防火墙配置ssl vpn,对不同的vpn账号赋予不同的权限,比如某些账号可访问内网全网段,某一个账号只能访问内网某一两个网段
(0)
最佳答案
配置用户组,把对应的用户local-user加入对应的用户组
#
user-group usergroup
authorization-attribute sslvpn-policy-group pgroup
#
user-group usergroup1
authorization-attribute sslvpn-policy-group pgroup1
#配置PKI域
pki domain sslvpn
public-key rsa general name sslvpn
undo crl check enable
#配置ssl策略
ssl server-policy ssl
pki-domain sslvpn
#配置netconf参数
netconf soap http enable
netconf soap https enable
netconf ssh server enable
#
ip https enable
webui log enable
#配置SSLVPN IP接入地址池
sslvpn ip address-pool ippool 100.0.0.2 100.0.0.254
#配置SSLVPN网关
sslvpn gateway gw
ip address 10.0.0.1 port 2000
ssl server-policy ssl
service enable
#
sslvpn context ctx
gateway gw
ip-tunnel interface SSLVPN-AC0
ip-tunnel address-pool ippool mask 255.255.255.0
#配置用户1可以访问的路由列表
ip-route-list iplist
include 20.0.0.0 255.255.255.0
include 192.168.206.0 255.255.254.0
#配置用户2可以访问的路由列表
ip-route-list iplist1
include 30.0.0.0 255.255.255.0
include 192.168.206.0 255.255.254.0
#配置IP接入要访问的资源快捷方式
shortcut resource1
execution url('20.0.0.3:81')
shortcut-list resource1
resources shortcut resource1
shortcut resource2
execution url('30.0.0.3:81')
shortcut-list resource2
resources shortcut resource2
#配置用户1的资源池
policy-group pgroup
filter ip-tunnel acl 3001
ip-tunnel access-route force-all
ip-tunnel access-route ip-route-list iplist
resources shortcut-list resource1
#配置用户2的资源池
policy-group pgroup1
filter ip-tunnel acl 3002
ip-tunnel access-route ip-route-list iplist1
resources shortcut-list resource2
aaa domain sslvpn
(0)
#创建ACL 3999,允许SSL VPN用户访问的内网资源192.168.10.0/24网段
[H3C]acl advanced 3999
[H3C-acl-ipv4-adv-3999]rule permit ip destination 192.168.10.0 0.0.0.255
[H3C-acl-ipv4-adv-3999]quit
# 创建SSL VPN策略组“SSLVPNZIYUAN”,引用路由列表“NEIWANG”,配置ACL限制,只有通过ACL检查的报文才可以访问IP资源
[H3C-sslvpn-context-SSLVPN] policy-group SSLVPNZIYUAN
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]filter ip-tunnel acl 3999
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]ip-tunnel access-route ip-route-list NEIWANG
[H3C-sslvpn-context-SSLVPN-policy-group-SSLVPNZIYUAN]quit
[H3C-sslvpn-context-SSLVPN] service enable
[H3C-sslvpn-context-SSLVPN]quit
(0)
可能我问题描述的不太明白,我是需要对客户端拨号的账户赋予不同的权限的配置,比如user1拨号成功后可访问内网192.168.1.0-192.168.10.0,user2拨号成功后只能访问192.168.1.0,
可能我问题描述的不太明白,我是需要对客户端拨号的账户赋予不同的权限的配置,比如user1拨号成功后可访问内网192.168.1.0-192.168.10.0,user2拨号成功后只能访问192.168.1.0,
举一个例子,如下:
sslvpn context ctx
gateway gw
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list xxx 这是允许用户xxx访问的网段
include 10.222.161.1 255.255.255.255
include 10.223.9.253 255.255.255.255
ip-route-list zzz 这是允许用户zzz访问的网段
include 192.168.100.253 255.255.255.255
policy-group xxx
filter ip-tunnel acl 3000
ip-tunnel access-route ip-route-list gaj
policy-group zzz
filter ip-tunnel acl 3000
ip-tunnel access-route ip-route-list gzj
service enable
local-user xxx class network
auth sslvpn policy-group xxx
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明