CLI: Example for Configuring an IPSec Tunnel Between the Headquarters and Branches Through Certificate Authentication (the Headquarters Uses a Certificate Whitelist)
Networking Requirements
A large enterprise has the headquarters and multiple branches. For security purposes, the headquarters and branches establish an IPSec tunnel through certificate authentication to secure communication between them. The enterprise wants to control branch access to the headquarters based on certificates so that only authorized branches can be connected to the headquarters.
In this case, the headquarters can use a certificate attribute access control policy to authenticate the branches' certificates. There are multiple branches, so the configuration workload is heavy, and management and maintenance are inconvenient. Therefore, you are advised to configure a certificate whitelist at the headquarters and add the Common Name (CN) of the branches' certificates to the whitelist. Subsequently, only the branches in the whitelist can be connected to the headquarters.
In Figure 1, FW_B and FW_C in two branches establish an IPSec tunnel with FW_A at the headquarters. The enterprise requires that the headquarters use the certificate whitelist to allow only FW_B to establish an IPSec tunnel with FW_A.
Configuration Roadmap
The configuration roadmap is as follows:
- Configure IP addresses for interfaces and add the interfaces to security zones.
- Configure security policies to allow devices on specified network segments of private networks to exchange packets.
- Configure static routes to ensure reachable routes between networks.
- Configure PKI to apply for local and CA certificates using SCFP.
- Configure IPSec policies for certificate authentication, including configuring the data flows to be protected and IPSec proposal negotiation parameters.
- Configure a certificate whitelist on FW_A so that the headquarters allows only the branch specified in the certificate whitelist to be connected to it.
Data Preparation
Obtain the fingerprint information of a CA certificate from a CA server. This example uses Windows Server 2008 as the CA server. Assume that the CA server uses a challenge password to process the certificate application and the challenge password is 6AE73F21E6D3571D. The challenge password and fingerprint can be obtained at this URL: http://5.1.1.1:8080/certsrv/mscep_admin. It is assumed that the fingerprint information of the CA certificate is 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 in SHA1 mode and the URL at which the certificate is obtained is http://5.1.1.1:8080/certsrv/mscep/mscep.dll.
Prepare a certificate whitelist (by creating a TXT file and changing the file name extension from .txt to .xml), add the CN field (CN-Cer-FWB) of the certificate for FW_B to the whitelist, and import the whitelist to the hda1:/pki/public file of the device through TFTP.
For example, if the certificate whitelist file is cerwhitelist.xml, the format is:
<SerialnumberList> <Serialnumber>CN-Cer-FWB</Serialnumber> </SerialnumberList>
Procedure
- Configure FW_A.
- Configure inter-zone security policies.
# Configure inter-zone security policies between the trust zone and untrust zone.
[FW_A] security-policy [FW_A-policy-security] rule name policy1 [FW_A-policy-security-rule-policy1] source-zone trust [FW_A-policy-security-rule-policy1] destination-zone untrust [FW_A-policy-security-rule-policy1] source-address 10.1.1.0 24 [FW_A-policy-security-rule-policy1] destination-address 10.1.0.0 16 [FW_A-policy-security-rule-policy1] action permit [FW_A-policy-security-rule-policy1] quit [FW_A-policy-security] rule name policy2 [FW_A-policy-security-rule-policy2] source-zone untrust [FW_A-policy-security-rule-policy2] destination-zone trust [FW_A-policy-security-rule-policy2] source-address 10.1.0.0 16 [FW_A-policy-security-rule-policy2] destination-address 10.1.1.0 24 [FW_A-policy-security-rule-policy2] action permit [FW_A-policy-security-rule-policy2] quit
# Configure inter-zone security policies between the local zone and untrust zone.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_A-policy-security] rule name policy3 [FW_A-policy-security-rule-policy3] source-zone local [FW_A-policy-security-rule-policy3] destination-zone untrust [FW_A-policy-security-rule-policy3] source-address 1.1.1.1 32 [FW_A-policy-security-rule-policy3] destination-address 2.1.1.1 32 [FW_A-policy-security-rule-policy3] destination-address 3.1.1.1 32 [FW_A-policy-security-rule-policy3] action permit [FW_A-policy-security-rule-policy3] quit [FW_A-policy-security] rule name policy4 [FW_A-policy-security-rule-policy4] source-zone untrust [FW_A-policy-security-rule-policy4] destination-zone local [FW_A-policy-security-rule-policy4] source-address 2.1.1.1 32 [FW_A-policy-security-rule-policy4] source-address 3.1.1.1 32 [FW_A-policy-security-rule-policy4] destination-address 1.1.1.1 32 [FW_A-policy-security-rule-policy4] action permit [FW_A-policy-security-rule-policy4] quit [FW_A-policy-security] quit
- Configure inter-zone security policies.
- Configure FW_B.
- Configure inter-zone security policies.
# Configure inter-zone security policies between the trust zone and untrust zone.
[FW_B] security-policy [FW_B-policy-security] rule name policy1 [FW_B-policy-security-rule-policy1] source-zone trust [FW_B-policy-security-rule-policy1] destination-zone untrust [FW_B-policy-security-rule-policy1] source-address 10.1.2.0 24 [FW_B-policy-security-rule-policy1] destination-address 10.1.1.0 24 [FW_B-policy-security-rule-policy1] action permit [FW_B-policy-security-rule-policy1] quit [FW_B-policy-security] rule name policy2 [FW_B-policy-security-rule-policy2] source-zone untrust [FW_B-policy-security-rule-policy2] destination-zone trust [FW_B-policy-security-rule-policy2] source-address 10.1.1.0 24 [FW_B-policy-security-rule-policy2] destination-address 10.1.2.0 24 [FW_B-policy-security-rule-policy2] action permit [FW_B-policy-security-rule-policy2] quit
# Configure inter-zone security policies between the local zone and untrust zone.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW_B-policy-security] rule name policy3 [FW_B-policy-security-rule-policy3] source-zone local [FW_B-policy-security-rule-policy3] destination-zone untrust [FW_B-policy-security-rule-policy3] source-address 2.1.1.1 32 [FW_B-policy-security-rule-policy3] destination-address 1.1.1.1 32 [FW_B-policy-security-rule-policy3] action permit [FW_B-policy-security-rule-policy3] quit [FW_B-policy-security] rule name policy4 [FW_B-policy-security-rule-policy4] source-zone untrust [FW_B-policy-security-rule-policy4] destination-zone local [FW_B-policy-security-rule-policy4] source-address 1.1.1.1 32 [FW_B-policy-security-rule-policy4] destination-address 2.1.1.1 32 [FW_B-policy-security-rule-policy4] action permit [FW_B-policy-security-rule-policy4] quit [FW_B-policy-security] quit
- Configure inter-zone security policies.
- Configure FW_C.
For details, see the configuration of FW_B.
Verification
After the preceding configurations are complete, PC2 can ping PC1 successfully, but PC3 cannot ping PC1.
Run the display ike sa command on FW_A, finding that an IKE SA and an IPSec SA have been set up with FW_B.
<FW_A> display ike sa IE SA information : Conn-ID Peer VPN Flag(s) Phase RemoteType RemoteID ----------------------------------------------------------------------------- 16777239 2.1.1.1:500 RD|A v2:2 IP 2.1.1.1 16777232 2.1.1.1:500 RD|A v2:1 IP 2.1.1.1 Number of IKE SA : 2 ------------------------------------------------------------------------------- Flag Description: RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING
Configuration Files
FW_A configuration file
# sysname FW_A # pki entity user01 country CN state beijing organization huawei organization-unit dev common-name CN-Cer-FWA ip-address 1.1.1.1 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method rsa-signature integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer b ike-proposal 10 pki realm abc pki validate-certificate whitelist enable # ipsec policy-template use1 10 ike-peer b proposal tran1 # ipsec policy map1 10 isakmp template use1 # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.1.1 255.255.255.0 ipsec policy map1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.1.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 1.1.1.2 # pki realm abc ca id ca_root enrollment-url http://5.1.1.1:8080/certsrv/mscep/mscep.dll ra entity user01 fingerprint sha1 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 rsa local-key-pair rsa_scep password cipher %^%#D=}""x(9%D~E<v0tx4S'WBY!#o9D[,"mnO*s<0xR%^%# auto-enroll 60 regenerate # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.1.0.0 mask 255.255.0.0 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.0.0 mask 255.255.0.0 destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.1.1 mask 255.255.255.255 destination-address 2.1.1.1 mask 255.255.255.255 destination-address 3.1.1.1 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local source-address 2.1.1.1 mask 255.255.255.255 source-address 3.1.1.1 mask 255.255.255.255 destination-address 1.1.1.1 mask 255.255.255.255 action permit # return
FW_B configuration file
# sysname FW_B # pki entity user02 country CN state beijing organization huawei organization-unit dev common-name CN-Cer-FWB ip-address 2.1.1.1 # acl number 3000 rule 5 permit ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method rsa-signature integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a ike-proposal 10 remote-address 1.1.1.1 pki realm b # ipsec policy map1 10 isakmp security acl 3000 ike-peer a proposal tran1 # interface GigabitEthernet0/0/1 undo shutdown ip address 2.1.1.1 255.255.255.0 ipsec policy map1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.2.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 2.1.1.2 # pki realm b ca id ca_root enrollment-url http://5.1.1.1:8080/certsrv/mscep/mscep.dll ra entity user02 fingerprint sha1 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 rsa local-key-pair rsa_scep_b password cipher %^%#D=}""x(9%D~E<v0tx4S'WBY!#o9D[,"mnO*s<0xR%^%# auto-enroll 60 regenerate # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.2.0 mask 255.255.255.0 destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.1.2.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 2.1.1.1 mask 255.255.255.255 destination-address 1.1.1.1 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.1.1 mask 255.255.255.255 destination-address 2.1.1.1 mask 255.255.255.255 action permit # return
FW_C configuration file
# sysname FW_C # pki entity user02 country CN state beijing organization huawei organization-unit dev common-name CN-Cer-FWC ip-address 3.1.1.1 # acl number 3000 rule 5 permit ip source 10.1.3.0 0.0.0.255 destination 10.1.1.0 0.0.0.255 # ipsec proposal tran1 esp authentication-algorithm sha2-256 esp encryption-algorithm aes-256 # ike proposal 10 encryption-algorithm aes-256 dh group14 authentication-algorithm sha2-256 authentication-method rsa-signature integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer a ike-proposal 10 remote-address 1.1.1.1 pki realm b # ipsec policy map1 10 isakmp security acl 3000 ike-peer a proposal tran1 # interface GigabitEthernet0/0/1 undo shutdown ip address 3.1.1.1 255.255.255.0 ipsec policy map1 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.1.3.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/3 # firewall zone untrust set priority 5 add interface GigabitEthernet0/0/1 # ip route-static 0.0.0.0 0.0.0.0 3.1.1.2 # pki realm b ca id ca_root enrollment-url http://5.1.1.1:8080/certsrv/mscep/mscep.dll ra entity user02 fingerprint sha1 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 rsa local-key-pair rsa_scep_b password cipher %^%#D=}""x(9%D~E<v0tx4S'WBY!#o9D[,"mnO*s<0xR%^%# auto-enroll 60 regenerate # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.3.0 mask 255.255.255.0 destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy2 source-zone untrust destination-zone trust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.1.3.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 3.1.1.1 mask 255.255.255.255 destination-address 1.1.1.1 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local source-address 1.1.1.1 mask 255.255.255.255 destination-address 3.1.1.1 mask 255.255.255.255 action permit # return