< Home

CLI: Example for Enabling Remote Users to Access the Headquarters through SSL VPN (AD Authentication + Local Authorization)

Networking Requirements

Figure 1 shows the network topology. Mobile users can access resources at the headquarters using SSL VPNs. An AD server is used to authenticate access users.

Requirements are as follows:

  • Top executives on the move or working at home can obtain IP addresses and access the intranet smoothly and securely. They can also access the Webmail and ERP systems using a browser.
  • Employees on the move or working at home can access the Webmail and ERP systems using a browser.
Figure 1 Mobile users accessing the headquarters using SSL VPNs

Procedure

  1. Set an IP address for each interface and assign the interfaces to security zones.

    # Set interface IP addresses.

    <FW> system-view
[FW] interface GigabitEthernet 0/0/1
[FW-GigabitEthernet0/0/1] ip address 1.1.1.1 24 
[FW-GigabitEthernet0/0/1] quit
[FW] interface GigabitEthernet 0/0/2
[FW-GigabitEthernet0/0/2] ip address 10.2.0.1 16
[FW-GigabitEthernet0/0/2] quit

    # Assign interfaces to security zones.

    [FW] firewall zone untrust
[FW-zone-untrust] add interface GigabitEthernet 0/0/1 
[FW-zone-untrust] quit
[FW] firewall zone trust 
[FW-zone-trust] add interface GigabitEthernet 0/0/2
[FW-zone-trust] quit

  2. Configure security policies.

    # Configure a security policy to allow users to set up SSL VPN tunnels with the FW.

    [FW] security-policy
[FW-policy-security] rule name policy_sslvpn_1
[FW-policy-security-policy_sslvpn_1] source-zone untrust
[FW-policy-security-policy_sslvpn_1] destination-zone local
[FW-policy-security-policy_sslvpn_1] destination-address 1.1.1.1 32
[FW-policy-security-policy_sslvpn_1] service https
[FW-policy-security-policy_sslvpn_1] action permit
[FW-policy-security-policy_sslvpn_1] quit

    # Configure a security policy to allow the FW to interact with the Webmail and ERP systems.

    [FW-policy-security] rule name policy_sslvpn_2
[FW-policy-security-policy_sslvpn_2] source-zone local
[FW-policy-security-policy_sslvpn_2] destination-zone trust
[FW-policy-security-policy_sslvpn_2] destination-address 10.2.0.10 32
[FW-policy-security-policy_sslvpn_2] destination-address 10.2.0.11 32
[FW-policy-security-policy_sslvpn_2] action permit
[FW-policy-security-policy_sslvpn_2] quit

    # Configure a security policy to allow network extension users to access intranet resources.

    [FW-policy-security] rule name policy_sslvpn_3
[FW-policy-security-policy_sslvpn_3] source-zone untrust
[FW-policy-security-policy_sslvpn_3] destination-zone trust
[FW-policy-security-policy_sslvpn_3] source-address range 172.16.1.1 172.16.1.100
[FW-policy-security-policy_sslvpn_3] destination-address 10.2.0.0 16
[FW-policy-security-policy_sslvpn_3] action permit
[FW-policy-security-policy_sslvpn_3] quit

    # Configure a security policy to allow the FW to communicate with the AD server.

    [FW-policy-security] rule name policy_ad_server
[FW-policy-security-policy_ad_server] source-zone local
[FW-policy-security-policy_ad_server] destination-zone trust
[FW-policy-security-policy_ad_server] destination-address 10.2.0.155 32
[FW-policy-security-policy_ad_server] destination-address 10.2.0.156 32
[FW-policy-security-policy_ad_server] action permit
[FW-policy-security-policy_ad_server] quit

  3. Set parameters for interconnection between the FW and AD server.

    The parameter settings on the NGFW must be consistent with those on the AD server.

    [FW] ad-server template ad_server   
[FW-ad-ad_server] ad-server authentication 10.3.0.155 88 no-ssl
[FW-ad-ad_server] ad-server authentication 10.3.0.156 88 secondary no-ssl
[FW-ad-ad_server] ad-server authentication base-dn dc=cce,dc=com
[FW-ad-ad_server] ad-server authentication manager cn=administrator,cn=users Admin@123 Admin@123
[FW-ad-ad_server] ad-server authentication host-name info-server.cce.com
[FW-ad-ad_server] ad-server authentication host-name info-server2.cce.com secondary
[FW-ad-ad_server] ad-server authentication ldap-port 389      
[FW-ad-ad_server] ad-server user-filter sAMAccountName         
[FW-ad-ad_server] ad-server group-filter ou

    If you are unfamiliar with the AD server and cannot provide the server name, Base DN, or filter field values, you can use the AD Explorer or AD Browser software to connect to the AD server to query the attribute values. The AD Explorer is used as an example. The AD server attributes and mappings between the server attributes and parameters on the FW are as follows.

    # Test the connectivity between the FW and AD server.

    [FW-ad-ad_server] test-aaa user_0001 Admin@123 ad-template ad_server
[FW-ad-ad_server] quit

    The user name and password used for the test must be the same as those on the AD server.

  4. Configure an authentication domain.

    [FW] aaa
[FW-aaa] authentication-scheme ad
[FW-aaa-authen-ad] authentication-mode ad
[FW-aaa-authen-ad] quit
[FW-aaa] domain cce.com
[FW-aaa-domain-cce.com] service-type ssl-vpn
[FW-aaa-domain-cce.com] authentication-scheme ad
[FW-aaa-domain-cce.com] ad-server ad_server 
[FW-aaa-domain-cce.com] reference user current-domain
[FW-aaa-domain-cce.com] quit
[FW-aaa] quit

  5. Configure a policy to import user information from the AD server to the FW.

    [FW] user-manage import-policy ad_server from ad 
[FW-import-ad_server] server template ad_server
[FW-import-ad_server] server basedn dc=cce,dc=com
[FW-import-ad_server] server searchdn ou=director,dc=cce,dc=com
[FW-import-ad_server] server searchdn ou=employee,dc=cce,dc=com
[FW-import-ad_server] destination-group /cce.com
[FW-import-ad_server] user-attribute sAMAccountName
[FW-import-ad_server] import-type all         
[FW-import-ad_server] import-override enable 
[FW-import-ad_server] sync-mode incremental schedule interval 120
[FW-import-ad_server] sync-mode full schedule daily 01:00
[FW-import-ad_server] quit

    The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)). To change them, run the user-filter and group-filter commands.

  6. Execute the import policy to import users to the FW.

    [FW] execute user-manage import-policy ad_server
 Now importing user, security group and user-group information from remote server...successfully.

    After the import succeeds, you can run the display user-manage user verbose command to view information about the imported users.

  7. Set the new user option for the authentication domain on the FW.

    [FW] aaa
[FW-aaa] domain cce.com
[FW-aaa-domain-cce.com] new-user add-temporary group /cce.com auto-import ad_server
[FW-aaa-domain-cce.com] quit
[FW-aaa] quit

  8. Configure an SSL VPN virtual gateway.

    # Create an SSL VPN virtual gateway.

    [FW] v-gateway example interface GigabitEthernet 0/0/1 private example.huawei.com
[FW-example] quit

    # Configure the maximum number of users and maximum number of concurrent users allowed by the virtual gateway.

    [FW] v-gateway example max-user 150
[FW] v-gateway example cur-max-user 100

    # Bind the virtual gateway to the authentication domain.

    [FW] v-gateway example authentication-domain cce.com

    If the virtual gateway is bound to an authentication domain, the user name entered for a login should not carry the authentication domain information. If the user name carries an authentication domain name, the gateway considers the string following the at sign (@) as a part of the user name, not an authentication domain name. For example, if the virtual gateway has been bound to the authentication domain cce.com, you should enter user_0001, not user_0001@cce.com, as the user name.

  9. Configure the web proxy function.

    # Enable the web proxy function.

    [FW] v-gateway example
[FW-example] service
[FW-example-service] web-proxy enable

    # Add web proxy resources Webmail and ERP.

    [FW-example-service] web-proxy proxy-resource Webmail http://10.2.0.10 show-link
[FW-example-service] web-proxy proxy-resource ERP http://10.2.0.11 show-link

  10. Configure the network extension function.

    # Enable the network extension function.

    [FW-example-service] network-extension enable

    # Configure the network extension address pool.

    [FW-example-service] network-extension netpool 172.16.1.1 172.16.1.100 255.255.255.0

    # Set the network extension routing mode to manual.

    [FW-example-service] network-extension mode manual

    # Configure the intranet subnet accessible to network extension users.

    [FW-example-service] network-extension manual-route 10.2.0.0 255.255.0.0
[FW-example-service] quit

  11. Configure SSL VPN role authorization/users.

    # Add user groups director and employee to the virtual gateway.

    [FW-example] vpndb
[FW-example-vpndb] group /cce.com/director
[FW-example-vpndb] group /cce.com/employee
[FW-example-vpndb] quit

    # Create roles director and employee.

    [FW-example] role
[FW-example-role] role director
[FW-example-role] role employee

    # Bind the roles to corresponding user groups.

    [FW-example-role] role director group /cce.com/director
[FW-example-role] role employee group /cce.com/employee

    # Configure functions for the roles. Enable web proxy and network extension for role director and web proxy for role employee.

    [FW-example-role] role director web-proxy network-extension enable
[FW-example-role] role employee web-proxy enable

    # Associate the roles with web proxy resources.

    [FW-example-role] role director web-proxy resource Webmail
[FW-example-role] role director web-proxy resource ERP
[FW-example-role] role employee web-proxy resource Webmail
[FW-example-role] role employee web-proxy resource ERP
[FW-example-role] quit
[FW-example] quit

Verifying the Configuration

  1. Enter example.huawei.com or https://1.1.1.1 in the address box of the browser to access the SSL VPN login page using the teleworker account. Upon initial login, install the controls as instructed by the browser.

    Virtual gateways of different versions require Active controls of different versions to be installed on the client. When a client is used to access virtual gateways of different versions. Delete the old Active control and install a new one for accessing a new virtual gateway. Otherwise, the browser will be stuck at the control loading page.

    If the client is on a PC, run the following command to delete a control:

    PC> regsvr32 SVNIEAgt.ocx -u -s 
PC> del %systemroot%\SVNIEAgt.ocx /q 
PC> del %systemroot%\"Downloaded Program Files"\SVNIEAgt.inf /q 
PC> cd %appdata% 
PC> rmdir svnclient /q /s
  2. Enter the user name and password on the login page to log in to the SSL VPN gateway.

  3. After logging in to the SSL VPN gateway using the top executive account user_0001, you can use the web proxy and network extension service. You can click Webmail and ERP to use corresponding services. Click Start to automatically install the virtual network adapter to obtain a virtual IP address. After that, you can use various services just as you are on a LAN.

  4. Use common employee account user_0002 to log in to the SSL VPN gateway. You can use only the web proxy service. You can click Webmail and ERP to use corresponding services.

Configuration Scripts

#
ad-server template ad_server             
 ad-server authentication 10.2.0.155 88 no-ssl    
 ad-server authentication 10.2.0.156 88 secondary no-ssl
 ad-server authentication base-dn dc=cce,dc=com
 ad-server authentication manager cn=administrator,cn=users %$%$M#._~J4QrR[kJu7PUMtHUqh_%$%$
 ad-server authentication host-name info-server2.cce.com secondary
 ad-server authentication host-name info-server.cce.com
 ad-server authentication ldap-port 389       
 ad-server user-filter sAMAccountName         
 ad-server group-filter ou 
 ad-server ip-address-filter VIP mask-filter VIPMask
#
interface GigabitEthernet0/0/1
 ip address 1.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 ip address 10.2.0.1 255.255.0.0
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/2
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#  
 user-manage import-policy ad_server from ad 
 server template ad_server
 server basedn dc=cce,dc=com
 server searchdn ou=director,dc=cce,dc=com
 server searchdn ou=employee,dc=cce,dc=com
 destination-group /cce.com
 user-attribute sAMAccountName
 user-filter (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer)))
 group-filter (|(objectclass=organizationalUnit)(ou=*)) 
 import-type all          
 import-override enable 
 sync-mode incremental schedule interval 120
 sync-mode full schedule daily 01:00
#
aaa 
 authentication-scheme ad
  authentication-mode ad
 #
 domain cce.com
  authentication-scheme ad 
  ad-server ad_server 
  service-type ssl-vpn 
  reference user current-domain
  new-user add-temporary group /cce.com auto-import ad_server
#
v-gateway example interface GigabitEthernet0/0/1 private example.huawei.com
v-gateway example authentication-domain cce.com
v-gateway example max-user 150
v-gateway example cur-max-user 100
#
v-gateway example
 service
  web-proxy enable
  web-proxy web-link enable
  web-proxy proxy-resource Webmail http://10.2.0.10 show-link
  web-proxy proxy-resource ERP http://10.2.0.11 show-link
  network-extension enable
  network-extension keep-alive enable
  network-extension netpool 172.16.1.1 172.16.1.100 255.255.255.0
  network-extension mode manual
  network-extension manual-route 10.2.0.0 255.255.0.0
 role
  role director condition all
  role director network-extension enable
  role director web-proxy enable
  role director web-proxy resource ERP
  role director web-proxy resource Webmail
  role employee condition all
  role employee web-proxy enable
  role employee web-proxy resource ERP
  role employee web-proxy resource Webmail
#
security-policy
 rule name policy_sslvpn_1
  source-zone untrust
  destination-zone local
  destination-address 1.1.1.1 32
  service https
  action permit
 rule name policy_sslvpn_2
  source-zone local
  destination-zone trust
  destination-address 10.2.0.10 32
  destination-address 10.2.0.11 32
  action permit
 rule name policy_sslvpn_3
  source-zone untrust
  destination-zone trust
  source-address range 172.16.1.1 172.16.1.100
  destination-address 10.2.0.0 16
  action permit
 rule name policy_ad_server
  source-zone local
  destination-zone trust
  destination-address 10.2.0.155 32
  destination-address 10.2.0.156 32
  action permit

# The following configuration is used to perform a one-time operation and not stored in the configuration profile.
 execute user-manage import-policy ad_server
# The following configuration is stored in the database, but not in the configuration profile. 
 v-gateway example
  vpndb
   group /cce.com/director
   group /cce.com/employee
  role
   role director group /cce.com/director
   role director group /cce.com/employee
Parent Topic: SSL VPN
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >