TOPIC/DETAIL/9308392
AVG.163.com/TOPIC/DETAIL/9303807
AVG.163.com/TOPIC/DETAIL/9303865
AVG.163.com/TOPIC/DETAIL/9303919
AVG.163.com/TOPIC/DETAIL/9304218
AVG.163.com/TOPIC/DETAIL/9304600
AVG.163.com/TOPIC/DETAIL/9305034
AVG.163.com/TOPIC/DETAIL/9305356
AVG.163.com/TOPIC/DETAIL/9305736
AVG.163.com/TOPIC/DETAIL/9306129
AVG.163.com/TOPIC/DETAIL/9306396
AVG.163.com/TOPIC/DETAIL/9306907
AVG.163.com/TOPIC/DETAIL/9307047
AVG.163.com/TOPIC/DETAIL/9307300
AVG.163.com/TOPIC/DETAIL/9307396
AVG.163.com/TOPIC/DETAIL/9307441
AVG.163.com/TOPIC/DETAIL/9307501
AVG.163.com/TOPIC/DETAIL/9307551
AVG.163.com/TOPIC/DETAIL/9307611
AVG.163.com/TOPIC/DETAIL/9307661
AVG.163.com/TOPIC/DETAIL/9307720
AVG.163.com/TOPIC/DETAIL/9307779
AVG.163.com/TOPIC/DETAIL/9307845
AVG.163.com/TOPIC/DETAIL/9307919
AVG.163.com/TOPIC/DETAIL/9308010
AVG.163.com/TOPIC/DETAIL/9308060
AVG.163.com/TOPIC/DETAIL/9308123
AVG.163.com/TOPIC/DETAIL/9308187
AVG.163.com/TOPIC/DETAIL/9308245
AVG.163.com/TOPIC/DETAIL/9308312
AVG.163.com/TOPIC/DETAIL/9308381
AVG.163.com/TOPIC/DETAIL/9303805
AVG.163.com/TOPIC/DETAIL/9303863
AVG.163.com/TOPIC/DETAIL/9303922
AVG.163.com/TOPIC/DETAIL/9304219
AVG.163.com/TOPIC/DETAIL/9304916
AVG.163.com/TOPIC/DETAIL/9305367
AVG.163.com/TOPIC/DETAIL/9305738
AVG.163.com/TOPIC/DETAIL/9306128
AVG.163.com/TOPIC/DETAIL/9306411
AVG.163.com/TOPIC/DETAIL/9306950
AVG.163.com/TOPIC/DETAIL/9307062
AVG.163.com/TOPIC/DETAIL/9307301
AVG.163.com/TOPIC/DETAIL/9307401
AVG.163.com/TOPIC/DETAIL/9307445
AVG.163.com/TOPIC/DETAIL/9307502
AVG.163.com/TOPIC/DETAIL/9307554
AVG.163.com/TOPIC/DETAIL/9307617
AVG.163.com/TOPIC/DETAIL/9307662
AVG.163.com/TOPIC/DETAIL/9307722
AVG.163.com/TOPIC/DETAIL/9307783
AVG.163.com/TOPIC/DETAIL/9307834
AVG.163.com/TOPIC/DETAIL/9307964
AVG.163.com/TOPIC/DETAIL/9308008
AVG.163.com/TOPIC/DETAIL/9308062
AVG.163.com/TOPIC/DETAIL/9308124
AVG.163.com/TOPIC/DETAIL/9308191
AVG.163.com/TOPIC/DETAIL/9308246
AVG.163.com/TOPIC/DETAIL/9308313
AVG.163.com/TOPIC/DETAIL/9308384
AVG.163.com/TOPIC/DETAIL/9303787
AVG.163.com/TOPIC/DETAIL/9303869
AVG.163.com/TOPIC/DETAIL/9303923
AVG.163.com/TOPIC/DETAIL/9304220
AVG.163.com/TOPIC/DETAIL/9304878
AVG.163.com/TOPIC/DETAIL/9305004
AVG.163.com/TOPIC/DETAIL/9305360
AVG.163.com/TOPIC/DETAIL/9305780
AVG.163.com/TOPIC/DETAIL/9306197
AVG.163.com/TOPIC/DETAIL/9306756
AVG.163.com/TOPIC/DETAIL/9307064
AVG.163.com/TOPIC/DETAIL/9307302
AVG.163.com/TOPIC/DETAIL/9307399
AVG.163.com/TOPIC/DETAIL/9307446
AVG.163.com/TOPIC/DETAIL/9307503
AVG.163.com/TOPIC/DETAIL/9307559
AVG.163.com/TOPIC/DETAIL/9307618
AVG.163.com/TOPIC/DETAIL/9307663
AVG.163.com/TOPIC/DETAIL/9307723
AVG.163.com/TOPIC/DETAIL/9307790
AVG.163.com/TOPIC/DETAIL/9307838
AVG.163.com/TOPIC/DETAIL/9307922
AVG.163.com/TOPIC/DETAIL/9308014
AVG.163.com/TOPIC/DETAIL/9308063
AVG.163.com/TOPIC/DETAIL/9308125
AVG.163.com/TOPIC/DETAIL/9308193
AVG.163.com/TOPIC/DETAIL/9308248
AVG.163.com/TOPIC/DETAIL/9308315
AVG.163.com/TOPIC/DETAIL/9308386
AVG.163.com/TOPIC/DETAIL/9303802
AVG.163.com/TOPIC/DETAIL/9303861
AVG.163.com/TOPIC/DETAIL/9303917
AVG.163.com/TOPIC/DETAIL/9303844
AVG.163.com/TOPIC/DETAIL/9303857
AVG.163.com/TOPIC/DETAIL/9303912
本电子书由CyberArticle制作。点击这里下载CyberArticle。注册版本不会显示该信息。 删除广告
1 V7防火墙使用默认证书配置SSL VPN IP资源典型案例（命令行配置）
2 目录
1
5.4 新建SSL VPN用户，关联SSLVPN资源组... 4
5.5 将SSL VPN端口加入安全域，放通对应安全策略... 4
本案例适用于软件平台为Comware V7系列防火墙：F100-X-G2、F1000-X-G2、F100-X-WiNet、F1000-AK、F10X0等。
注：本案例是在F1000-C-G2的Version 7.1.064, Release 9323P19版本上进行配置和验证的。
V7防火墙设备作为出口设备，外网PC通过inode软件拨SSLVPN，认证成功后可以访问内网192.168.10.0网段的资源。IP地址及接口规划如下表所示：
|
外网接口 |
公网地址/掩码 |
内网接口 |
内网地址/掩码 |
|
GE1/0/1 |
222.1.1.100/24 |
GE1/0/3 |
192.168.10.1/24 |
防火墙上网配置请参考“2.2.2 防火墙外网使用固定IP地址上网配置方法”进行配置，本文只针对SSLVPN配置进行介绍。
5.2 配置SSL VPN网关
#SSLVPN网关IP地址填写防火墙1口地址222.1.1.1.00，端口号修改为4433，缺省端口为443，443端口和https端口冲突，然后使能网关配置。
<H3C>sys //进入系统视图
[H3C]sslvpn gateway SSLVPNGW //创建sslvpn网关 名称SSLVPNGW
[H3C-sslvpn-gateway-SSLVPNGW]ip address 222.1.1.100 port 4433 // SLVPN网关IP地址填写防火墙1口地址222.1.1.1.00，端口号修改为4433(默认443和网关冲突)
[H3C-sslvpn-gateway-SSLVPNGW]service enable //使能sslvpn
[H3C-sslvpn-gateway-SSLVPNGW]quit //退出
#创建SSL VPN AC接口1,配置接口IP为10.10.10.1/24
[H3C]interface SSLVPN-AC 1 //创建SSL VPN AC接口1
[H3C-SSLVPN-AC1] ip address 10.10.10.1 255.255.255.0 //配置接口IP为10.10.10.1 掩码255.255.255.0
[H3C-SSLVPN-AC1]quit //退出当前视图
#创建地址池名称为“SSLPOOL”，指定IP地址范围为10.10.10.2——10.10.10.254
[H3C]sslvpn ip address-pool SSLPOOL 10.10.10.2 10.10.10.254
#创建ACL 3999，允许SSL VPN用户访问的内网资源192.168.10.0/24网段
[H3C]acl advanced 3999 //创建ACL 3999
[H3C-acl-ipv4-adv-3999]rule permit ip destination 192.168.10.0 0.0.0.255 //创建规则,允许SSL VPN用户访问的内网资源192.168.10.0/24网段
[H3C-acl-ipv4-adv-3999]quit //退出当前视图
5.3 配置SSL VPN实例
# 配置SSL VPN访问实例“SSLVPNSL”引用SSL VPN网关“SSLVPNGW”
[H3C] sslvpn context SSLVPN //创建SSL VPN访问实例“SSLVPNSL”
[H3C-sslvpn-context-SSLVPN]gateway SSLVPNGW //引用SSL VPN网关“SSLVPNGW”
#引用SSL VPN接口1
[H3C-sslvpn-context-SSLVPN] ip-tunnel interface SSLVPN-AC1 //引用SSL VPN接口1
#引用SSL VPN地址池，掩码和dns
[H3C-sslvpn-context-SSLVPN]ip-tunnel address-pool SSLPOOL mask 255.255.255.0 //引用SSL VPN地址池，掩码
[H3C-sslvpn-context-SSLVPN]ip-tunnel dns-server primary 114.114.114.114 //设置客户端dns服务器
#创建路由列表“NEIWANG”，添加路由表项192.168.10.0/24
[H3C-sslvpn-context-SSLVPN] ip-route-list NEIWANG //创建路由列表“NEIWANG”
[H3C-sslvpn-context-SSLVPN-route-list-NEIWANG] include 192.168.10.0 255.255.255.0 //添加路由表项192.168.10.0/24
# 创建SSL VPN策略组“SSLVPNZIYUAN”，引用路由列表“NEIWANG”，配置ACL限制，只有通过ACL检查的报文才可以访问IP资源
[H3C-sslvpn-context-SSLVPN] policy-group SSLVPNZIYUAN //创建SSL VPN策略组“SSLVPNZIYUAN”
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]filter ip-tunnel acl 3999 //配置ACL限制，只有通过ACL检查的报文才可以访问IP资源
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]ip-tunnel access-route ip-route-list NEIWANG //引用路由列表“NEIWANG”
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]quit //退出
[H3C-sslvpn-context-SSLVPN] service enable //使能sslvpn策略组
[H3C-sslvpn-context-SSLVPN]quit //退出
5.4 新建SSL VPN用户，关联SSLVPN资源组
#创建SSLVPN本地用户,配置用户名密码user1,服务类型sslvpn，引用之前创建的SSLVPN资源组
[H3C]local-user user1 class network //创建SSLVPN本地用户,配置用户名密码user1,
[H3C-luser-network-user1]password simple user1 //配置密码user1
[H3C-luser-network-user1]service-type sslvpn //服务类型sslvpn
[H3C-luser-network-user1]authorization-attribute sslvpn-policy-group SSLVPNZIYUAN //引用所创建的SSLVPN资源组SSLVPNZIYUAN
[H3C-luser-network-user1]quit //退出
5.5 将SSL VPN端口加入安全域，放通对应安全策略
#新建安全域，名称为“SSLVPN”，将SSL VPN端口1加入到安全域“SSLVPN”
[H3C]security-zone name SSLVPN //新建安全域，名称为“SSLVPN”
[H3C-security-zone-SSLVPN]import interface SSLVPN-AC1 //将SSL VPN端口1加入到安全域“SSLVPN”
[H3C-security-zone-SSLVPN]quit //退出
#创建服务对象组，组名称为4433，匹配SSLVPN端
[H3C]object-group service 4433 //创建服务对象组，组名称为4433
[H3C-obj-grp-service-4433]service tcp destination eq 4433 //添加服务为tcp的目的端口4433
[H3C-obj-grp-service-4433]quit //退出当前视图
#配置安全策略将Untrust到Local域目的端口为TCP4433端口放通
[H3C]security-policy ip //配置安全策略
[H3C-security-policy-ip]rule 5 name Untrst-Local //创建规则5名字Untrst-Local
[H3C-security-policy-ip-5-Untrst-Local]action pass //动作允许
[H3C-security-policy-ip-5-Untrst-Local]source-zone Untrust //添加源安全域Untrust
[H3C-security-policy-ip-5-Untrst-Local]destination-zone Local //添加目的安全域trust
[H3C-security-policy-ip-5-Untrst-Local]service 4433 //调用服务对象组4433
[H3C-security-policy-ip-5-Untrst-Local]quit //退出当前视图
#配置配置安全策略,放通源安全域为SSLVPN，目前安全域为“Trust”的数据流量
[H3C-security-policy-ip]rule 10 name SSLVPN-Trust //创建规则10 名字SSLVPN-Trust
[H3C-security-policy-ip-10-SSLVPN-Trust] action pass //动作允许
[H3C-security-policy-ip-10-SSLVPN-Trust] source-zone SSLVPN //添加源安全域SSLVPN
[H3C-security-policy-ip-10-SSLVPN-Trust] destination-zone Trust /添加目的安全域trust
[H3C-security-policy-ip-10-SSLVPN-Trust]quit //退出
[H3C]save force
<H3C>dis sslvpn session verbose
User : user1
Context : SSLVPN
Policy group :SSLVPNZIYUAN
Idle timeout : 30 min
Created at : 18:16:02 UTC Sun 08/26/2018
Lastest : 18:32:32 UTC Sun 08/26/2018
User IPv4 address : 222.1.1.99
Alloced IP : 10.10.10.2
Session ID : 3
Web browser/OS : Windows
1、本案例适应的是默认证书，不需要手工导入CA证书和本地正常
2、不需要配置SSL服务器端策略，SSLVPN网关不需要引用SSL服务器端策略
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论