SSL vpn远程接入防火墙共享型配置实验

一、实验目的及拓扑

实验目的:用户采用SSL方式接入服务器,在防火墙进行相应的SSLvpn共享型配置,在防火墙后的内网中这只两台服务器对应两项业务

二、基础配置

(一)如图所示配置路由器接口地址(此处配置省略)

(二)FW1地址和区域配置需区分根系统、虚拟系统OA和虚拟系统RD

FW1\]vsys enable \[FW1\]vsys name OA \[FW1\]vsys name RD \[FW1-vsys-OA\]assign interface g1/0/1 \[FW1-vsys-RD\]assign interface g1/0/2 3、切换到虚拟系统OA \[FW1\]switch vsys OA \[FW1-OA-GigabitEthernet1/0/1\]dis th # interface GigabitEthernet1/0/1 undo shutdown ip binding vpn-instance OA ip address 10.1.121.12 255.255.255.0 # \[FW1-OA\]dis zone vpn-instance OA local priority is 100 interface of the zone is (0): # vpn-instance OA trust priority is 85 interface of the zone is (1): GigabitEthernet1/0/1 # vpn-instance OA untrust priority is 5 interface of the zone is (1): Virtual-if1 # vpn-instance OA dmz priority is 50 interface of the zone is (0): # \[FW1-OA-policy-security\]dis th # security-policy rule name LOCAL_TO_ANY source-zone local action permit # 4、切换到虚拟系统RD \[FW1\]switch vsys RD \[FW1-RD\]dis zone vpn-instance RD local priority is 100 interface of the zone is (0): # vpn-instance RD trust priority is 85 interface of the zone is (1): GigabitEthernet1/0/2 # vpn-instance RD untrust priority is 5 interface of the zone is (1): Virtual-if2 # vpn-instance RD dmz priority is 50 interface of the zone is (0): # \[FW1-RD-policy-security\]dis th # security-policy rule name LOCAL_TO_ANY source-zone local action permit # 5、在防火墙根系统测试两台服务器联通情况 \[FW1\]ping -vpn-instance OA 10.1.121.10 PING 10.1.121.10: 56 data bytes, press CTRL_C to break Request time out Reply from 10.1.121.10: bytes=56 Sequence=2 ttl=255 time=1 ms Reply from 10.1.121.10: bytes=56 Sequence=3 ttl=255 time=1 ms \[FW1\]ping -vpn-instance RD 10.1.122.10 PING 10.1.122.10: 56 data bytes, press CTRL_C to break Request time out Reply from 10.1.122.10: bytes=56 Sequence=2 ttl=255 time=1 ms Reply from 10.1.122.10: bytes=56 Sequence=3 ttl=255 time=1 ms 三、详细配置 (一)设置共享型网关共享地址及共享域名 \[FW1\]v-gateway public-ip 155.1.121.12 \[FW1\]v-gateway public-domain www.qyw.com \[FW1\]dis cu \| in v-gate 2024-07-25 06:13:01.760 v-gateway public-ip 155.1.121.12 v-gateway public-domain www.qyw.com v-gateway public ssl version tlsv11 tlsv12 v-gateway public ssl ciphersuit custom aes256-sha non-des-cbc3-sha aes128-sha v-gateway ssl_gw_oa public-ip public www.qyw.com/OA v-gateway ssl_gw_oa alias SSL_GW_OA v-gateway ssl_gw_oa (二)切换至虚拟防火墙OA及防火墙RD新建共享型网关并对网络扩展进行相应属性配置 1、\[FW1\]switch vsys OA \[FW1-OA\]v-gateway SSL_GW_OA public-ip public www.qyw.com/OA ![](https://i-blog.csdnimg.cn/direct/7c4e523f86d74224970d3288376ccef4.png) # v-gateway ssl_gw_oa public-ip public www.qyw.com/OA v-gateway ssl_gw_oa alias SSL_GW_OA # #\*\*\*\*BEGIN\*\*\*ssl_gw_oa\*\*1\*\*\*\*# v-gateway ssl_gw_oa basic ssl timeout 5 ssl lifecycle 1440 service network-extension enable network-extension keep-alive enable network-extension keep-alive interval 120 network-extension netpool 192.168.0.1 192.168.0.10 255.255.255.0 netpool 192.168.0.1 default network-extension mode manual network-extension manual-route 10.1.121.0 255.255.255.0 security policy-default-action permit vt-src-ip certification cert-anonymous cert-field user-filter subject cn group-filter su bject cn certification cert-anonymous filter-policy permit-all certification cert-challenge cert-field user-filter subject cn certification user-cert-filter key-usage any undo public-user enable hostchecker cachecleaner vpndb group /default role role default role default condition all #\*\*\*\*END\*\*\*\*# 2、\[FW1\]switch vsys RD \[FW1-RD\]v-gateway SSL_GW_RD public-ip public www.qyw.com/RD ![](https://i-blog.csdnimg.cn/direct/1ddf22cbae974be09cf6b23ec8ce0d49.png) # v-gateway ssl_gw_rd public-ip public www.qyw.com/RD v-gateway ssl_gw_rd alias SSL_GW_RD # #\*\*\*\*BEGIN\*\*\*ssl_gw_rd\*\*1\*\*\*\*# v-gateway ssl_gw_rd basic ssl timeout 5 ssl lifecycle 1440 service network-extension enable network-extension keep-alive enable network-extension keep-alive interval 120 network-extension netpool 192.168.0.11 192.168.0.20 255.255.255.0 netpool 192.168.0.11 default network-extension mode manual network-extension manual-route 10.1.122.0 255.255.255.0 security policy-default-action permit vt-src-ip certification cert-anonymous cert-field user-filter subject cn group-filter su bject cn certification cert-anonymous filter-policy permit-all certification cert-challenge cert-field user-filter subject cn certification user-cert-filter key-usage any undo public-user enable hostchecker cachecleaner vpndb group /default role role default role default condition all #\*\*\*\*END\*\*\*\*# (三)设置安全策略 在根系统上设置 \[FW1-policy-security\]dis th # security-policy rule name LOCAL_TO_ANY source-zone local action permit rule name OUT_TO_LOCAL source-zone untrust destination-zone local service protocol tcp destination-port 443 action permit # 在虚拟系统OA上设置 \[FW1-OA-policy-security\]DIS TH # security-policy rule name LOCAL_TO_ANY source-zone local action permit rule name OUT_TO_IN source-zone untrust destination-zone trust source-address 192.168.0.0 mask 255.255.255.0 destination-address 10.1.121.0 mask 255.255.255.0 action permit # 在虚拟系统RD上设置 \[FW1-RD-policy-security\]dis th 2024-07-25 06:24:09.270 # security-policy rule name LOCAL_TO_ANY source-zone local action permit rule name OUT_TO_IN source-zone untrust destination-zone trust source-address 192.168.0.0 mask 255.255.255.0 destination-address 10.1.122.0 mask 255.255.255.0 action permit # (四)添加用户 ![](https://i-blog.csdnimg.cn/direct/07fcfab2e60b49a1a2a1f14e4f3b5bd3.png) 四、结果验证 使用虚拟机登录共享型网关地址155.1.12.12 ![](https://i-blog.csdnimg.cn/direct/492f40ebbaac4687a59d4cee5873febe.png) 可以ping通内网 PS C:\\Users\\Administrator\> ping 10.1.121.10 正在 Ping 10.1.121.10 具有 32 字节的数据: 来自 10.1.121.10 的回复: 字节=32 时间=6ms TTL=255 来自 10.1.121.10 的回复: 字节=32 时间=8ms TTL=255 可以ping通外网 PS C:\\Users\\Administrator\> ping 150.1.1.1 正在 Ping 150.1.1.1 具有 32 字节的数据: 来自 150.1.1.1 的回复: 字节=32 时间=12ms TTL=255 来自 150.1.1.1 的回复: 字节=32 时间=14ms TTL=255 可以ping通直连网段 PS C:\\Users\\Administrator\> ping 155.1.2.100 正在 Ping 155.1.2.100 具有 32 字节的数据: 来自 155.1.2.100 的回复: 字节=32 时间=9ms TTL=255 来自 155.1.2.100 的回复: 字节=32 时间=7ms TTL=255

相关推荐
程序猿(雷霆之王)1 小时前
Linux——进程间通信
linux·运维·服务器
一颗星星辰1 小时前
路由交换网络专题 | 第八章 | GVRP配置 | 端口安全 | 端口隔离 | Mux-VLAN | Hybrid
网络·安全
自由鬼1 小时前
高性能的开源网络入侵检测和防御引擎:Suricata介绍
网络·安全·网络安全·开源·系统安全·入侵检测
老六ip加速器1 小时前
如何获取静态IP地址?完整教程
网络·网络协议·tcp/ip
NoneCoder3 小时前
HTML 模板技术与服务端渲染
服务器·servlet·html
李詹3 小时前
Steam游戏服务器攻防全景解读——如何构建游戏级抗DDoS防御体系?
服务器·游戏·ddos
你熬夜了吗?3 小时前
spring中使用netty-socketio部署到服务器(SSL、nginx转发)
服务器·websocket·spring·netty·ssl
joke_xiaoli4 小时前
tomcat Server 连接服务器 进展
java·服务器·tomcat
小吃饱了4 小时前
LSA六种类型
网络·智能路由器
北冥有鱼被烹4 小时前
【微知】/proc中如何查看Linux内核是否允许加载内核模块?(/proc/sys/kernel/modules_disabled)
linux·服务器