Web: Example for Enabling Remote Users to Access the Headquarters through SSL VPN (AD Authentication + Local Authorization)

Procedure

1. Configure interfaces.
   1. Choose Network > Interface.
   2. Click of GE0/0/1 and set the following parameters:

      Zone	untrust
      IPv4
      IP Address	1.1.1.1/24
      Default Gateway	1.1.1.2

   3. Click OK.
   4. Repeat the preceding steps to configure GE0/0/2.

      Zone	trust
      IPv4
      IP Address	10.2.0.1/16

2. Configure security policies.
   1. Choose Policy > Security Policy > Security Policy.
   2. Click Add.
   3. Configure security policy policy_sslvpn_1 and set the parameters as follows:

      Name	policy_sslvpn_1
      Source Zone	untrust
      Destination Zone	local
      Destination Address	1.1.1.1/32
      Service	https
      Action	Permit

   4. Click OK.
   5. Repeat the preceding steps to configure security policy policy_sslvpn_2 as follows:

      Name	policy_sslvpn_2
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.2.0.10/32,10.2.0.11/32
      Action	Permit

   6. Repeat the preceding steps to configure security policy policy_sslvpn_3 as follows:

      Name	policy_sslvpn_3
      Source Zone	untrust
      Destination Zone	trust
      Source Address	172.16.1.1-172.16.1.100
      Destination Address	10.2.0.0/16
      Action	Permit

   7. Repeat the preceding steps to configure security policy policy_ad_server as follows:

      Name	policy_ad_server
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.2.0.155/32,10.2.0.156/32
      Action	Permit

3. Choose Object > Authentication Server > AD and set parameters for interconnection between the FW and AD server.

   

   

   

   For the V600R007C20 version, whether to enable SSL for AD authentication cannot be configured on the web UI. When you configure the AD server on the web UI, SSL (ldap-over-ssl) is enabled by default. In this mode, LDAP over SSL must also be enabled on the AD server. For details, see the operating system guide of the AD server. To disable SSL (no-ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ad-server authentication 10.2.0.155 88 no-ssl command in the corresponding AD server template view. From V600R007C20SPC100, you can configure whether to enable SSL for AD authentication on the Web UI. The following uses no-ssl as an example.

   If you are unfamiliar with the AD server and cannot provide the server name, Base DN, or filter field values, you can use the AD Explorer or AD Browser software to connect to the AD server to query the attribute values. The AD Explorer is used as an example. The AD server attributes and mappings between the server attributes and parameters on the FW are as follows.

   

   Click Test. In the dialog box that is displayed, click OK and enter the user name and password. Click Start to check the connectivity to the AD server.

   

   The user name and password used for the test must be the same as those on the AD server.

   

4. Choose Object > User > Authentication Domain, configure an authentication domain.

   

   

   When the FW uses AD or LDAP authentication, the authentication domain name configured on the FW must be the same as that configured on the authentication server. In this example, the domain name on the AD server is cce.com. Therefore, the authentication domain name must be set to cce.com on the FW.

5. Choose Object > User > User Import > Server Import, click Add and configure a policy to import user information from the AD server to the FW.

   

   

   After the policy is created, click to import the users and organizational structures from the authentication server to the FW.

   

   After the import succeeds, choose Object > User > User/Group to view the user and organizational structure information.

   

6. Choose Object > User and select cce.com.
   1. Set Scenario to Online behavior management and SSL VPN access and set the following parameters.

      

   2. Set new user options for the authentication domain.

      

7. Configure an SSL VPN gateway, including the gateway address, user authentication, and maximum number of concurrent users.
   1. Choose Network > SSL VPN > SSL VPN.
   2. Click the Add, configure an SSL VPN gateway and set the parameters as follows.

      

      

      

      If the virtual gateway is bound to an authentication domain, the user name entered for a login should not carry the authentication domain information. If the user name carries an authentication domain name, the gateway considers the string following the at sign (@) as a part of the user name, not an authentication domain name. For example, if the virtual gateway has been bound to the authentication domain cce.com, you should enter user_0001, not user_0001@cce.com, as the user name.

   3. Click Next.
8. Configure the SSL parameter.
   1. Configure the SSL parameter as follows. In the example, use the default algorithms.
   2. Click Next.
9. Select the services to be enabled.
   1. Select Web Proxy and Network Extension.

      

   2. Click Next.
10. Configure the network extension function.
    1. Set the Available IP Address Range and Accessible Private Network Segment List to the network extension function as follows:

       

    2. Click Next.
11. Configure the web proxy function and add resources Webmail and ERP.
    1. In Web Proxy Resource List, click Add.

       

    2. Add web proxy resource Webmail as follows:

       

    3. Click OK.
    4. Repeat the preceding steps to add web proxy resource ERP as follows:

       

    5. Click OK.
    6. Click Next.
12. Configure SSL VPN role authorization/users.
    1. Under List of Authorized Roles, click Add.

       

    2. Add director user group to a role and associate corresponding permissions.

       

    3. Click OK.
    4. Add employee user group to a role and associate corresponding permissions.

       

    5. Click OK.
    6. Click Finish.