Web: Example for Configuring Mobile Office Users Accessing the Intranet Through the SSL VPN Tunnel (Chinese Cryptographic Certificate)

Procedure

1. Apply for CA certificates and client certificates.
2. Upload the CA certificates and client certificates to the device.

   Upload the CA certificates and client certificates to the pki/public/ directory of the device. sm2.rca.pem and sm2.oca.pem are CA certificates, and sm2.sig.crt.pem and sm2.enc.crt.pem are client certificates. For details about how to import certificates, see "Object Configuration" > "Certificate Configuration" in the Configuration Guide.

   <FW> system-view 
   [FW] pki realm sm_sig
   [FW-pki-realm-sm_sig] quit
   [FW] pki realm sm_enc
   [FW-pki-realm-sm_enc] quit
   [FW]pki import sm2-key-pair sm2.enc.key pem sm2.enc.key.pem exportable password admin@123
   [FW]pki import-certificate local realm sm_enc pem filename sm2.enc.crt.pem
   [FW]pki import sm2-key-pair sm2.sig.key pem sm2.sig.key.pem exportable password admin@123
   [FW]pki import-certificate local realm sm_sig pem filename sm2.sig.crt.pem no-check-same-name
   [FW]pki import-certificate ca filename oca.crt
   [FW]pki import-certificate ca filena

3. Configure interfaces.
   1. Choose Network > Interface.
   2. Click corresponding to GE0/0/1 and set the parameters as follows:

      Zone	untrust
      IPv4
      IP Address	1.1.1.1/24

   3. Click OK.
   4. Repeat the preceding steps to set the parameters for GE0/0/2.

      Zone	trust
      IPv4
      IP Address	10.2.0.1/24

4. Configure users.
   1. Choose Object > User > default, and set the parameters as follows:

      Configure a user and a user group based on the values of User Filtering Field and Group Filtering Field planned for the virtual gateway. For example, if the virtual gateway uses Subject-CN as User Filtering Field and Subject-OU as Group Filtering Field, the user name must be the same as the value of Subject-CN in the client certificate, and the user group name must be the same as the value of Subject-OU in the client certificate. For details about how to obtain the values of the Subject-CN and Subject-OU fields in the client certificate, see 11. In addition, the user and user group created here are used for identity authentication and subsequent role authorization.

      

   2. Click Apply.
5. Configure the SSL VPN gateway.
   1. Choose Network > SSL VPN > SSL VPN.
   2. Click Add and set the parameters as follows:

      User Filtering Field indicates the field of the client certificate that is used as the user name. Group Filtering Field indicates the field of the client certificate that is used as the user group name. The two parameters are used for identity authentication and subsequent role authorization.

      

   3. Click Next.
6. Configure the SSL version, cipher suite, session timeout, and session lifecycle. click Next.

   

7. Select Network Extension and click Next.
8. Configure the network extension function.
   1. Set the parameters as follows.

      

   2. Click Next.
9. Configure SSL VPN role authorization/users.
   1. Click Add in List of Authorized Roles and set the role authorization parameters as follows. After the configuration is complete, click OK.
      

      If you do not configure role authorization for users in certificate-challenge authentication mode, the users use the authorization of the default role after logging in to the virtual gateway. Generally, to precisely control users' resource access permission, you are advised to configure independent role authorization for users.

      

   2. Return to the Role Authorization/User configuration page, and click OK.
10. Configure security policies.
    1. Configure an Internet-to-FW security policy to allow employees on the move to access the SSL VPN gateway.
       1. Choose Policy > Security Policy > Security Policy.
       2. Click Add Security Policy and configure the security policy policy01 as follows:

          Name	policy01
          Source Zone	untrust
          Destination Zone	local
          Destination Address/Region	1.1.1.1/24
          Service	https NOTE: If the HTTPS port number is changed, you are advised to enable security policies based on the new port number.
          Action	Permit

       3. Click OK.

    2. Configure a FW-to-intranet security policy to allow employees on the move to access resources in the headquarters.
       1. Choose Policy > Security Policy > Security Policy.
       2. Click Add Security Policy and configure the security policy policy02 as follows. Click OK.

          Name	policy02
          Source Zone	untrust
          Destination Zone	trust
          Source Address/Region	172.16.1.0/24
          Destination Address/Region	10.2.0.0/24
          Action	Permit

11. On the intranet server, configure a route to the network segment 172.16.1.0 to 172.16.1.254.
12. Configure the client.

    Start the client and create a connection. Then enter the IP address and port number, select the Chinese cryptographic algorithm, and add the corresponding signature certificate and encryption certificate. For details about how to use the SSL VPN function through client access, see VPN Client Download Description.