Web: Example for Configuring a Base Station to Obtain an IP Address from the FW Using the IKEv2 Configuration Payload

Procedure

1. Complete the basic configurations of the FW.
   1. Set interface IP addresses and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set the parameters as follows.

         Zone	untrust
         IPv4
         IP Address	1.1.1.1/24

      3. Click OK.

      4. Repeat the preceding steps to configure GE0/0/3.

         Zone	trust
         IPv4
         IP Address	10.1.1.1/24

   2. Configure security policies to allow specific subnets to communicate.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add and set the following parameters for the Trust -> Untrust interzone policy. In the example, the private subnet assigned to the base station is 10.1.2.0/24.

         Name	policy1
         Source Zone	trust
         Destination Zone	untrust
         Source Address/Region	10.1.1.0/24
         Destination Address/Region	10.1.2.0/24
         Action	Permit

      3. Click OK.

      4. Repeat the preceding steps to configure Untrust -> Trust, Untrust -> Local, and Local -> Untrust interzone policies.

         The parameters of the security policy for the Untrust -> Trust interzone are as follows.

         Name	policy2
         Source Zone	untrust
         Destination Zone	trust
         Source Address/Region	10.1.2.0/24
         Destination Address/Region	10.1.1.0/24
         Action	Permit

         The parameters of the Untrust -> Local interzone policy are as follows.

         Name	policy3
         Source Zone	untrust
         Destination Zone	local
         Source Address/Region	2.2.2.2/32
         Destination Address/Region	1.1.1.1/32
         Action	Permit

         The parameters of the Local -> Untrust interzone policy are as follows.

         Name	policy4
         Source Zone	local
         Destination Zone	untrust
         Source Address/Region	1.1.1.1/32
         Destination Address/Region	2.2.2.2/32
         Action	Permit

         

         The local-untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).

   3. Configure a default route. In the example, the next-hop IP address to the Internet is 1.1.1.2.
      1. Choose Network > Router > Static Route.

         

      2. Click Add and set parameters as follows.

         Destination Address/Mask	0.0.0.0/0.0.0.0
         Next Hop	1.1.1.2

      3. Click OK.

   4. Configure the IPSec tunnel on FW_A.
      1. Choose Network > IPSec > IPSec, click Add, and set the parameters shown in the following figure.

         

         In the example, the pre-shared key is Admin@123, and the default parameters are used for the security proposal. To change parameter values, expand the Advanced settings of IKE/IPSec Proposal. The security proposals used by the tunnel ends must be the same.

         

         Create an address pool in advance. The parameter settings are provided in the following figure.

         

         Configure one data flow to be encrypted. The parameter settings are provided in the following figure.

         

      2. Click Apply in the IPSec policy configuration to complete the configuration of the FW.