srx dynamic vpn 配置docWord下载.docx
- 文档编号:799841
- 上传时间:2023-04-29
- 格式:DOCX
- 页数:17
- 大小:337KB
srx dynamic vpn 配置docWord下载.docx
《srx dynamic vpn 配置docWord下载.docx》由会员分享,可在线阅读,更多相关《srx dynamic vpn 配置docWord下载.docx(17页珍藏版)》请在冰点文库上搜索。
三配置web认证用xauthprofile
setaccessfirewall-authenticationweb-authenticationdefault-profiledyn-vpn-access-profile
然后是配置vpntunnel
四配置IKEpolicy
setsecurityikepolicyike-dyn-vpn-policymodeaggressive
setsecurityikepolicyike-dyn-vpn-policyproposal-setstandard(standard就可以,不用自定义)
setsecurityikepolicyike-dyn-vpn-policypre-shared-keyascii-text"
$9$1oJREyeK87NblegoGUHk"
(与共享密钥abc123)
五配置IKEgateway
setsecurityikegatewaydyn-vpn-local-gwike-policyike-dyn-vpn-policy
setsecurityikegatewaydyn-vpn-local-gwdynamichostnamedynvpn
setsecurityikegatewaydyn-vpn-local-gwdynamicconnections-limit10
setsecurityikegatewaydyn-vpn-local-gwdynamicike-user-typeshared-ike-id
setsecurityikegatewaydyn-vpn-local-gwexternal-interfacege-0/0/0.0(对外接口)
setsecurityikegatewaydyn-vpn-local-gwxauthaccess-profiledyn-vpn-access-profile(也调用xauthprofile)
六配置ipsec(第二阶段转换集)
setsecurityipsecpolicyipsec-dyn-vpn-policyproposal-setstandard(采用系统standard)
setsecurityipsecvpndyn-vpnikegatewaydyn-vpn-local-gw
setsecurityipsecvpndyn-vpnikeipsec-policyipsec-dyn-vpn-policy(引用ipsecpolicy)
七配置securitypolicy
setsecuritypoliciesfrom-zoneuntrustto-zonetrustpolicydyn-vpn-policymatchsource-addressany
setsecuritypoliciesfrom-zoneuntrustto-zonetrustpolicydyn-vpn-policymatchdestination-addressany
setsecuritypoliciesfrom-zoneuntrustto-zonetrustpolicydyn-vpn-policymatchapplicationany
setsecuritypoliciesfrom-zoneuntrustto-zonetrustpolicydyn-vpn-policythenpermittunnelipsec-vpndyn-vpn(引用六中的dyn-vpn)
用远程客户端关联dynamicvpn
八用远程用户去关联dynamicvpn和配置客户端来决定谁能用dynamicvpn
setsecuritydynamic-vpnaccess-profiledyn-vpn-access-profile
setsecuritydynamic-vpnclientsallremote-protected-resources10.0.0.0/8
setsecuritydynamic-vpnclientsallremote-exceptions0.0.0.0/0
setsecuritydynamic-vpnclientsallipsec-vpndyn-vpn
setsecuritydynamic-vpnclientsalluserclient1
setsecuritydynamic-vpnclientsalluserclient2
(all是clients的名字)
lab#show|no-more
##Lastchanged:
2011-03-2910:
54:
01UTC
version10.4R3.4;
system{
root-authentication{
encrypted-password"
$1$mdFhlLtS$gllI3Szu6M9wH3UcEu2Dl/"
;
##SECRET-DATA
}
name-server{
208.67.222.222;
208.67.220.220;
login{
userlab{
uid2001;
classsuper-user;
authentication{
$1$j5Obg2WE$jCYCVKcjICFSRU3e.gJp51"
services{
ssh;
telnet;
xnm-clear-text;
web-management{
http{
interface[vlan.0ge-0/0/0.0];
https{
system-generated-certificate;
interface[vlan.0ge-0/0/0.0];
------------------------必须把接口给删除,j-web的管理不在https里。
syslog{
archivesize100kfiles3;
user*{
anyemergency;
filemessages{
anycritical;
authorizationinfo;
fileinteractive-commands{
interactive-commandserror;
max-configurations-on-flash5;
max-configuration-rollbacks5;
license{
autoupdate{
url
}
interfaces{
ge-0/0/0{
unit0{
familyinet{
address192.168.0.199/24;
ge-0/0/1{
address10.10.10.1/24;
ge-0/0/2{
unit0;
ge-0/0/3{
ge-0/0/4{
ge-0/0/5{
ge-0/0/6{
ge-0/0/7{
ge-0/0/8{
ge-0/0/9{
ge-0/0/10{
ge-0/0/11{
ge-0/0/12{
ge-0/0/13{
ge-0/0/14{
ge-0/0/15{
protocols{
stp;
security{
ike{
policyike-dyn-vpn-policy{
modeaggressive;
proposal-setstandard;
pre-shared-keyascii-text"
gatewaydyn-vpn-local-gw{
ike-policyike-dyn-vpn-policy;
dynamic{
hostnamedynvpn;
connections-limit10;
ike-user-typeshared-ike-id;
external-interfacege-0/0/0.0;
xauthaccess-profiledyn-vpn-access-profile;
ipsec{
policyipsec-dyn-vpn-policy{
vpndyn-vpn{
gatewaydyn-vpn-local-gw;
ipsec-policyipsec-dyn-vpn-policy;
nat{
source{
rule-settrust-to-untrust{
fromzonetrust;
tozoneuntrust;
rulesource-nat-rule{
match{
source-address0.0.0.0/0;
then{
source-nat{
interface;
screen{
ids-optionuntrust-screen{
icmp{
ping-death;
ip{
source-route-option;
tear-drop;
tcp{
syn-flood{
alarm-threshold1024;
attack-threshold200;
source-threshold1024;
destination-threshold2048;
timeout20;
land;
zones{
security-zonetrust{
host-inbound-traffic{
system-services{
all;
protocols{
interfaces{
ge-0/0/1.0;
security-zoneuntrust{
screenuntrust-screen;
ge-0/0/0.0{
dhcp;
tftp;
policies{
from-zonetrustto-zoneuntrust{
policytrust-to-untrust{
source-addressany;
destination-addressany;
applicationany;
permit;
from-zoneuntrustto-zonetrust{
policydyn-vpn-policy{
permit{
tunnel{
ipsec-vpndyn-vpn;
dynamic-vpn{
access-profiledyn-vpn-access-profile;
clients{
all{
remote-protected-resources{
10.0.0.0/8;
remote-exceptions{
0.0.0.0/0;
user{
client1;
client2;
access{
profiledyn-vpn-access-profile{
clientclient1{
firewall-user{
password"
clientclient2{
address-assignment{
pooldyn-vpn-address-pool;
pooldyn-vpn-address-pool{
network10.10.10.0/24;
xauth-attributes{
primary-dns202.96.64.68/32;
firewall-authentication{
web-authentication{
default-profiledyn-vpn-access-profile;
测试开始
会再弹出对话框进行用户名和密码的认证
由于内部接口没启动所以分配了一个10.10.10.1
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- srx dynamic vpn 配置doc 配置 doc