· Device已获取到CA证书ca.cer和服务器证书server.pfx,若SSL VPN网关不引用SSL 服务端策略,则使用设备缺省证书。证书怎么获取 要怎么生成
(0)
最佳答案
证书获取方式如下链接:
http://www.h3c.com/cn/d_201704/990598_30005_0.htm#_Toc480482674
在开始下面的配置之前,假设已完成如下配置:
· Device A已获取到CA证书ca.cer和服务器证书server.pfx。
· Device A与SSL VPN客户端、Server之间路由可达。
· Server上存在到达网段10.1.1.0/24的路由。
# 配置PKI域sslvpn。
<DeviceA> system-view
[DeviceA] pki domain sslvpn
[DeviceA-pki-domain-sslvpn] public-key rsa general name sslvpn
[DeviceA-pki-domain-sslvpn] undo crl check enable
[DeviceA-pki-domain-sslvpn] quit
# 导入CA证书ca.cer和服务器证书server.pfx。
[DeviceA] pki import domain sslvpn der ca filename ca.cer
[DeviceA] pki import domain sslvpn p12 local filename server.pfx
# 配置SSL服务器端策略ssl。
[DeviceA] ssl server-policy ssl
[DeviceA-ssl-server-policy-ssl] pki-domain sslvpn
[DeviceA-ssl-server-policy-ssl] quit
# 配置SSL VPN网关gw的IP地址为1.1.1.2,端口号为2000,并引用SSL服务器端策略ssl。
[DeviceA] sslvpn gateway gw
[DeviceA-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000
[DeviceA-sslvpn-gateway-gw] ssl server-policy ssl
# 开启SSL VPN网关gw。
[DeviceA-sslvpn-gateway-gw] service enable
[DeviceA-sslvpn-gateway-gw] quit
# 创建地址池ippool,指定IP地址范围为10.1.1.1~10.1.1.10。
[DeviceA] sslvpn ip address-pool ippool 10.1.1.1 10.1.1.10
# 创建SSL VPN AC接口1,配置该接口绑定VPN实例VPN1,并配置接口的IP地址为10.1.1.100/24。
[DeviceA] interface sslvpn-ac 1
[DeviceA-SSLVPN-AC1] ip address 10.1.1.100 24
[DeviceA-SSLVPN-AC1] quit
# 创建ACL 3000,允许所有数据包通过。
[DeviceA] acl advanced 3000
[DeviceA-acl-ipv4-adv-3000] rule permit ip source any
[DeviceA-acl-ipv4-adv-3000] quit
# 配置SSL VPN访问实例ctx,引用SSL VPN网关gw。
[DeviceA] sslvpn context ctx
[DeviceA-sslvpn-context-ctx] gateway gw
# 创建路由列表rtlist,并添加路由表项20.2.2.0/24。
[DeviceA-sslvpn-context-ctx] ip-route-list rtlist
[DeviceA-sslvpn-context-ctx-route-list-rtlist] include 20.2.2.0 255.255.255.0
[DeviceA-sslvpn-context-ctx-route-list-rtlist] quit
# 配置SSL VPN访问实例ctx引用SSL VPN AC接口1
[DeviceA-sslvpn-context-ctx] ip-tunnel interface sslvpn-ac 1
# 配置SSL VPN访问实例ctx,并引用路由列表rtlist和地址池ippool,同时配置对IP接入进行URI ACL过滤。
[DeviceA-sslvpn-context-ctx] ip-tunnel address-pool ippool mask 255.255.255.0
[DeviceA-sslvpn-context-ctx] policy-group pgroup
[DeviceA-sslvpn-context-ctx-policy-group-pgroup] filter ip-tunnel acl 3000
[DeviceA-sslvpn-context-ctx-policy-group-pgroup] ip-tunnel access-route ip-route-list rtlist
[DeviceA-sslvpn-context-ctx-policy-group-pgroup] quit
# 开启SSL VPN访问实例ctx。
[DeviceA-sslvpn-context-ctx] service enable
[DeviceA-sslvpn-context-ctx] quit
# 创建本地SSL VPN用户sslvpn,密码为123456,用户角色为network-operator,授权用户的SSL VPN策略组为pgroup。
[DeviceA] local-user sslvpn class network
[DeviceA-luser-network-sslvpn] password simple 123456
[DeviceA-luser-network-sslvpn] service-type sslvpn
[DeviceA-luser-network-sslvpn] authorization-attribute user-role network-operator
[DeviceA-luser-network-sslvpn] authorization-attribute sslvpn-policy-group pgroup
[DeviceA-luser-network-sslvpn] quit
# 在Device A上查看SSL VPN网关状态,可见SSL VPN网关gw处于Up状态。
[DeviceA] display sslvpn gateway
Gateway name: gw
Operation state: Up
IP: 1.1.1.2 Port: 2000
SSL server policy configured: ssl
SSL server policy in use: ssl
Front VPN instance: Not configured
# 在Device A上查看SSL VPN访问实例状态,可见SSL VPN访问实例ctx处于Up状态。
[DeviceA] display sslvpn context
Context name: ctx
Operation state: Up
AAA domain: domain1
Certificate authentication: Disabled
Dynamic password: Disabled
Code verification: Disabled
Default policy group: Not configured
Associated SSL VPN gateway: gw
SSL client policy configured: ssl
SSL client policy in use: ssl
Maximum users allowed: 1048575
VPN instance: Not configured
Idle timeout: 30 min
# 用户在PC上启动IP接入客户端软件,输入访问地址1.1.1.2、端口号2000、用户名sslvpn、密码123456,登录成功。
# 在Device A上可以看到用户会话信息。
[DeviceA] display sslvpn session context ctx
SSL VPN context: ctx
Users: 1
Username Conn Idle Time Created User IP address
sslvpn 6 00:02:05 00:03:14 40.1.1.1
# 在PC上查看IPv4路由表,其中40.1.1.1/24为本地网卡地址,10.1.1.1/24为SSL VPN网关设备分配给用户的地址,20.2.2.0/24为到达内部服务器Server的路由。
>route -4 print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
10.1.1.0 255.255.255.0 On-link 10.1.1.1 276
10.1.1.1 255.255.255.255 On-link 10.1.1.1 276
10.1.1.255 255.255.255.255 On-link 10.1.1.1 276
20.2.2.0 255.255.255.0 On-link 10.1.1.1 276
20.2.2.255 255.255.255.255 On-link 10.1.1.1 276
40.1.1.0 255.255.255.0 On-link 40.1.1.1 276
40.1.1.1 255.255.255.255 On-link 40.1.1.1 276
40.1.1.255 255.255.255.255 On-link 40.1.1.1 276
===========================================================================
# 在PC上可以Ping通服务器地址20.2.2.2。
>ping 20.2.2.2
Pinging 20.2.2.2 with 32 bytes of data:
Reply from 20.2.2.2: bytes=32 time=197ms TTL=254
Reply from 20.2.2.2: bytes=32 time=1ms TTL=254
Reply from 20.2.2.2: bytes=32 time=1ms TTL=254
Reply from 20.2.2.2: bytes=32 time=186ms TTL=254
Ping statistics for 20.2.2.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 197ms, Average = 96ms
(0)
您好,请知:
如果不使用默认证书,则需要服务器生成证书后,导入证书。
以下是配置举例,请参考:
Device为SSL VPN网关设备,连接公网用户和企业私有网络VPN 1、VPN 2。用户通过Device能够安全地访问位于VPN 1内的Server A和VPN 2内的Server B。其中,Server A和Server B均为Web服务器,Sever A使用HTTP协议和80端口号,Sever B使用HTTPS协议和443端口号;Device对用户进行本地认证和本地授权。
图1-11 Web接入组网图
在开始下面的配置之前,假设已完成如下配置:
· Device上已创建VPN实例,设备各接口都已绑定对应的VPN实例且接口的地址都已配置完毕。
· Device已获取到CA证书ca.cer和服务器证书server.pfx,若SSL VPN网关不引用SSL服务端策略,则使用设备缺省证书。
(1) 配置路由、安全域及域间策略保证网络可达,具体配置步骤略
(2) 配置PKI域
# 配置PKI域sslvpn。
<Device> system-view
[Device] pki domain sslvpn
[Device-pki-domain-sslvpn] public-key rsa general name sslvpn
[Device-pki-domain-sslvpn] undo crl check enable
[Device-pki-domain-sslvpn] quit
# 导入CA证书ca.cer和服务器证书server.pfx。
[Device] pki import domain sslvpn der ca filename ca.cer
[Device] pki import domain sslvpn p12 local filename server.pfx
(3) 配置SSL服务器端策略
# 配置SSL服务器端策略ssl。
[Device] ssl server-policy ssl
[Device-ssl-server-policy-ssl] pki-domain sslvpn
[Device-ssl-server-policy-ssl] quit
(4) 配置SSL VPN网关
# 配置SSL VPN网关gw的IP地址为1.1.1.2,端口号为2000,并引用SSL服务器端策略ssl。
[Device] sslvpn gateway gw
[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000
[Device-sslvpn-gateway-gw] ssl server-policy ssl
# 开启SSL VPN网关gw。
[Device-sslvpn-gateway-gw] service enable
[Device-sslvpn-gateway-gw] quit
(5) 配置SSL VPN访问实例
# 配置SSL VPN访问实例ctx1引用SSL VPN网关gw,指定域名为domain1,并配置SSL VPN访问实例关联的VPN实例为VPN1。
[Device] sslvpn context ctx1
[Device-sslvpn-context-ctx1] gateway gw domain domain1
[Device-sslvpn-context-ctx1] vpn-instance VPN1
# 创建URL表项urlitem,并配置资源的URL。
[Device-sslvpn-context-ctx1] url-item urlitem
[Device-sslvpn-context-ctx1-url-item-urlitem] url http://20.2.2.2
[Device-sslvpn-context-ctx1-url-item-urlitem] quit
# 创建URL列表urllist。
[Device-sslvpn-context-ctx1] url-list urllist
# 配置URL列表标题为web。
[Device-sslvpn-context-ctx1-url-list-urllist] heading web
# 配置URL列表引用的URL表项。
[Device-sslvpn-context-ctx1-url-list-urllist] resources url-item urlitem
[Device-sslvpn-context-ctx1-url-list-urllist] quit
# SSL VPN访问实例ctx1下创建策略组pgroup,引用Web资源,并指定其为缺省策略组。
[Device-sslvpn-context-ctx1] policy-group pgroup
[Device-sslvpn-context-ctx1-policy-group-pgroup] resources url-list urllist
[Device-sslvpn-context-ctx1-policy-group-pgroup] quit
[Device-sslvpn-context-ctx1] default-policy-group pgroup
# 开启SSL VPN访问实例ctx1。
[Device-sslvpn-context-ctx1] service enable
[Device-sslvpn-context-ctx1] quit
# 配置SSL VPN访问实例ctx2引用SSL VPN网关gw,指定域名为domain2,并配置SSL VPN访问实例关联的VPN实例为VPN2。
[Device] sslvpn context ctx2
[Device-sslvpn-context-ctx2] gateway gw domain domain2
[Device-sslvpn-context-ctx2] vpn-instance VPN2
# 创建URL表项urlitem,并配置资源的URL。
[Device-sslvpn-context-ctx1] url-item urlitem
[Device-sslvpn-context-ctx1-url-item-urlitem] url https://30.3.3.3
[Device-sslvpn-context-ctx1-url-item-urlitem] quit
# 创建URL列表urllist。
[Device-sslvpn-context-ctx2] url-list urllist
# 配置URL列表标题为web。
[Device-sslvpn-context-ctx2-url-list-urllist] heading web
# 配置URL列表引用的URL表项。
[Device-sslvpn-context-ctx1-url-list-urllist] resources url-item urlitem
[Device-sslvpn-context-ctx1-url-list-urllist] quit
# SSL VPN访问实例ctx2下创建策略组pgroup,引用Web资源,并指定其为缺省策略组。
[Device-sslvpn-context-ctx2] policy-group pgroup
[Device-sslvpn-context-ctx2-policy-group-pgroup] resources url-list urllist
[Device-sslvpn-context-ctx2-policy-group-pgroup] quit
[Device-sslvpn-context-ctx2] default-policy-group pgroup
# 开启SSL VPN访问实例ctx2。
[Device-sslvpn-context-ctx2] service enable
[Device-sslvpn-context-ctx2] quit
(6) 配置SSL VPN用户
# 创建本地SSL VPN用户sslvpn,密码为123456,用户角色为network-operator,授权用户的SSL VPN策略组为pgroup。
[Device] local-user sslvpn class network
[Device-luser-network-sslvpn] password simple 123456
[Device-luser-network-sslvpn] service-type sslvpn
[Device-luser-network-sslvpn] authorization-attribute user-role network-operator
[Device-luser-network-sslvpn] authorization-attribute sslvpn-policy-group pgroup
[Device-luser-network-sslvpn] quit
# 在Device上查看SSL VPN网关状态,可见SSL VPN网关gw处于Up状态。
[Device] display sslvpn gateway
Gateway name: gw
Operation state: Up
IP: 1.1.1.2 Port: 2000
SSL server policy configured: ssl
SSL server policy in use: ssl
Front VPN instance: Not configured
# 在Device上查看SSL VPN访问实例状态,可见SSL VPN访问实例ctx1和ctx2均处于Up状态。
[Device] display sslvpn context
Context name: ctx1
Operation state: Up
AAA domain: Not specified
Certificate authentication: Disabled
Password authentication:Enabled
Authentication use: All
Dynamic password: Disabled
Code verification: Disabled
Default policy group: pgroup
Associated SSL VPN gateway: gw
Domain name: domain1
SSL client policy configured: ssl
SSL client policy in use: ssl
Maximum users allowed: 1048575
VPN instance: VPN1
Idle timeout: 30 min
Context name: ctx2
Operation state: Up
AAA domain: Not specified
Certificate authentication: Disabled
Password authentication:Enabled
Authentication use: All
Dynamic password: Disabled
Code verification: Disabled
Default policy group: pgroup
Associated SSL VPN gateway: gw
Domain name: domain2
SSL client policy configured: ssl
SSL client policy in use: ssl
Maximum users allowed: 1048575
VPN instance: VPN2
Idle timeout: 30 min
# 用户在PC浏览器上输入https://1.1.1.2:2000/,进入Domain List页面。
图1-12 Domain List页面
# 用户选择domain1进入登录页面,输入用户sslvpn和密码123456,点击<登录>按钮,可以成功登录。
图1-13 登录页面
# 用户登录成功后,在Device上可以看到用户会话信息。
[Device] display sslvpn session context ctx1
SSL VPN context: ctx1
Users: 1
Username Connections Idle time Created User IP
sslvpn 6 0/00:12:05 0/00:04:14 40.1.1.1
# 网关首页的“书签”栏显示用户可以访问的远端web资源。
图1-14 网关首页
# 点击serverA,可以进入Web服务器Server A的HTTP网站首页面,且在浏览器的地址栏中显示如下格式的URL:https://1.1.1.2:2000/_proxy2/http/80/20.2.2.2/。
# 用户退出登录,重启浏览器,重新输入https://1.1.1.2:2000/,选择domain2进入登录页面,输入用户名sslvpn和密码123456,可以登录成功。
# 用户登录成功后,在Device上可以看到用户会话信息。
[Device] display sslvpn session context ctx2
SSL VPN context: ctx2
Users: 1
Username Connections Idle time Created User IP
sslvpn 6 0/00:02:05 0/00:01:11 40.1.1.1
# 网关首页的“书签”栏显示用户可以访问的远端web资源。
图1-15 网关首页
# 点击serverB,可以进入Web服务器Server B的HTTPS网站页面,且在浏览器的地址栏中显示如下格式的URL:https://1.1.1.2:2000/_proxy2/https/443/30.3.3.3/。
具体的SSL VPN手册连接如下:
https://www.h3c.com/cn/d_202006/1307646_30005_0.htm#_Toc43154556
(0)
暂无评论
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论