如下图所示,Device为SSL VPN网关设备,连接公网用户和企业私有网络。用户通过Device可以通过IP接入方式安全地访问私有网络内的Server。Device通过RADIUS server采用远程认证和授权方式对用户进行认证和授权。
图-1 RADIUS认证、授权配置组网图
在开始下面的配置之前,假设已完成如下配置:
· Device已获取到CA证书ca.cer和服务器证书server.pfx,若SSL VPN网关不引用SSL 服务端策略,则使用设备缺省证书。
· Server上存在到达网段10.1.1.0/24的路由。
· RADIUS server已经部署完成,能够对用户进行认证和授权。
配置接口IP地址
# 根据组网图中规划的信息,配置各接口的IP地址,具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 1.1.1.2 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址,具体配置步骤略。
创建SSL VPN AC接口,用于转发IP接入流量
# 创建SSL VPN AC接口1,配置该接口的IP地址为10.1.1.100/24。
[Device] interface sslvpn-ac 1
[Device-SSLVPN-AC1] ip address 10.1.1.100 24
[Device-SSLVPN-AC1] quit
配置静态路由
本举例仅以静态路由方式配置路由信息。实际组网中,请根据具体情况选择相应的路由配置方式。
# 请根据组网图中规划的信息,配置静态路由,本举例假设到达Server的下一跳IP地址为2.2.2.3,到达User的下一跳IP地址为1.1.1.3实际使用中请以具体组网情况为准,具体配置步骤如下。
[Device] ip route-static 20.2.2.2 24 2.2.2.3
[Device] ip route-static 40.1.1.1 24 1.1.1.3
配置接口加入安全域。
# 请根据组网图中规划的信息,将接口加入对应的安全域,具体配置步骤如下。
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1
[Device-security-zone-Untrust] import interface sslvpn-ac 1
[Device-security-zone-Untrust] quit
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/2
[Device-security-zone-Trust] import interface gigabitethernet 1/0/3
[Device-security-zone-Trust] quit
配置安全策略放行Untrust与Local安全域之间的流量,用于用户访问SSL VPN网关设备。
# 配置名称为sslvpnlocalout1的安全策规则,使Device可以向用户发送报文,具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name sslvpnlocalout1
[Device-security-policy-ip-1-sslvpnlocalout1] source-zone local
[Device-security-policy-ip-1-sslvpnlocalout1] destination-zone untrust
[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 1.1.1.2
[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 10.1.1.100
[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-host 40.1.1.1
[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-subnet 10.1.1.0 24
[Device-security-policy-ip-1-sslvpnlocalout1] action pass
[Device-security-policy-ip-1-sslvpnlocalout1] quit
# 配置名称为sslvpnlocalin1的安全策略规则,使用户可以向Device发送报文,具体配置步骤如下。
[Device-security-policy-ip] rule name sslvpnlocalin1
[Device-security-policy-ip-2-sslvpnlocalin1] source-zone untrust
[Device-security-policy-ip-2-sslvpnlocalin1] destination-zone local
[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host 40.1.1.1
[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-subnet 10.1.1.0 24
[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 1.1.1.2
[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 10.1.1.100
[Device-security-policy-ip-2-sslvpnlocalin1] action pass
[Device-security-policy-ip-2-sslvpnlocalin1] quit
# 配置名称为sslvpnlocalout2的安全策规则,使Device可以向Server发送报文,具体配置步骤如下。
[Device-security-policy-ip] rule name sslvpnlocalout2
[Device-security-policy-ip-3-sslvpnlocalout2] source-zone local
[Device-security-policy-ip-3-sslvpnlocalout2] destination-zone trust
[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 2.2.2.2
[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 3.3.3.1
[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 20.2.2.2
[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 3.3.3.2
[Device-security-policy-ip-3-sslvpnlocalout2] action pass
[Device-security-policy-ip-3-sslvpnlocalout2] quit
# 配置名称为sslvpnlocalin2的安全策略规则,使Server可以向Device发送报文,具体配置步骤如下。
[Device-security-policy-ip] rule name sslvpnlocalin2
[Device-security-policy-ip-4-sslvpnlocalin2] source-zone trust
[Device-security-policy-ip-4-sslvpnlocalin2] destination-zone local
[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 20.2.2.2
[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 3.3.3.2
[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 2.2.2.2
[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 3.3.3.1
[Device-security-policy-ip-4-sslvpnlocalin2] action pass
[Device-security-policy-ip-4-sslvpnlocalin2] quit
# 配置名称为untrust-trust的安全策规则,使用户可以通过SSL VPN AC接口访问Server,具体配置步骤如下。
[Device-security-policy-ip] rule name untrust-trust
[Device-security-policy-ip-5-untrust-trust] source-zone untrust
[Device-security-policy-ip-5-untrust-trust] destination-zone trust
[Device-security-policy-ip-5-untrust-trust] source-ip-subnet 10.1.1.0 24
[Device-security-policy-ip-5-untrust-trust] destination-ip-host 20.2.2.2
[Device-security-policy-ip-5-untrust-trust] action pass
[Device-security-policy-ip-5-untrust-trust] quit
# 配置名称为trust-untrust的安全策略规则,使Server可以通过SSL VPN AC接口向用户发送报文,具体配置步骤如下。
[Device-security-policy-ip] rule name trust-untrust
[Device-security-policy-ip-6-trust-untrust] source-zone trust
[Device-security-policy-ip-6-trust-untrust] destination-zone untrust
[Device-security-policy-ip-6-trust-untrust] source-ip-host 20.2.2.2
[Device-security-policy-ip-6-trust-untrust] destination-ip-subnet 10.1.1.0 24
[Device-security-policy-ip-6-trust-untrust] action pass
[Device-security-policy-ip-6-trust-untrust] quit
[Device-security-policy-ip] quit
配置PKI域,设置证书申请所需的相关参数
[Device] pki domain sslvpn
[Device-pki-domain-sslvpn] public-key rsa general name sslvpn
[Device-pki-domain-sslvpn] undo crl check enable
[Device-pki-domain-sslvpn] quit
[Device] pki import domain sslvpn der ca filename ca.cer
[Device] pki import domain sslvpn p12 local filename server.pfx
配置SSL服务器端策略,引用PKI域
[Device] ssl server-policy ssl
[Device-ssl-server-policy-ssl] pki-domain sslvpn
[Device-ssl-server-policy-ssl] quit
配置SSL VPN网关,为用户提供访问SSL VPN网关的入口
# 配置SSL VPN网关gw的IP地址为1.1.1.2,端口号为2000,并引用SSL服务器端策略ssl。
[Device] sslvpn gateway gw
[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000
[Device-sslvpn-gateway-gw] ssl server-policy ssl
[Device-sslvpn-gateway-gw] service enable
[Device-sslvpn-gateway-gw] quit
创建SSL VPN客户端地址池,用于为IP接入客户端分配IP地址
# 创建地址池ippool,指定IP地址范围为10.1.1.1~10.1.1.10。
[Device] sslvpn ip address-pool ippool 10.1.1.1 10.1.1.10
配置RADIUS,用于远程认证SSL VPN用户
# 配置Radius方案rscheme,指定认证和授权服务器地址均为3.3.3.2、认证和授权的共享密钥均为123456、发送给RADIUS服务器的用户名格式为不携带ISP域名。
[Device] radius scheme rscheme
[Device-radius-rscheme] primary authentication 3.3.3.2
[Device-radius-rscheme] primary accounting 3.3.3.2
[Device-radius-rscheme] accounting-on enable
[Device-radius-rscheme] key authentication simple 123456
[Device-radius-rscheme] key accounting simple 123456
[Device-radius-rscheme] user-name-format without-domain
[Device-radius-rscheme] quit
配置用户组,基于用户组对用户进行授权
# 配置用户组group1,授权给该用户组的策略组为pgroup。
[Device] user-group group1
[Device-ugroup-group1] authorization-attribute sslvpn-policy-group pgroup
[Device-ugroup-group1] quit
配置ISP域,通过ISP域对SSL VPN用户进行认证
# 配置ISP域domain1,指定用户授权属性为用户组group1,认证、授权和计费使用的RADIUS方案为rscheme。
[Device] domain domain1
[Device-isp-domain1] authorization-attribute user-group group1
[Device-isp-domain1] authentication sslvpn radius-scheme rscheme
[Device-isp-domain1] authorization sslvpn radius-scheme rscheme
[Device-isp-domain1] accounting sslvpn radius-scheme rscheme
[Device-isp-domain1] quit
配置SSL VPN访问实例,为用户提供不同的SSL VPN服务
# 配置SSL VPN访问实例ctx引用SSL VPN网关gw。
[Device] sslvpn context ctx
[Device-sslvpn-context-ctx] gateway gw
[Device-sslvpn-context-ctx] aaa domain domain1
[Device-sslvpn-context-ctx] ip-route-list rtlist
[Device-sslvpn-context-ctx-route-list-rtlist] include 20.2.2.0 255.255.255.0
[Device-sslvpn-context-ctx-route-list-rtlist] quit
[Device-sslvpn-context-ctx] uri-acl uriacl
[Device-sslvpn-context-ctx-uri-acl-uriacl] rule 1 permit uri icmp://20.2.2.0
[Device-sslvpn-context-ctx-uri-acl-uriacl] quit
[Device-sslvpn-context-ctx] ip-tunnel interface sslvpn-ac 1
[Device-sslvpn-context-ctx] ip-tunnel address-pool ippool mask 255.255.255.0
[Device-sslvpn-context-ctx] policy-group pgroup
[Device-sslvpn-context-ctx-policy-group-pgroup] ip-tunnel access-route ip-route-list rtlist
[Device-sslvpn-context-ctx-policy-group-pgroup] filter ip-tunnel uri-acl uriacl
[Device-sslvpn-context-ctx-policy-group-pgroup] quit
[Device-sslvpn-context-ctx] service enable
[Device-sslvpn-context-ctx] quit
# 在Device上查看SSL VPN网关状态,可见SSL VPN网关gw处于Up状态。
[Device] display sslvpn gateway
Gateway name: gw
Operation state: Up
IP: 1.1.1.2 Port: 2000
SSL server policy configured: ssl
SSL server policy in use: ssl
Front VPN instance: Not configured
# 在Device上查看SSL VPN访问实例状态,可见SSL VPN访问实例ctx处于Up状态。
[Device] display sslvpn context
Context name: ctx
Operation state: Up
AAA domain: domain1
Certificate authentication: Disabled
Password authentication:Enabled
Authentication use: All
SMS auth type: Not configured
Urlmasking: Disabled
Code verification: Disabled
Default policy group: Not configured
Associated SSL VPN gateway: gw
Maximum users allowed: 1048575
VPN instance: Not configured
Idle timeout: 30 min
Authentication server-type: aaa
Password changing: Enabled
# 用户在PC上启动IP接入客户端软件,输入访问地址1.1.1.2、端口号2000、用户名sslvpn、密码123456,登录成功。
# 在Device上可以看到用户会话信息。
[Device] display sslvpn session context ctx
SSL VPN context: ctx
Users: 1
Username Connections Idle time Created User IP
sslvpn 6 0/00:02:05 0/00:03:14 40.1.1.1
# 在PC上查看IPv4路由表,其中40.1.1.1/24为本地网卡地址,10.1.1.1/24为SSL VPN网关设备分配给用户的地址,20.2.2.0/24为到达内部服务器Server的路由。
>route -4 print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
10.1.1.0 255.255.255.0 On-link 10.1.1.1 276
10.1.1.1 255.255.255.255 On-link 10.1.1.1 276
10.1.1.255 255.255.255.255 On-link 10.1.1.1 276
20.2.2.0 255.255.255.0 On-link 10.1.1.1 276
20.2.2.255 255.255.255.255 On-link 10.1.1.1 276
40.1.1.0 255.255.255.0 On-link 40.1.1.1 276
40.1.1.1 255.255.255.255 On-link 40.1.1.1 276
40.1.1.255 255.255.255.255 On-link 40.1.1.1 276
===========================================================================
# 在PC上可以Ping通服务器地址20.2.2.2。
C:\>ping 20.2.2.2
Pinging 20.2.2.2 with 32 bytes of data:
Reply from 20.2.2.2: bytes=32 time=197ms TTL=254
Reply from 20.2.2.2: bytes=32 time=1ms TTL=254
Reply from 20.2.2.2: bytes=32 time=1ms TTL=254
Reply from 20.2.2.2: bytes=32 time=186ms TTL=254
Ping statistics for 20.2.2.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 197ms, Average = 96ms
(0)
有没有针对IMC方面的配置
https://www.h3c.com/cn/Service/Document_Software/Document_Center/IP_Management/H3C_intelligentize/H3C_intelligentize/Configure/Typical_Configuration_Example/iMC_UAM-5710/28/?CHID=1014217
您好,这个是否有帮助
(0)
您好,这个文档可以再发一下么,URL 404了
您好,这个文档可以再发一下么,URL 404了
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
https://www.h3c.com/cn/Service/Document_Software/Document_Center/IP_Management/H3C_intelligentize/H3C_intelligentize/Configure/Typical_Configuration_Example/iMC_UAM-5710/28/?CHID=1014217