Web: Example for Enabling Mobile Employees to Access the Headquarters Through SSL VPN Tunnels (MAC Address Authentication)

Procedure

1. Configure an interface.
   1. Choose Network > Interface.
   2. Click of GigabitEthernet 0/0/1 and set required parameters.

      Security zone	untrust
      IPv4
      IP address	1.1.1.1/24

   3. Click OK.
   4. Configure GigabitEthernet 0/0/2 based on the preceding step.

      Security zone	trust
      IPv4
      IP address	10.2.0.1/24

2. Configure users and authentication.
   1. Choose Object > User > default and set required parameters.

      The user group of user user0001 is /default/group1, User Location is local authentication, and Password is Password@123.

      

   2. Click Apply.
3. Configure the SSL VPN gateway.
   1. Choose Network > SSL VPN > SSL VPN.
   2. Click Network and set required parameters as follows.

      

   3. Click Next.
4. Set the SSL version, encryption suite, as well as session timeout duration and lifecycle. You can use the default values. Click Next.
5. Select Network Extension and click Next.
   

   MAC address authentication can be used in multiple service scenarios, such as web proxy, file sharing, port forwarding, and network extension. Which services users access is not the focus of this section. In this section, network extension is used as an example.

6. Configure network extension.
   1. In Accessible Private Network Segment List, click Add. Set required parameters.

      

   2. Click Next.
7. Configure SSL VPN role authorization/users.
   1. In List of Authorized Roles, click Add and set role authorization parameters according to the following figure. Then click OK.

      

   2. Return to the Role Authorization/User page and click OK.
8. Configure MAC address authentication.
   1. Choose Network > SSL VPN > SSL VPN.
   2. Click of virtual gateway gateway.
   3. Select MAC Authentication.

      

   4. Click Enable to enable MAC authentication.
   5. Click Add Configure a MAC address group and associate it with the user group of employee user0001. Then click OK.

      

   6. Return to the MAC address authentication configuration page and click OK.
9. Configure a security policy to allow mobile employees to access resources at the headquarters.
   1. Configure a security policy for traffic from the Internet to the FW to allow mobile employees to access the SSL VPN gateway.
      1. Choose Policy > Security Policy > Security Policy.
      2. Click Add and configure security policy policy01 based on the following parameters:

         Name	policy01
         Source Zone	untrust
         Destination zone	local
         Destination Address/Region	1.1.1.1/24
         Services	https
         Action	Permit

      3. Click OK.

   2. Configure a security policy for traffic from the FW to the intranet to allow mobile employees to access resources at the headquarters.
      1. Choose Policy > Security Policy > Security Policy.
      2. Click add and configure security policy policy02 based on the following parameters:

         Name	policy02
         Source Zone	untrust
         Destination zone	trust
         Destination Address/Region	10.2.0.0/24
         Action	Permit

      3. Click OK.