H3C SecPath F1000 920 AI配置SSL VPN？

35-SSL VPN IP接入方式典型配置举例 演示视频-新华三集团-H3C

轻轻松松配安全：https://zhiliao.h3c.com/topic/huati/1248这个案例集对你一定有帮助

这种需要自己导证书

#

 sysname H3C

#

context Admin id 1

#

 telnet server enable

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 password-recovery enable

#

vlan 1

#

interface NULL0

#

interface LoopBack1

 ip address 1.1.1.1 255.255.255.255

#

interface GigabitEthernet1/0/0

 port link-mode route

 ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface SSLVPN-AC0

 ip address 20.1.1.1 255.255.255.0

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

 import interface SSLVPN-AC0

#

security-zone name DMZ

#

security-zone name Untrust

#

security-zone name Management

 import interface GigabitEthernet1/0/0

#

 scheduler logfile size 16

#

 ssh server enable

#

acl advanced 3000

 rule 0 permit tcp destination-port eq telnet

#

domain system

#

 aaa session-limit ftp 16

 aaa session-limit telnet 16

 aaa session-limit ssh 16

 domain default enable system

#

user-group system

#

local-user admin class manage

 password hash $h$6$UbIhNnPevyKUwfpm$LqR3+yg1IjNct39MkOR0H0iQXLkYB3jMqM4vbAeoXOhbabIIFnjJPEGR00YiYA1Sz4LiY3FmEdru2fOLMb1shQ==

 service-type ftp

 service-type ssh telnet terminal https

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

local-user ds class manage

 authorization-attribute user-role network-operator

#

local-user ds class network

 password cipher $c$3$g21uDAe9coHWqbPix9mqJBgKqoWD/kjcWA==

 service-type sslvpn

 authorization-attribute user-role network-operator

 authorization-attribute sslvpn-policy-group pgroup

#

pki domain dsssl

 public-key rsa general name dsssl

 undo crl check enable

#

pki domain ssl

 public-key rsa general name ssl

 undo crl check enable

#

pki domain sslvpn

 undo crl check enable

#

ssl server-policy ssl

 pki-domain dsssl

#

 ftp server enable

#

 session statistics enable

#

 ip http enable

 ip https port 2001

 ip https enable

 webui log enable

#

sslvpn ip address-pool ippool 20.1.1.10 20.1.1.10

#

sslvpn gateway gw

 ip address 192.168.1.1 port 2000

 ssl server-policy ssl

 service enable

#

sslvpn context ctx

 gateway gw

 ip-tunnel interface SSLVPN-AC0

 ip-tunnel address-pool ippool mask 255.255.255.0

 ip-route-list iplist

  include 1.1.1.1 255.255.255.255

 policy-group pgroup

  filter ip-tunnel acl 3000

  ip-tunnel access-route ip-route-list iplist

 service enable

#

security-policy ip

 rule 0 name sslvpn

  action pass

  source-zone trust

  destination-zone local

#