防火墙配置SSLVPN，域间策略需要怎么放通

将对应interfyuace SSLVPN-AC加入对应安全域名。类似

security-zone name Trust
import interface GigabitEthernet1/0/2
import interface SSLVPN-AC1

再将对应的安全策略加上就行

untrust到local trust都需要。 

您好，请知：

域间策略都放通，确保SSL VPN的业务访问没有问题，后期再逐步修改策略。

以下是域间策略的放通配置脚本，请参考：

[SSL_VPN]acl basic 2001

[SSL_VPN-acl-ipv4-basic-2001]rule 0 permit source any

[SSL_VPN-acl-ipv4-basic-2001]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source trust destination untrust

[SSL_VPN-zone-pair-security-Trust-Untrust]packet-filter 2001

[SSL_VPN-zone-pair-security-Trust-Untrust]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source untrust destination trust

[SSL_VPN-zone-pair-security-Untrust-Trust]packet-filter 2001

[SSL_VPN-zone-pair-security-Untrust-Trust]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source trust destination local

[SSL_VPN-zone-pair-security-Trust-Local]packet-filter 2001

[SSL_VPN-zone-pair-security-Trust-Local]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source local destination trust

[SSL_VPN-zone-pair-security-Local-Trust]packet-filter 2001

[SSL_VPN-zone-pair-security-Local-Trust]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source untrust destination local

[SSL_VPN-zone-pair-security-Untrust-Local]packet-filter 2001

[SSL_VPN-zone-pair-security-Untrust-Local]quit

[SSL_VPN]

[SSL_VPN]zone-pair security source local destination untrust

[SSL_VPN-zone-pair-security-Local-Untrust]packet-filter 2001

[SSL_VPN-zone-pair-security-Local-Untrust]quit

另外给您提供下下SSL VPN的WEB、TCP、IP方式的案例，请参考：

https://zhiliao.h3c.com/theme/details/102210 

https://zhiliao.h3c.com/theme/details/101781

https://zhiliao.h3c.com/theme/details/101816