F1020防火墙SSL VPN的基础配置

官网有配置案例，连接：http://www.h3c.com/cn/d_201901/1145529_30005_0.htm#_Toc534208454

Web接入配置举例（缺省证书）

1. 组网需求

Device为SSL VPN网关设备，连接公网用户和企业私有网络。SSL VPN用户通过Device能够安全地访问位于企业私有网络内的Server A和Server B。其中，Server A和Server B均为Web服务器，Sever A使用HTTP协议和80端口号，Sever B使用HTTPS协议和443端口号。具体需求如下：

·     Device对SSL VPN用户进行本地认证和本地授权；

·     User1仅能访问Server A；

·     User2仅能访问Server B。

2. 组网图

图1-11 Web接入组网图（缺省证书）

3. 配置步骤

(1)     配置接口IP地址、路由、安全域及域间安全策略保证网络可达，具体配置步骤略

(2)     配置SSL VPN网关

# 配置SSL VPN网关gw的IP地址为1.1.1.2，端口号为4430。

<Device> system-view

[Device] sslvpn gateway gw

[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 4430

[Device-sslvpn-gateway-gw] service enable

[Device-sslvpn-gateway-gw] quit

(3)     配置SSL VPN访问实例

# 配置SSL VPN访问实例ctxweb1，引用SSL VPN网关gw，指定域名为domainweb1。

[Device] sslvpn context ctxweb1

[Device-sslvpn-context-ctxweb1] gateway gw domain domainweb1

# 创建URL列表urllist。

[Device-sslvpn-context-ctxweb1] url-list urllist

# 配置URL列表标题为web。

[Device-sslvpn-context-ctxweb1-url-list-urllist] heading web

# 创建一个URL表项，链接名为serverA，对应的URL为http://20.2.2.2。

[Device-sslvpn-context-ctxweb1-url-list-urllist] url serverA url-value http://20.2.2.2

[Device-sslvpn-context-ctxweb1-url-list-urllist] quit

# SSL VPN访问实例ctx1下创建策略组resourcegrp1，引用URL列表urllist。

[Device-sslvpn-context-ctxweb1] policy-group resourcegrp1

[Device-sslvpn-context-ctxweb1-policy-group-resourcegrp1] resources url-list urllist

[Device-sslvpn-context-ctxweb1-policy-group-resourcegrp1] quit

# 开启SSL VPN访问实例ctxweb1。

[Device-sslvpn-context-ctxweb1] service enable

[Device-sslvpn-context-ctxweb1] quit

# 配置SSL VPN访问实例ctxweb2，引用SSL VPN网关gw，指定域名为domainweb2。

[Device] sslvpn context ctxweb2

[Device-sslvpn-context-ctxweb2] gateway gw domain domainweb2

# 创建URL列表urllist。

[Device-sslvpn-context-ctxweb2] url-list urllist

# 配置URL列表标题为web。

[Device-sslvpn-context-ctxweb2-url-list-urllist] heading web

# 创建一个URL表项，链接名为serverA，对应的URL为https://30.3.3.3。

[Device-sslvpn-context-ctxweb2-url-list-urllist] url serverB url-value https://30.3.3.3

[Device-sslvpn-context-ctxweb2-url-list-urllist] quit

# SSL VPN访问实例ctx1下创建策略组resourcegrp2，引用URL列表urllist。

[Device-sslvpn-context-ctxweb2] policy-group resourcegrp2

[Device-sslvpn-context-ctxweb2-policy-group-resourcegrp2] resources url-list urllist

[Device-sslvpn-context-ctxweb2-policy-group-resourcegrp2] quit

# 开启SSL VPN访问实例ctxweb2。

[Device-sslvpn-context-ctxweb2] service enable

[Device-sslvpn-context-ctxweb2] quit

(4)     配置SSL VPN用户

# 创建SSL VPN用户sslvpnuser1，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为resourcegrp1。

[Device] local-user sslvpnuser1 class network

[Device-luser-network-sslvpnuser1] password simple 123456

[Device-luser-network-sslvpnuser1] service-type sslvpn

[Device-luser-network-sslvpnuser1] authorization-attribute user-role network-operator

[Device-luser-network-sslvpnuser1] authorization-attribute sslvpn-policy-group resourcegrp1

[Device-luser-network-sslvpnuser1] quit

# 创建SSL VPN用户sslvpnuser2，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为resourcegrp2。

[Device] local-user sslvpnuser2 class network

[Device-luser-network-sslvpnuser2] password simple 123456

[Device-luser-network-sslvpnuser2] service-type sslvpn

[Device-luser-network-sslvpnuser2] authorization-attribute user-role network-operator

[Device-luser-network-sslvpnuser2] authorization-attribute sslvpn-policy-group resourcegrp2

[Device-luser-network-sslvpnuser2] quit

4. 验证配置

# 在Device上查看SSL VPN网关状态，可见SSL VPN网关gw处于Up状态。

[Device] display sslvpn gateway

Gateway name: gw

  Operation state: Up

  IP: 1.1.1.2  Port: 4430

  Front VPN instance: Not configured

# 在Device上查看SSL VPN访问实例状态，可见SSL VPN访问实例ctxweb1和ctxweb2均处于Up状态。

[Device] display sslvpn context

Context name: ctxweb1

  Operation state: Up

  AAA domain: Not specified

  Certificate authentication: Disabled

  Password authentication: Enabled

  Authentication use: All

  Dynamic password: Disabled

  Code verification: Disabled

  Default policy group: Not configured

  Associated SSL VPN gateway: gw

    Domain name: domainweb1

  Maximum users allowed: 1048575

  VPN instance: Not configured

  Idle timeout: 30 min

Context name: ctxweb2

  Operation state: Up

  AAA domain: Not specified

  Certificate authentication: Disabled

  Password authentication: Enabled

  Authentication use: All

  Dynamic password: Disabled

  Code verification: Disabled

  Default policy group: Not configured

  Associated SSL VPN gateway: gw

    Domain name: domainweb2

  Maximum users allowed: 1048575

  VPN instance: Not configured

  Idle timeout: 30 min

# SSL VPN用户sslvpnuser1在PC浏览器上输入https://1.1.1.2:4430/，进入Domain List页面，如下图所示。