华三防火墙F1000 如何设置ssl vpn

1.33.3  IP接入配置举例

1. 组网需求

Device为SSL VPN网关设备，连接公网用户和企业私有网络。用户通过Device可以通过IP

接入方式安全地访问私有网络内的Server。Device采用本地认证和授权方式对用户进行认证和授权。

2. 组网图

图1-19 IP接入配置组网图

‌

3. 配置步骤

 

(1)     配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 1.1.1.2 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

(2)     创建SSL VPN AC接口，用于转发IP接入流量

# 创建SSL VPN AC接口1，配置该接口的IP地址为10.1.1.100/24。

[Device] interface sslvpn-ac 1

[Device-SSLVPN-AC1] ip address 10.1.1.100 24

[Device-SSLVPN-AC1] quit

(3)     配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达Server的下一跳IP地址为2.2.2.3，到达User的下一跳IP地址为1.1.1.3实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 20.2.2.2 24 2.2.2.3

[Device] ip route-static 40.1.1.1 24 1.1.1.3

(4)     配置接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] import interface sslvpn-ac 1

[Device-security-zone-Untrust] quit

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] quit

(5)     配置安全策略放行Untrust与Local安全域、Untrust与Trust安全域之间的流量，用于用户访问SSL VPN网关设备和Server

# 配置名称为sslvpnlocalout1的安全策略规则，使Device可以向用户发送报文，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name sslvpnlocalout1

[Device-security-policy-ip-1-sslvpnlocalout1] source-zone local

[Device-security-policy-ip-1-sslvpnlocalout1] destination-zone untrust

[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 1.1.1.2

[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-host 40.1.1.1

[Device-security-policy-ip-1-sslvpnlocalout1] action pass

[Device-security-policy-ip-1-sslvpnlocalout1] quit

# 配置名称为sslvpnlocalin1的安全策略规则，使用户可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin1

[Device-security-policy-ip-2-sslvpnlocalin1] source-zone untrust

[Device-security-policy-ip-2-sslvpnlocalin1] destination-zone local

[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host 40.1.1.1

[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 1.1.1.2

[Device-security-policy-ip-2-sslvpnlocalin1] action pass

[Device-security-policy-ip-2-sslvpnlocalin1] quit

# 配置名称为sslvpnlocalout2的安全策略规则，使Device可以向Server发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalout2

[Device-security-policy-ip-3-sslvpnlocalout2] source-zone local

[Device-security-policy-ip-3-sslvpnlocalout2] destination-zone trust

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 2.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 20.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] action pass

[Device-security-policy-ip-3-sslvpnlocalout2] quit

# 配置名称为sslvpnlocalin2的安全策略规则，使Server可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin2

[Device-security-policy-ip-4-sslvpnlocalin2] source-zone trust

[Device-security-policy-ip-4-sslvpnlocalin2] destination-zone local

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 20.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 2.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] action pass

[Device-security-policy-ip-4-sslvpnlocalin2] quit

# 配置名称为untrust-trust的安全策略规则，使用户可以通过SSL VPN AC接口访问Server，具体配置步骤如下。

[Device-security-policy-ip] rule name untrust-trust

[Device-security-policy-ip-5-untrust-trust] source-zone untrust

[Device-security-policy-ip-5-untrust-trust] destination-zone trust

[Device-security-policy-ip-5-untrust-trust] source-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-5-untrust-trust] destination-ip-host 20.2.2.2

[Device-security-policy-ip-5-untrust-trust] action pass

[Device-security-policy-ip-5-untrust-trust] quit

# 配置名称为trust-untrust的安全策略规则，使Server可以通过SSL VPN AC接口向用户发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-6-trust-untrust] source-zone trust

[Device-security-policy-ip-6-trust-untrust] destination-zone untrust

[Device-security-policy-ip-6-trust-untrust] source-ip-host 20.2.2.2

[Device-security-policy-ip-6-trust-untrust] destination-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-6-trust-untrust] action pass

[Device-security-policy-ip-6-trust-untrust] quit

[Device-security-policy-ip] quit

(6)     创建ACL，用于对IP接入流量进行过滤

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule permit ip source 10.1.1.0 0.0.0.255 destination 20.2.2.0 0.0.0.255

[Device-acl-ipv4-adv-3000] quit

(7)     配置PKI域，设置证书申请所需的相关参数

[Device] pki domain sslvpn

[Device-pki-domain-sslvpn] public-key rsa general name sslvpn

[Device-pki-domain-sslvpn] undo crl check  enable

[Device-pki-domain-sslvpn] quit

[Device] pki import domain sslvpn der ca filename ca.cer

[Device] pki import domain sslvpn p12 local filename server.pfx

(8)     配置SSL服务器端策略，引用PKI域

[Device] ssl server-policy ssl

[Device-ssl-server-policy-ssl] pki-domain sslvpn

[Device-ssl-server-policy-ssl] quit

(9)     配置SSL VPN网关，为用户提供登录SSL VPN网关的入口

# 配置SSL VPN网关gw的IP地址为1.1.1.2，端口号为4430，并引用SSL服务器端策略ssl。

<Device> system-view

[Device] sslvpn gateway gw

[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 4430

[Device-sslvpn-gateway-gw] ssl server-policy ssl

[Device-sslvpn-gateway-gw] service enable

[Device-sslvpn-gateway-gw] quit

(10)     创建SSL VPN客户端地址池，用于为IP接入客户端分配IP地址

# 创建为SSL VPN客户端分配地址的地址池sslvpnpool，地址范围为10.1.1.1～10.1.1.10。

[Device] sslvpn ip address-pool sslvpnpool 10.1.1.1 10.1.1.10

(11)     配置SSL VPN访问实例，为用户提供SSL VPN IP接入服务

# 配置SSL VPN访问实例ctxip，引用SSL VPN网关gw，指定域名为domainip。

[Device] sslvpn context ctxip

[Device-sslvpn-context-ctxip] gateway gw domain domainip

[Device-sslvpn-context-ctxip] ip-tunnel interface sslvpn-ac 1

[Device-sslvpn-context-ctxip] ip-route-list rtlist

[Device-sslvpn-context-ctxip-route-list-rtlist] include 20.2.2.0 24

[Device-sslvpn-context-ctxip-route-list-rtlist] quit

[Device-sslvpn-context-ctxip] ip-tunnel address-pool sslvpnpool mask 24

[Device-sslvpn-context-ctxip] policy-group resourcegrp

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] ip-tunnel access-route ip-route-list rtlist

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] filter ip-tunnel acl 3000

[Device-sslvpn-context-ctxip-policy-group-resourcegrp] quit

[Device-sslvpn-context-ctxip] service enable

[Device-sslvpn-context-ctxip] quit

(12)     配置SSL VPN用户，用于访问SSL VPN网关

# 创建本地SSL VPN用户sslvpnuser，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为resourcegrp。

[Device] local-user sslvpnuser class network

[Device-luser-network-sslvpnuser] password simple 123456

[Device-luser-network-sslvpnuser] service-type sslvpn

[Device-luser-network-sslvpnuser] authorization-attribute sslvpn-policy-group resourcegrp

[Device-luser-network-sslvpnuser] authorization-attribute user-role network-operator

[Device-luser-network-sslvpnuser] quit

1.29  SSL VPN典型配置举例

1.29.1  Web接入配置举例

1. 组网需求

Device为SSL VPN网关设备，连接公网用户和企业私有网络Network 1、Network 2。用户通过Device能够安全地访问位于Network 1内的Server A和Network 2内的Server B。其中，Server A和Server B均为Web服务器，Sever A使用HTTP协议和80端口号，Sever B使用HTTPS协议和443端口号；Device对用户进行本地认证和本地授权。

2. 组网图

图1-12 Web接入组网图

‌

3. 配置步骤

 

(1)     配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 1.1.1.2 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

(2)     配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达ServerA的下一跳IP地址为2.2.2.3，到达ServerB的下一跳IP地址为3.3.3.4，到达User的下一跳IP地址为1.1.1.3实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 20.2.2.2 24 2.2.2.3

[Device] ip route-static 30.3.3.3 24 3.3.3.4

[Device] ip route-static 40.1.1.1 24 1.1.1.3

(3)     配置接口加入安全域。

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] quit

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] import interface gigabitethernet 1/0/3

[Device-security-zone-Trust] quit

(4)     配置安全策略放行Untrust与Local安全域之间的流量，用于用户访问SSL VPN网关设备。

# 配置名称为sslvpnlocalout1的安全策略规则，使Device可以向用户发送报文，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name sslvpnlocalout1

[Device-security-policy-ip-1-sslvpnlocalout1] source-zone local

[Device-security-policy-ip-1-sslvpnlocalout1] destination-zone untrust

[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 1.1.1.2

[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-host 40.1.1.1

[Device-security-policy-ip-1-sslvpnlocalout1] action pass

[Device-security-policy-ip-1-sslvpnlocalout1] quit

# 配置名称为sslvpnlocalin1的安全策略规则，使用户可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin1

[Device-security-policy-ip-2-sslvpnlocalin1] source-zone untrust

[Device-security-policy-ip-2-sslvpnlocalin1] destination-zone local

[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host 40.1.1.1

[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 1.1.1.2

[Device-security-policy-ip-2-sslvpnlocalin1] action pass

[Device-security-policy-ip-2-sslvpnlocalin1] quit

# 配置名称为sslvpnlocalout2的安全策略规则，使Device可以向ServerA和Server B发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalout2

[Device-security-policy-ip-3-sslvpnlocalout2] source-zone local

[Device-security-policy-ip-3-sslvpnlocalout2] destination-zone trust

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 2.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 3.3.3.3

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 20.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 30.3.3.3

[Device-security-policy-ip-3-sslvpnlocalout2] action pass

[Device-security-policy-ip-3-sslvpnlocalout2] quit

# 配置名称为sslvpnlocalin2的安全策略规则，使ServerA和Server B可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin2

[Device-security-policy-ip-4-sslvpnlocalin2] source-zone trust

[Device-security-policy-ip-4-sslvpnlocalin2] destination-zone local

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 20.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 30.3.3.3

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 2.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 3.3.3.3

[Device-security-policy-ip-4-sslvpnlocalin2] action pass

[Device-security-policy-ip-4-sslvpnlocalin2] quit

[Device-security-policy-ip] quit

(5)     配置PKI域，设置证书申请所需的相关参数

[Device] pki domain sslvpn

[Device-pki-domain-sslvpn] public-key rsa general name sslvpn

[Device-pki-domain-sslvpn] undo crl check enable

[Device-pki-domain-sslvpn] quit

[Device] pki import domain sslvpn der ca filename ca.cer

[Device] pki import domain sslvpn p12 local filename server.pfx

(6)     配置SSL服务器端策略，引用PKI域

[Device] ssl server-policy ssl

[Device-ssl-server-policy-ssl] pki-domain sslvpn

[Device-ssl-server-policy-ssl] quit

(7)     配置SSL VPN网关，为用户提供登录SSL VPN网关的入口

# 配置SSL VPN网关gw的IP地址为1.1.1.2，端口号为2000，并引用SSL服务器端策略ssl。

[Device] sslvpn gateway gw

[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000

[Device-sslvpn-gateway-gw] ssl server-policy ssl

[Device-sslvpn-gateway-gw] service enable

[Device-sslvpn-gateway-gw] quit

(8)     配置SSL VPN访问实例，为用户提供SSL VPN Web接入服务

# 配置SSL VPN访问实例ctx1引用SSL VPN网关gw，指定域名为domain1。

[Device] sslvpn context ctx1

[Device-sslvpn-context-ctx1] gateway gw domain domain1

[Device-sslvpn-context-ctx1] url-item serverA

[Device-sslvpn-context-ctx1-url-item-serverA] url http://20.2.2.2

[Device-sslvpn-context-ctx1-url-item-serverA] quit

[Device-sslvpn-context-ctx1] url-list urllist

[Device-sslvpn-context-ctx1-url-list-urllist] heading web

[Device-sslvpn-context-ctx1-url-list-urllist] resources url-item serverA

[Device-sslvpn-context-ctx1-url-list-urllist] quit

[Device-sslvpn-context-ctx1] policy-group pgroup

[Device-sslvpn-context-ctx1-policy-group-pgroup] resources url-list urllist

[Device-sslvpn-context-ctx1-policy-group-pgroup] quit

[Device-sslvpn-context-ctx1] default-policy-group pgroup

[Device-sslvpn-context-ctx1] service enable

[Device-sslvpn-context-ctx1] quit

# 配置SSL VPN访问实例ctx2引用SSL VPN网关gw，指定域名为domain2。

[Device] sslvpn context ctx2

[Device-sslvpn-context-ctx2] gateway gw domain domain2

[Device-sslvpn-context-ctx2] url-item serverB

[Device-sslvpn-context-ctx2-url-item-serverB] url https://30.3.3.3

[Device-sslvpn-context-ctx2-url-item-serverB] quit

[Device-sslvpn-context-ctx2] url-list urllist

[Device-sslvpn-context-ctx2-url-list-urllist] heading web

[Device-sslvpn-context-ctx2-url-list-urllist] resources url-item serverB

[Device-sslvpn-context-ctx2-url-list-urllist] quit

[Device-sslvpn-context-ctx2] policy-group pgroup

[Device-sslvpn-context-ctx2-policy-group-pgroup] resources url-list urllist

[Device-sslvpn-context-ctx2-policy-group-pgroup] quit

[Device-sslvpn-context-ctx2] default-policy-group pgroup

[Device-sslvpn-context-ctx2] service enable

[Device-sslvpn-context-ctx2] quit

(9)     配置SSL VPN用户，用于接入SSL VPN网关

# 创建本地SSL VPN用户sslvpn，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为pgroup。

[Device] local-user sslvpn class network

[Device-luser-network-sslvpn] password simple 123456

[Device-luser-network-sslvpn] service-type sslvpn

[Device-luser-network-sslvpn] authorization-attribute user-role network-operator

[Device-luser-network-sslvpn] authorization-attribute sslvpn-policy-group pgroup

[Device-luser-network-sslvpn] quit

4. 验证配置

# 在Device上查看SSL VPN网关状态，可见SSL VPN网关gw处于Up状态。

[Device] display sslvpn gateway

Gateway name: gw

  Operation state: Up

  IP: 1.1.1.2  Port: 2000

  SSL server policy configured: ssl

  SSL server policy in use: ssl

  Front VPN instance: Not configured

# 在Device上查看SSL VPN访问实例状态，可见SSL VPN访问实例ctx1和ctx2均处于Up状态。

[Device] display sslvpn context

Context name: ctx1

  Operation state: Up

  AAA domain: Not specified

  Certificate authentication: Disabled

  Password authentication：Enabled

  Authentication use: All

  SMS auth type: Not configured

  Urlmasking: Disabled

  Code verification: Disabled

  Default policy group: pgroup

  Associated SSL VPN gateway: gw

    Domain name: domain1

  SSL client policy configured: ssl

  SSL client policy in use: ssl

  Maximum users allowed: 1048575

  VPN instance: Not configured

  Idle timeout: 30 min

  Authentication server-type: aaa

  Password changing: Enabled

 

Context name: ctx2

  Operation state: Up

  AAA domain: Not specified

  Certificate authentication: Disabled

  Password authentication：Enabled

  Authentication use: All

  SMS auth type: Not configured

  Urlmasking: Disabled

  Code verification: Disabled

  Default policy group: pgroup

  Associated SSL VPN gateway: gw

    Domain name: domain2

  SSL client policy configured: ssl

  SSL client policy in use: ssl

  Maximum users allowed: 1048575

  VPN instance: Not configured

  Idle timeout: 30 min

  Authentication server-type: aaa

  Password changing: Enabled

# 用户在PC浏览器上输入https://1.1.1.2:2000/，进入Domain List页面。

图1-13 Domain List页面

 

# 用户选择domain1进入登录页面，输入用户sslvpn和密码123456，点击<登录>按钮，可以成功登录。

图1-14 登录页面

 

# 用户登录成功后，在Device上可以看到用户会话信息。

[Device] display sslvpn session context ctx1

SSL VPN context: ctx1

Users: 1

Username        Connections  Idle time   Created       User IP

sslvpn          6            0/00:12:05  0/00:04:14    40.1.1.1

# 网关首页的“书签”栏显示用户可以访问的远端web资源。

图1-15 网关首页

 

# 点击serverA，可以进入Web服务器Server A的HTTP网站首页面，且在浏览器的地址栏中显示如下格式的URL：https://1.1.1.2:2000/_proxy2/http/80/20.2.2.2/。

# 用户退出登录，重启浏览器，重新输入https://1.1.1.2:2000/，选择domain2进入登录页面，输入用户名sslvpn和密码123456，可以登录成功。

# 用户登录成功后，在Device上可以看到用户会话信息。

[Device] display sslvpn session context ctx2

SSL VPN context: ctx2

Users: 1

Username        Connections  Idle time   Created       User IP

sslvpn          6            0/00:02:05  0/00:01:11    40.1.1.1

# 网关首页的“书签”栏显示用户可以访问的远端web资源。

图1-16 网关首页

 

# 点击serverB，可以进入Web服务器Server B的HTTPS网站页面，且在浏览器的地址栏中显示如下格式的URL：https://1.1.1.2:2000/_proxy2/https/443/30.3.3.3/。