< Home

Web: Example for Enabling Remote Users to Access the Headquarters through SSL VPN (LDAP Authentication + Local Authorization)

Networking Requirements

Figure 1 shows the network topology. Mobile users can access resources at the headquarters using SSL VPNs. An LDAP server is used to authenticate access users.

The FW supports MS Active Directory (AD LDAP), Sun ONE LDAP, and Open LDAP servers. This section uses the Sun ONE LDAP server as an example.

Requirements are as follows:

  • Top executives on the move or working at home can obtain IP addresses and access the intranet smoothly and securely. They can also access the Webmail and ERP systems using a browser.
  • Employees on the move or working at home can access the Webmail and ERP systems using a browser.
Figure 1 Mobile users accessing the headquarters using SSL VPNs

Data Planning

Item

Data

Interface

Interface ID: GigabitEthernet 0/0/1

IP address: 1.1.1.1/24

Security zone: Untrust

Interface ID: GigabitEthernet 0/0/2

IP address: 10.2.0.1/16

Security zone: Trust

Teleworker account

Top executive

User name: user_0001

Group: /cce.com/director

Common employee

User name: user_0002

Group: /cce.com/employee

Virtual gateway

Name: example

Interface: GigabitEthernet 0/0/1

Domain name: example.huawei.com

Maximum number of users: 150

Maximum number of online users: 100

Sun ONE LDAP server

IP address: 10.2.0.155

Port: 389

Web proxy resource

Name: Webmail; link: http://10.2.0.10

Name: ERP; link: http://10.2.0.11

Network extension

Network extension address pool: 172.16.1.1-172.16.1.100

Routing mode: Manual

Intranet subnet accessible to network extension users: 10.2.0.0/16

Procedure

  1. Configure interfaces.
    1. Choose Network > Interface.
    2. Click of GE0/0/1 and set the following parameters:

      Zone

      untrust

      IPv4

      IP Address

      1.1.1.1/24

      Default Gateway

      1.1.1.2

    3. Click OK.
    4. Repeat the preceding steps to configure GE0/0/2.

      Zone

      trust

      IPv4

      IP Address

      10.2.0.1/16

  2. Configure security policies.
    1. Choose Policy > Security Policy > Security Policy.
    2. Click Add.
    3. Configure security policy policy_sslvpn_1 and set the parameters as follows:

      Name

      policy_sslvpn_1

      Source Zone

      untrust

      Destination Zone

      local

      Destination Address

      1.1.1.1/32

      Service

      https

      Action

      Permit

    4. Click OK.
    5. Repeat the preceding steps to configure security policy policy_sslvpn_2 as follows:

      Name

      policy_sslvpn_2

      Source Zone

      local

      Destination Zone

      trust

      Destination Address

      10.2.0.10/32,10.2.0.11/32

      Action

      Permit

    6. Repeat the preceding steps to configure security policy policy_sslvpn_3 as follows:

      Name

      policy_sslvpn_3

      Source Zone

      untrust

      Destination Zone

      trust

      Source Address

      172.16.1.1-172.16.1.100

      Destination Address

      10.2.0.0/16

      Action

      Permit

    7. Repeat the preceding steps to configure security policy policy_ldap_server as follows:

      Name

      policy_ldap_server

      Source Zone

      local

      Destination Zone

      trust

      Destination Address

      10.2.0.155/32

      Action

      Permit

  3. Choose Object > Authentication Server > LDAP and set parameters for interconnection between the FW and LDAP server.

    For the V600R007C20 version, whether to enable SSL for LDAP authentication cannot be configured on the web UI. When you configure the LDAP server on the web UI, no SSL (no-ssl) is enabled by default. To enable SSL (ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ldap-server authentication 10.2.0.155 389 ssl command in the corresponding LDAP server template view. When ssl is deployed, it must also be enabled on the LDAP server. For details, see the operating system guide of the LDAP server. From V600R007C20SPC100, you can configure whether to enable SSL for LDAP authentication on the Web UI. The following uses no-ssl as an example.

    If you are unfamiliar with the LDAP server and cannot provide the server name, Base DN, or filter field values, you can use the LDAP Browser/Editor software to connect to the LDAP server to query the attribute values. The LDAP Browser/Editor is used as an example. The LDAP server attributes and mappings between the server attributes and parameters on the FW are as follows.

    Click Test. In the dialog box that is displayed, click OK and enter the user name and password. Click Start to check the connectivity to the LDAP server.

    The user name and password used for the test must be the same as those on the LDAP server.

  4. Choose Object > User > Authentication Domain, configure an authentication domain.

    When the FW uses AD or LDAP authentication, the authentication domain name configured on the FW must be the same as that configured on the authentication server. In this example, the domain name on the LDAP server is cce.com. Therefore, the authentication domain name must be set to cce.com on the FW.

  5. Choose Object > User > User Import > Server Import, click Add, configure a policy to import user information from the LDAP server to the FW.

    After the policy is created, click to import the users and organizational structures from the authentication server to the FW.

    After the import succeeds, choose Object > User > User/Group to view the user and organizational structure information.

  6. Choose Object > User and select cce.com.
    1. Set Scenario to Online behavior management and SSL VPN access and set the following parameters.

    2. Set new user options for the authentication domain.

  7. Configure an SSL VPN gateway, including the gateway address, user authentication, and maximum number of concurrent users.
    1. Choose Network > SSL VPN > SSL VPN.
    2. Click the Add, configure an SSL VPN gateway and set the parameters as follows.

      If the virtual gateway is bound to an authentication domain, the user name entered for a login should not carry the authentication domain information. If the user name carries an authentication domain name, the gateway considers the string following the at sign (@) as a part of the user name, not an authentication domain name. For example, if the virtual gateway has been bound to the authentication domain cce.com, you should enter user_0001, not user_0001@cce.com, as the user name.

    3. Click Next.
  8. Configure the SSL parameter.
    1. Configure the SSL parameter. In the example, use the default algorithms.
    2. Click Next.
  9. Select the services to be enabled.
    1. Select Web Proxy and Network Extension.

    2. Click Next.
  10. Configure the network extension function.
    1. Set the Available IP Address Range and Accessible Private Network Segment List to the network extension function as follows:

    2. Click Next.
  11. Configure the web proxy function and add resources Webmail and ERP.
    1. In Web Proxy Resource List, click Add.

    2. Add web proxy resource Webmail as follows:

    3. Click OK.
    4. Repeat the preceding steps to add web proxy resource ERP as follows:

    5. Click OK.
    6. Click Next.
  12. Configure SSL VPN role authorization/users.
    1. Under List of Authorized Roles, click Add.

    2. Add director user group to a role and associate corresponding permissions.

    3. Click OK.
    4. Add employee user group to a role and associate corresponding permissions.

    5. Click OK.
    6. Click Finish.

Verifying the Configuration

  1. Enter example.huawei.com or https://1.1.1.1 in the address box of the browser to access the SSL VPN login page using the teleworker account. Upon initial login, install the controls as instructed by the browser.

    Virtual gateways of different versions require Active controls of different versions to be installed on the client. When a client is used to access virtual gateways of different versions. Delete the old Active control and install a new one for accessing a new virtual gateway. Otherwise, the browser will be stuck at the control loading page.

    If the client is on a PC, run the following command to delete a control:

    PC> regsvr32 SVNIEAgt.ocx -u -s 
PC> del %systemroot%\SVNIEAgt.ocx /q 
PC> del %systemroot%\"Downloaded Program Files"\SVNIEAgt.inf /q 
PC> cd %appdata% 
PC> rmdir svnclient /q /s
  2. Enter the user name and password on the login page to log in to the SSL VPN gateway.

  3. After logging in to the SSL VPN gateway using the top executive account user_0001, you can use the web proxy and network extension service. You can click Webmail and ERP to use corresponding services. Click Start to automatically install the virtual network adapter to obtain a virtual IP address. After that, you can use various services just as you are on a LAN.

  4. Use common employee account user_0002 to log in to the SSL VPN gateway. You can use only the web proxy service. You can click Webmail and ERP to use corresponding services.

Configuration Scripts

#
ldap-server template ldap_server             
 ldap-server authentication 10.2.0.155 389 no-ssl       
 ldap-server authentication base-dn dc=cce,dc=com
 ldap-server authentication manager uid=manager_user %$%$M#._~J4QrR[kJu7PUMtHUqh_%$%$
 ldap-server group-filter ou 
 ldap-server authentication-filter (objectclass=*)
 ldap-server user-filter uid 
 ldap-server server-type sun-one
 undo ldap-server authentication manager-with-base-dn enable
#
interface GigabitEthernet0/0/1
 ip address 1.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 ip address 10.2.0.1 255.255.0.0
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/2
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#  
 user-manage import-policy ldap_server from ldap 
 server template ldap_server
 server basedn dc=cce,dc=com
 server searchdn dc=cce,dc=com
 destination-group /cce.com
 user-attribute uid
 user-filter (&(|(objectclass=person)(objectclass=organizationalPerson))(uid=*))
 group-filter (|(objectclass=organizationalUnit)(ou=*)) 
 import-type user-group          
 import-override enable 
 sync-mode incremental schedule interval 120
 sync-mode full schedule daily 01:00
#
aaa 
 authentication-scheme ldap
  authentication-mode ldap
 #
 domain cce.com
  authentication-scheme ldap 
  ldap-server ldap_server 
  service-type internetaccess ssl-vpn 
  reference user current-domain
  new-user add-temporary group /cce.com auto-import ldap_server
#
v-gateway example interface GigabitEthernet0/0/1 private example.huawei.com
v-gateway example authentication-domain cce.com
v-gateway example max-user 150
v-gateway example cur-max-user 100
#
v-gateway example
basic
  ssl timeout 5
  ssl lifecycle 1440
 service
  web-proxy enable
  web-proxy web-link enable
  web-proxy proxy-resource Webmail http://10.2.0.10 show-link
  web-proxy proxy-resource ERP http://10.2.0.11 show-link
  network-extension enable
  network-extension keep-alive enable
  network-extension netpool 172.16.1.1 172.16.1.100 255.255.255.0
  network-extension mode manual
  network-extension manual-route 10.2.0.0 255.255.0.0
 role
  role director condition all
  role director network-extension enable
  role director web-proxy enable
  role director web-proxy resource ERP
  role director web-proxy resource Webmail
  role employee condition all
  role employee web-proxy enable
  role employee web-proxy resource ERP
  role employee web-proxy resource Webmail
#
security-policy
 rule name policy_sslvpn_1
  source-zone untrust
  destination-zone local
  destination-address 1.1.1.1 32
  service https
  action permit
 rule name policy_sslvpn_2
  source-zone local
  destination-zone trust
  destination-address 10.2.0.10 32
  destination-address 10.2.0.11 32
  action permit
 rule name policy_sslvpn_3
  source-zone untrust
  destination-zone trust
  source-address range 172.16.1.1 172.16.1.100
  destination-address 10.2.0.0 16
  action permit
 rule name policy_ldap_server
  source-zone local
  destination-zone trust
  destination-address 10.2.0.155 32
  action permit

# The following configuration is used to perform a one-time operation and not stored in the configuration profile.
 execute user-manage import-policy ldap_server
# The following configuration is stored in the database, but not in the configuration profile. 
 v-gateway example
  vpndb
   group /cce.com/director
   group /cce.com/employee
  role
   role director group /cce.com/director
   role director group /cce.com/employee
Parent Topic: SSL VPN
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >