华三SSL VPN基础配置

一、配置防火墙

[H3C]sysname FW1
#配置防火墙内、外网地址，并将其加入相应区域
[FW1]interface gigabitethernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 192.56.2.2 24
[FW1-GigabitEthernet1/0/1]interface gigabitethernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip address 2.2.2.1 24
[FW1-GigabitEthernet1/0/0]security-zone name trust
[FW1-security-zone-Trust]import interface gigabitethernet 1/0/0
[FW1-security-zone-Trust]security-zone name untrust
[FW1-security-zone-Untrust]import interface gigabitethernet 1/0/1
[FW1-security-zone-Untrust]quit

#配置SSL网关地址（使用防火墙出接口地址）及端口号
[FW1]sslvpn gateway wg
[FW1-sslvpn-gateway-wg]ip address 192.168.56.2 port 4433
[FW1-sslvpn-gateway-wg]service enable
[FW1-sslvpn-gateway-wg]quit

#配置地址池范围为10.1.1.1-10.1.1.80
[FW1]sslvpn ip address-pool ssl-pool 10.1.1.1 10.1.1.80

#配置AC接口地址
[FW1]interface sslvpn-ac 1
[FW1-SSLVPN-AC1]ip address 10.1.1.100 24
[FW1-SSLVPN-AC1]quit
#创建SSL VPN实例
[FW1]sslvpn context sslcontext
#引用网关
[FW1-sslvpn-context-sslcontext]gateway wg
#创建路由列表
[FW1-sslvpn-context-sslcontext]ip-route-list nwlist
#添加内网的路由表项
[FW1-sslvpn-context-sslcontext-route-list-nwlist]include 2.2.2.0 24
[FW1-sslvpn-context-sslcontext-route-list-nwlist]quit
#引用AC接口
[FW1-sslvpn-context-sslcontext]ip-tunnel interface sslvpn-ac 1
#引用地址池
[FW1-sslvpn-context-sslcontext]ip-tunnel address-pool ssl-pool mask 24
#创建策略组
[FW1-sslvpn-context-sslcontext]policy-group ssl-policy1
#引用路由表项
[FW1-sslvpn-context-sslcontext-policy-group-ssl-policy1]ip-tunnel access-route ip-route-list nwlist
[FW1-sslvpn-context-sslcontext-policy-group-ssl-policy1]quit
#启用该实例
[FW1-sslvpn-context-sslcontext]service enable
[FW1-sslvpn-context-sslcontext]quit

#创建本地用户，供登录使用
[FW1]local-user user1 class network
[FW1-luser-network-user1]password simple a123456789
[FW1-luser-network-user1]service-type sslvpn
[FW1-luser-network-user1]authorization-attribute sslvpn-policy-group ssl-policy1
[FW1-luser-network-user1]quit

#将AC接口加入安全区域
[FW1-security-policy-ip]security-zone name trust
[FW1-security-zone-Trust]import interface sslvpn-ac1

[FW1]security-policy ip
#配置安全策略，放行4433端口
[FW1-security-policy-ip]rule 10 name ssl-pass
[FW1-security-policy-ip-10-ssl-pass]service-port tcp destination eq 4433
[FW1-security-policy-ip-10-ssl-pass]action pass
#配置安全策略，放行相应流量
[FW1-security-policy-ip]rule 15 name trust-to-trust
[FW1-security-policy-ip-15-trust-to-trust]source-zone trust
[FW1-security-policy-ip-15-trust-to-trust]destination-zone trust
[FW1-security-policy-ip-15-trust-to-trust]action pass

二、配置inode客户端

三、测试连接

使用ping测试，能够ping通2.2.2.2。