SecPath 1000F防火墙主模式IPSec with CA
自动申请典型配置指南
用户需要在主模式下,自动申请证书建立IPSec。
如图所示,SecPath1000F-A要与SecPath1000F-B建立基于证书的VPN。
软件版本如下:
SecPath1000F-A: VRP 3.40 ESS 1604;
SecPath1000F-B: VRP 3.40 ESS 1604;
1.基本配置命令
定义PKI Domain
pki domain ***.*** //Domain名称
ca identifier h3c //ca服务器的名称
certificate request url http://1.1.1.20/certsrv/mscep/mscep.dll //由于是自动发起,URL必须配置成证书服务器的URL
certificate request from ra //Windows2003仅支持RA模式
certificate request entity 1kf-2
crl check disable
PKI实体配置
pki entity ***.*** //PKI实体配置,此处名称应该与PKI Domain中的实体名称一样
common-name SecPath 1kf-2
locality ShangDi
state
country CN
fqdn 1kf-2.***.***
通过RSA生成公、私密钥对
[Quidway]rsa local-key-pair create
引入CA服务器证书
[Quidway] pki retrieval-certificate ca domain 1
查看指纹和CA证书的指纹是否一致,输入“Y”后,路由器自动引入CA证书
动态申请实体证书
[Quidway] pki request-certificate domain 1
防火墙自动完成注册申请,获得证书。(这是CA服务器配置为自动发放证书时结果。如果CA服务器配置为管理员颁发模式,路由器需要等待一段时间后才能获得证书,不能手动获取已经颁发的证书。)
防火墙 SecPath1000F-A的最终配置
SecPath1000F-A>dis cu
#
sysname SecPath1000F-A
#
firewall packet-filter enable
firewall packet-filter default permit
#
undo connection-limit enable
connection-limit default deny
connection-limit default amount upper-limit 50 lower-limit 20
#
firewall statistic system enable
#
pki entity 1kf-2
common-name SecPath 1kf-2
locality ShangDi
state
country CN
fqdn 1kf-2.***.***
#
pki domain ***.***
ca identifier h3c
certificate request url http://202.1.1.1/certsrv/mscep/mscep.dll
certificate request from ra
certificate request entity 1kf-2
crl check disable
#
radius scheme system
#
domain system
#
#
ike proposal 2
authentication-method rsa-signature
encryption-algorithm 3des-cbc
dh group5
#
ike peer peer
remote-address 202.38.162.1
certificate domain ***.***
#
ipsec proposal pro
transform ah-esp
esp authentication-algorithm md5
#
ipsec policy pol 1 isakmp
security acl 3000
ike-peer peer
proposal pro
#
acl number 3000
rule 1 permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.2
55
#
interface Aux0
async mode flow
#
interface GigabitEthernet0/0
ip address 202.38.163.1 255.255.255.0
ipsec policy pol
#
interface GigabitEthernet0/1
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0
ip address 192.168.1.2 255.255.255.0
#
interface GigabitEthernet1/1
#
interface Encrypt2/0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface GigabitEthernet0/0
add interface GigabitEthernet0/1
add interface GigabitEthernet1/0
add interface GigabitEthernet1/1
set priority 85
#
firewall zone untrust
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
ip route-static 0.0.0.0 0.0.0.0 202.38.163.2 preference 60
#
firewall defend syn-flood zone local
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
#
return
防火墙 SecPath1000F-B的最终配置
SecPath1000F-B>dis cu
#
sysname SecPath1000F-B
#
firewall packet-filter enable
firewall packet-filter default permit
#
connection-limit disable
connection-limit default deny
connection-limit default amount upper-limit 50 lower-limit 20
#
firewall statistic system enable
#
pki entity 1kf-2
common-name SecPath 1kf-2
locality ShangDi
state
country CN
fqdn 1kf-2.***.***
#
pki domain ***.***
ca identifier h3c
certificate request url http://202.1.1.1/certsrv/mscep/mscep.dll certificate request from ra
certificate request entity 1kf-2
crl check disable
#
radius scheme system
#
domain system
#
ike proposal 2
authentication-method rsa-signature
encryption-algorithm 3des-cbc
dh group5
#
ike peer peer
remote-address 202.38.163.1
certificate domain ***.***
#
ipsec proposal pro
transform ah-esp
esp authentication-algorithm md5
#
ipsec policy pol 1 isakmp
security acl 3000
ike-peer peer
proposal pro
#
acl number 3000
rule 1 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.2
55
#
interface Aux0
async mode flow
#
interface Ethernet1/0
#
interface GigabitEthernet0/0
ip address 202.38.162.1 255.255.255.0
ipsec policy pol
#
interface GigabitEthernet0/1
ip address 10.1.2.1 255.255.255.0
#
interface Encrypt2/0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface GigabitEthernet0/0
add interface GigabitEthernet0/1
set priority 85
#
firewall zone untrust
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
ip route-static 0.0.0.0 0.0.0.0 202.38.162.2 preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
#
return
IIKE配置时要要用RSA签名。
P配置IKE PEER时要采用申请的domain的证书 。
自动申请证书时,要指定证书服务器的地址。
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作