Web: Example for Enabling Multiple Tenants to Access the Enterprise Intranet Using the Exclusive Mode Virtual Gateway That Shares the Public IP Address

Procedure

1. Configure parameters in the root system.
   1. Configure interface corresponding to the public IP address.

      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set the parameters as follows:

         Security zone	untrust
         IPv4
         IP address	1.1.1.1/24
         Default gateway	1.1.1.2

      3. Click OK.

   2. Bind the virtual system and interface.
      1. Choose System > Virtual System > Virtual System.
      2. Configure the interface GE0/0/2 connected to the vsysa, and click .
      3. Click the Allocate Interface and Set Public Interface tab, allocate interfaces to the virtual system, and configure parameters as shown in the following figure.

         

         

      4. Click OK.

   3. Configure security policies from the Internet to the FW.
      1. Choose Policy > Security Policy > Security Policy.
      2. Click Add.
      3. Set the parameters for the security policy named policy_1 as listed in the following table.

         Name	policy_1
         Source Zone	untrust
         Destination Zone	local
         Destination Address	1.1.1.1/32
         Service	https
         Action	Permit

      4. Click OK.

   4. Set public parameters as follows:

      1. Choose Network > SSL VPN > Public Configuration.

      2. Set the parameters as follows:

         

      3. Click Apply.

2. Configure virtual system vsysa.
   1. Create user groups and users.

      1. Choose Object > User > default. Set the user group of user user0001 to /default/company_a, authentication type to local authentication, and password to User0001.

         

         

      2. Click Apply.

   2. Configure the interface connecting to the intranet of enterprise A.
      1. Choose Network > Interface.
      2. Configure interface GE0/0/2 and click . Configure the parameters as listed in the following table.

         Security zone	trust
         IPv4
         IP address	10.2.0.1/24

      3. Click OK.

   3. Configure security policies from the intranet of enterprise A to the FW.
      1. Choose Policy > Security Policy > Security Policy.
      2. Click Add.
      3. Set the parameters for the security policy named policy_2 as listed in the following table.

         Name	policy_2
         Source Zone	local
         Destination Zone	trust
         Destination Address	10.2.0.0/16
         Action	Permit

      4. Click OK.
      5. Repeat the preceding steps to configure security policy named policy_3 as follows:

         Name	policy_3
         Source Zone	untrust
         Destination Zone	trust
         Source Address	172.16.1.1-172.16.1.100
         Destination Address	10.2.0.0/16
         Action	Permit

   4. Configure exclusive mode virtual gateway gateway_A.
      1. Choose Network > SSL VPN > SSL VPN.

      2. Click Add and set the parameters as follows:

         

         

         If the virtual gateway is bound to an authentication domain, the user name entered for a login should not carry the authentication domain information. If the user name carries an authentication domain name, the gateway considers the string following the at sign (@) as a part of the user name, not an authentication domain name. For example, if the virtual gateway has been bound to the authentication domain cce.com, you should enter user_0001, not user_0001@cce.com, as the user name.

         When the local certificate of the exclusive mode virtual gateway is the same as the public device certificate, select Allow the user of the ssl encryption suite and certificate in global configuration for negotiation, encryption, and decryption. When the local certificate is a private certificate, determine whether to select this option based on security requirements.

      3. Click Next.

   5. Set SSL parameters.

      The exclusive mode virtual gateway that shares a public IP address uses common configurations.

   6. Select the services to be enabled.

      1. Select Web Proxy and Network Extension.

         

      2. Click Next.

   7. Configure the network extension function.

      1. Set the Available IP Address Range and Accessible Private Network Segment List to the network extension function as follows:

         

      2. Click Next.

   8. Configure the web proxy function and add resources Webmail and ERP.

      1. Under Web Proxy Resource List, click Add.

         

      2. Add web proxy resource Webmail as follows:

         

      3. Click OK.

      4. Repeat the preceding steps to add web proxy resource ERP as follows:

         

      5. Click OK.
      6. Click Next.

   9. Configure SSL VPN role authorization/users.

      1. Under List of Authorized Roles, click Add.

         

      2. Add roles to the employee group of enterprise A and associate the roles with corresponding permissions.

         

      3. Click OK.
      4. Click Finish.