CLI方式：TCP接入典型配置

使用版本

本举例是在M9000-AI-E8的R9071版本上进行配置和验证的。

组网需求

如下图所示，Device为SSL VPN网关设备，连接公网用户和企业私有网络。用户通过Device可以安全地访问私有网络内的Telnet服务器Server。Device采用本地认证和授权方式对用户进行认证和授权。

图-1 TCP接入配置组网图

‌

配置步骤

说明

在开始下面的配置之前，假设已完成如下配置：

·          Device已获取到CA证书ca.cer和服务器证书server.pfx，若SSL VPN网关不引用SSL服务端策略，则使用设备缺省证书。

·          SSL VPN用户主机上需要安装Java运行环境。

 

  1. 配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 1.1.1.2 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

  1. 配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达Server的下一跳IP地址为2.2.2.3，到达User的下一跳IP地址为1.1.1.3实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 20.2.2.2 24 2.2.2.3

[Device] ip route-static 40.1.1.1 24 1.1.1.3

  1. 配置接口加入安全域。

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] quit

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] quit

  1. 配置安全策略放行Untrust与Local安全域之间的流量，用于用户访问SSL VPN网关设备。

# 配置名称为sslvpnlocalout1的安全策规则，使Device可以向用户发送SSL VPN报文，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name sslvpnlocalout1

[Device-security-policy-ip-1-sslvpnlocalout1] source-zone local

[Device-security-policy-ip-1-sslvpnlocalout1] destination-zone untrust

[Device-security-policy-ip-1-sslvpnlocalout1] source-ip-host 1.1.1.2

[Device-security-policy-ip-1-sslvpnlocalout1] destination-ip-host 40.1.1.1

[Device-security-policy-ip-1-sslvpnlocalout1] action pass

[Device-security-policy-ip-1-sslvpnlocalout1] quit

# 配置名称为sslvpnlocalin1的安全策略规则，使用户可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin1

[Device-security-policy-ip-2-sslvpnlocalin1] source-zone untrust

[Device-security-policy-ip-2-sslvpnlocalin1] destination-zone local

[Device-security-policy-ip-2-sslvpnlocalin1] source-ip-host 40.1.1.1

[Device-security-policy-ip-2-sslvpnlocalin1] destination-ip-host 1.1.1.2

[Device-security-policy-ip-2-sslvpnlocalin1] action pass

[Device-security-policy-ip-2-sslvpnlocalin1] quit

# 配置名称为sslvpnlocalout2的安全策规则，使Device可以向Server发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalout2

[Device-security-policy-ip-3-sslvpnlocalout2] source-zone local

[Device-security-policy-ip-3-sslvpnlocalout2] destination-zone trust

[Device-security-policy-ip-3-sslvpnlocalout2] source-ip-host 2.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] destination-ip-host 20.2.2.2

[Device-security-policy-ip-3-sslvpnlocalout2] action pass

[Device-security-policy-ip-3-sslvpnlocalout2] quit

# 配置名称为sslvpnlocalin2的安全策略规则，使Server可以向Device发送报文，具体配置步骤如下。

[Device-security-policy-ip] rule name sslvpnlocalin2

[Device-security-policy-ip-4-sslvpnlocalin2] source-zone trust

[Device-security-policy-ip-4-sslvpnlocalin2] destination-zone local

[Device-security-policy-ip-4-sslvpnlocalin2] source-ip-host 20.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] destination-ip-host 2.2.2.2

[Device-security-policy-ip-4-sslvpnlocalin2] action pass

[Device-security-policy-ip-4-sslvpnlocalin2] quit

[Device-security-policy-ip] quit

  1. 配置PKI域，设置证书申请所需的相关参数

[Device] pki domain sslvpn

[Device-pki-domain-sslvpn] public-key rsa general name sslvpn

[Device-pki-domain-sslvpn] undo crl check enable

[Device-pki-domain-sslvpn] quit

[Device] pki import domain sslvpn der ca filename ca.cer

[Device] pki import domain sslvpn p12 local filename server.pfx

  1. 配置SSL服务器端策略，引用PKI域

[Device] ssl server-policy ssl

[Device-ssl-server-policy-ssl] pki-domain sslvpn

[Device-ssl-server-policy-ssl] quit

  1. 配置SSL VPN网关，为用户提供登录SSL VPN网关的入口

# 配置SSL VPN网关gw的IP地址为1.1.1.2，端口号为2000，并引用SSL服务器端策略ssl。

[Device] sslvpn gateway gw

[Device-sslvpn-gateway-gw] ip address 1.1.1.2 port 2000

[Device-sslvpn-gateway-gw] ssl server-policy ssl

[Device-sslvpn-gateway-gw] service enable

[Device-sslvpn-gateway-gw] quit

  1. 配置SSL VPN访问实例，为用户提供SSL VPN TCP接入服务

# 配置SSL VPN访问实例ctx引用SSL VPN网关gw。

[Device] sslvpn context ctx

[Device-sslvpn-context-ctx] gateway gw

[Device-sslvpn-context-ctx] port-forward-item pfitem1

[Device-sslvpn-context-ctx-port-forward-item-pfitem1] local-port 2323 local-name 127.0.0.1 remote-server 20.2.2.2 remote-port 23 description telnet

[Device-sslvpn-context-ctx-port-forward-item-pfitem1] quit

[Device-sslvpn-context-ctx] port-forward plist

[Device-sslvpn-context-ctx-port-forward-plist] resources port-forward-item pfitem1

[Device-sslvpn-context-ctx-port-forward-plist] quit

[Device-sslvpn-context-ctx] policy-group pgroup

[Device-sslvpn-context-ctx-policy-group-pgroup] resources port-forward plist

[Device-sslvpn-context-ctx-policy-group-pgroup] quit

[Device-sslvpn-context-ctx] service enable

[Device-sslvpn-context-ctx] quit

  1. 配置SSL VPN用户，用于访问SSL VPN网关

# 创建本地SSL VPN用户sslvpn，密码为123456，用户角色为network-operator，授权用户的SSL VPN策略组为pgroup。

[Device] local-user sslvpn class network

[Device-luser-network-sslvpn] password simple 123456

[Device-luser-network-sslvpn] service-type sslvpn

[Device-luser-network-sslvpn] authorization-attribute user-role network-operator

[Device-luser-network-sslvpn] authorization-attribute sslvpn-policy-group pgroup

[Device-luser-network-sslvpn] quit

验证配置

# 在Device上查看SSL VPN网关状态，可见SSL VPN网关gw处于Up状态。

[Device] display sslvpn gateway

Gateway name: gw

  Operation state: Up

  IP: 1.1.1.2  Port: 2000

  SSL server policy configured: ssl

  SSL server policy in use: ssl

  Front VPN instance: Not configured

# 在Device上查看SSL VPN访问实例状态，可见SSL VPN访问实例ctx处于Up状态。

[Device] display sslvpn context

Context name: ctx

  Operation state: Up

  AAA domain: Not specified

  Certificate authentication: Disabled

  Password authentication：Enabled

  Authentication use: All

  SMS auth type: Not configured

  Urlmasking: Disabled

  Code verification: Disabled

  Default policy group: Not configured

  Associated SSL VPN gateway: gw

  SSL client policy configured: ssl

  SSL client policy in use: ssl

  Maximum users allowed: 1048575

  VPN instance: Not configured

  Idle timeout: 30 min

  Authentication server-type: aaa

  Password changing: Enabled

# 用户在PC浏览器上输入https://1.1.1.2:2000/，进入登录页面后，输入用户名sslvpn和密码123456，用户可以成功登录。

图-2 登录页面

 

# 用户登录成功后，在网页的应用程序栏中选择“启动TCP客户端应用程序”。

# 单击<启动>按钮，下载TCP接入客户端软件并运行。

说明

不能通过双击的方式打开对应的TCP应用程序。

 

# 用户在PC上执行telnet 127.0.0.1 2323，可以远程连接到Server，显示信息略。

# 在Device上可以看到用户会话信息。

[Device] display sslvpn session context ctx

SSL VPN context: ctx

Users: 1

Username        Connections  Idle time   Created       User IP

sslvpn          6            0/00:12:05  0/00:04:14    40.1.1.1

# 在Device上可以看到TCP端口转发的连接信息。

[Device] display sslvpn port-forward connection

SSL VPN context  : ctx

  Client address : 40.1.1.1

  Client port    : 50788

  Server address : 20.2.2.2

  Server port    : 23

  State          : Connected

配置文件

#

interface GigabitEthernet1/0/1

 ip address 1.1.1.2 255.255.255.0

#

interface GigabitEthernet1/0/2

 ip address 2.2.2.2 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/2

#

security-zone name Untrust

 import interface GigabitEthernet1/0/1

#

 ip route-static 20.2.2.0 24 2.2.2.3

 ip route-static 40.1.1.0 24 1.1.1.3

#

local-user sslvpn class network

 password simple 123456

 service-type sslvpn

 authorization-attribute user-role network-operator

 authorization-attribute sslvpn-policy-group pgroup

#

pki domain sslvpn

 public-key rsa general name sslvpn

 undo crl check enable

#

pki import domain sslvpn der ca filename ca.cer

pki import domain sslvpn p12 local filename server.pfx

#

ssl server-policy ssl

 pki-domain sslvpn

#

sslvpn gateway gw

 ip address 1.1.1.2 port 2000

 ssl server-policy ssl

 service enable

#

sslvpn context ctx

 gateway gw

 port-forward-item pfitem1

  local-port 2323 local-name 127.0.0.1 remote-server 20.2.2.2 remote-port 23 description telnet

 port-forward plist

  resources port-forward-item pfitem1

 policy-group pgroup

  resources port-forward plist

 service enable

#

security-policy ip

 rule 0 name sslvpnlocalout1

  action pass

  source-zone local

  destination-zone untrust

  source-ip-host 1.1.1.2

  destination-ip-host 40.1.1.1

 rule 1 name sslvpnlocalin1

  action pass

  source-zone untrust

  destination-zone local

  source-ip-host 40.1.1.1

  destination-ip-host 1.1.1.2

 rule 2 name sslvpnlocalout2

  action pass

  source-zone local

  destination-zone trust

  source-ip-host 2.2.2.2

  destination-ip-host 20.2.2.2

 rule 3 name sslvpnlocalin2

  action pass

  source-zone trust

  destination-zone local

  source-ip-host 20.2.2.2

  destination-ip-host 2.2.2.2

#