F1000-AI-35 sslvpn

配置SSL VPN访问实例

# 配置SSL VPN访问实例ctxip，引用SSL VPN网关gw，指定域名为domainip。

[Device] sslvpn context ctxip

[Device-sslvpn-context-ctxip] gateway gw domain domainip

# 配置IP接入引用的SSL VPN AC接口1.

[Device-sslvpn-context-ctxip] ip-tunnel interface sslvpn-ac 1

# 创建路由表rtlist，并添加路由表项20.2.2.0/24。

[Device-sslvpn-context-ctxip] ip-route-list rtlist

[Device-sslvpn-context-ctxip-route-list-rtlist] include 20.2.2.0 24

[Device-sslvpn-context-ctxip-route-list-rtlist] quit

# 引用SSL VPN客户端地址池sslvpnpool。

[Device-sslvpn-context-ctxip] ip-tunnel address-pool sslvpnpool mask 24

# 创建SSL VPN策略组resourcegrp，引用路由列表rtlist，并同时配置对IP接入进行ACL过滤。

[Device-sslvpn-context-ctxip] policy-group resourcegrp

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] ip-tunnel access-route ip-route-list rtlist

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] filter ip-tunnel acl 3000

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] quit

# 开启SSL VPN访问实例ctxip。

[Device-sslvpn-context-ctxip] service enable

[Device-sslvpn-context-ctxip] quit

# 创建ACL 3000，规则为允许源IP为10.1.1.0/24的报文访问目标IP网段20.2.2.0/24。

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule permit ip source 10.1.1.0 0.0.0.255 destination 20.2.2.0 0.0.0.255

[Device-acl-ipv4-adv-3000] quit

(8)     配置SSL VPN用户

# 创建本地SSL VPN用户sslvpnuser，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为resourcegrp。

[Device] local-user sslvpnuser class network

[Device-luser-network-sslvpnuser] password simple 123456

[Device-luser-network-sslvpnuser] service-type sslvpn

[Device-luser-network-sslvpnuser] authorization-attribute sslvpn-policy-group resourcegrp

[Device-luser-network-sslvpnuser] authorization-attribute user-role network-operator

[Device-luser-network-sslvpnuser] quit