命令行用户 VPN StoneOS 5.0R4P3.6 TWNO: TW-CUG-UNI-VPN-5.0R4P3.6-CN-V1.0-Y14M11

Transcription

1 命令行用户 VPN StoneOS 5.0R4P3.6 TWNO: TW-CUG-UNI-VPN-5.0R4P3.6-CN-V1.0-Y14M11

2 1 IPSec... 1 IPSec... 1 Security Association... 1 SA... 1 SA... 2 SA IPSec VPN... 4 IPSec VPN... 5 VPN... 5 VPN... 5 IPSec IP IKE VPN... 8 P ISAKMP P XAUTH IPSec VPN... 24

3 IKE VPN VPN VPN XAUTH Secure Connect VPN Secure Connect VPN SCVPN IP DNS WINS SCVPN UDP SCVPN SSL PKI AAA HTTPS URL... 51

4 SCVPN SCVPN USB Key USB Key USB Key CA USB Key CA / / Profile SCVPN SCVPN SCVPN Web GUI Secure Connect... 98

5 SCVPN URL VPN VPN VPN P P DH ISAKMP ISAKMP ISAKMP

6 ISAKMP IKE P PKI ID NAT DPD P P PFS IKE IPSec ISAKMP P ID Commit VPN

7 PnPVPN PnPVPN PnPVPN PnPVPN CLI PnPVPN ISAKMP PnPVPN WebUI IKE VPN PnPVPN PnPVPN GRE GRE GRE GRE IPSec VPN GRE GRE

8 L2TP L2TP L2TP over IPSec LNS IP L2TP IP DNS WINS AAA PPP Hello LNS AVP IP IPSec L2TP L2TP L2TP L2TP L2TP LNS

9 LNS L2TP over IPSec LNS LNS

10 StoneOS VPN 1 IPSec StoneOS IPSec VPN 2 Secure Connect VPN StoneOS SSL Secure Connect VPN SCVPN 3 VPN StoneOS VPN npvpn StoneOS PnPVPN 5 GRE StoneOS GRE 6 L2TP StoneOS L2TP CLI Hillstone WebUI Hillstone < > WebUI MTU < > CLI { }

11 [ ] hostname

12 1 IPSec IPSec IPSec VPN IPSec IP AH Encapsulating Security Payload ESP Internet Key Exchange IKE IPSec AH IPsec IP IP IPsec ESP IPsec ESP IPsec ESP ESP AH ESP AH IKE AH ESP Security Association IPSec IPSec ISAKMP SA IPSec IPSec SA DES 3DES AES-128 AES -192 AES-256 SA SA Manual IKE ISAKMP 1

13 IPSec IKE IPSec IP IKE IKE IKE SA ISAKMP SA IKE ISAKMP SA IPsec SA SA SA 1. Diffie-Hellman 2. DES 3DES AES -128 AES -192 AES-256 hash MD5 SHA-1 SHA-2 3. DH DH DH 4. DH SA SA SA IPsec IPSec SA SA 1. 2

14 IPSec AH ESP hash MD5 SHA -1 SHA -2 NULL DES 3DES AES-128 NULL AES-192 AES-256 DEFLATE SA 2. DH IP 3. SA IPSec SA AH ESP IP IPSec IPSec MD5 MD5 128bit SHA-1 SHA bit SHA-1 MD5 SHA-2 SHA-2 SHA-256 SHA -384 SHA-512 SHA bit SHA bit SHA bit ESP IP StoneOS DES Data Encryption Standard 56bit 64bit 3DES Triple DES 56bit DES 168bit AES Advanced Encryption Standard StoneOS 128bit 192bit 256bit AES 3

15 IPComp IP Payload Compression IP IP IP IPComp IPComp IPCA IPComp IPComp IPSec IPCA IPCA ISAKMP Hillstone IPSec IPComp DEFLATE LZ77 Huffman IPComp StoneOS IPSec RFC IPSec IPSec RFC Security Architecture for the Internet Protocol: RFC2401/RFC4301 ESP RFC2406/RFC4303 AH RFC2402/RFC4302 RFC2410 Null Encryption RFC2405 DES-CBC RFC2451 3DES -CBC RFC3602 AES -CBC FIPS180-2 SHA RFC2404 SHA -1 RFC4868 SHA-2 RFC2403 MD5 RFC2393 IPComp RFC2394 DEFLATE IPSec VPN StoneOS VPN VPN Hillstone VPN VPN VPN 4

16 IPSec VPN StoneOS IPSec VPN VPN IKE VPN WebUI IPSec VPN VPN VPN IPSec / VPN VPN tunnel ipsec name manual name VPN CLI VPN VPN VPN no tunnel ipsec name manual IPSec IPSec VPN mode {transport tunnel} transport IPSec tunnel IPSec no mode Security Parameter Index SPI SA 32 AH ESP SPI VPN VPN SPI VPN spi spi-number out-spi-number spi-number SPI out-spi-number SPI no spi SPI inbo outbound 5

17 SPI SPI SPI SPI IPSec ESP AH VPN VPN protocol {esp ah} esp ESP ah AH no protocol VPN VPN encryption {3des des aes aes-192 aes-256 null} 3des 3DES 192 des DES 64 aes AES 128 aes bit AES 192 aes bit AES 256 null no encryption VPN VPN hash {md5 sha sha256 sha384 sha512 null} md5 MD5 128 sha SHA StoneOS sha256 SHA sha384 SHA sha512 SHA null no hash 6

18 VPN VPN DEFLATE VPN compression deflate no compression IP IP VPN peer ip-address ip-address IP no peer IP VPN hash-key inbound hex-number-string outbound hex-number-string inbound hex-number-string outbound hex-number-string no hash-key VPN encryption-key inbound hex-number-string outbound hex-number-string inbound hex-number-string outbound hex-number-string no encryption-key VPN VPN interface interface-name interface-name no interface VSYS VSYS 7

19 IKE VPN IKE VPN IKE VPN P1 ISAKMP P2 P1 P1 IKE ISAKMP SA IKE DH P1 P1 IKE isakmp proposal p1-name p1-name P1 CLI P1 P1 no isakmp proposal p1-name P1 IKE VSYS IKE P1 authentication {pre-share rsa-sig dsa-sig} pre-share rsa-sig RSA dsa-sig DSA SHA-1 no authentication StoneOS 3DES DES 128bit AES 192bit AES 256bit AES IKE P1 encryption {3des des aes aes-192 aes-256} 3des 3DES 192 StoneOS 8

20 des DES 64 aes AES 128 aes bit AES 192 aes bit AES 256 no encryption StoneOS MD5 SHA -1 SHA-2 SHA-256 SHA -384 SHA-512 IKE P1 hash {md5 sha sha256 sha384 sha512} md5 MD5 128 sha SHA StoneOS sha256 SHA sha384 SHA sha512 SHA no hash DH Diffie-Hellman DH DH DH DH IKE 5 DH DH SA DH DH DH ISAKMP DH DH DH P1 group {1 2 5} 1 DH DH DH no group DH SA ISAKMP SA SA SA SA 9

21 P1 lifetime time-value time-value SA no lifetime ISAKMP ISAKMP ISAKMP IKE ISAKMP IP IKE PKI ID ISAKMP ISAKMP ISAKMP NAT ISAKMP ISAKMP : isakmp peer peer-name peer-name ISAKMP CLI ISAKMP ISAKMP no isakmp peer peer-name ISAKMP ISAKMP ISAKMP ISAKMP ISAKMP interface interface-name interface-name no interface interface-name IKE IKE main aggressive modemode IKE IP IP IKE ISAKMP mode {main aggressive} main ID aggressive no mode 10

22 IP ISAKMP IP IP IP ISAKMP type {dynamic static} dynamic IP IP static IP IP no type IP peer ip-address ip-address - IP IP IP no peer IP ID ISAKMP ID ISAKMP accept-all-peer-id no accept-all-peer-id P1 ISAKMP P1 ISAKMP isakmp-proposal p1-proposal1 [p1-proposal2] [p1-proposal3] [p1-proposal4] p1-proposal1 P1 ISAKMP 4 P1 no isakmp-proposal P1 ISAKMP ISAKMP pre-share string string no pre-share PKI PKI ISAKMP PKI ISAKMP trust-domain string string PKI 11

23 no trust-domain PKI PKI PKI ID ID ISAKMP local-id {fqdn string asn1dn [string] u-fqdn string key-id string ip ip-address } fqdn string FQDN ID string ID asn1dn [string] Asn1dn ID string ID ID ID u-fqdn string U-FQDN ID user1@hillstonenet.com key-id string - Key ID ID XAUTH ip ip-address - IP ID ip-address ID no local-id ID ID ID ISAKMP peer-id {fqdn asn1dn u-fqdn key-id ip } string fqdn FQDN ID string ID asn1dn Asn1dn ID string ID u-fqdn string U-FQDN ID user1@hillstonenet.com key-id - Key ID ID XAUTH ip - IP ID no peer-id ID ISAKMP ISAKMP ISAKMP connection-type {bidirectional initiator-only responder-only} bidirectional ISAKMP 12

24 initiator-only ISAKMP responder-only ISAKMP no connection-type NAT IPSec IKE VPN NAT NAT VPN NAT IPSec IKE NAT N NAT ISAKMP nat-traversal no nat-traversal NAT DPD DPD Dead Peer Detection DPD ISAKMP DPD ISAKMP dpd [interval seconds] [retry times] interval seconds DPD retry times ISAKMP no dpd DPD ISAKMP ISAKMP description string string ISAKMP no description ISAKMP P2 P2 SA P2 13

25 P2 P2 IPSec ipsec proposal p2-name p2-name P2 CLI P2 P2 no ipsec proposal p2-name IPSec proposal P2 AH ESP P2 P2 protocol {esp ah} esp ESP ah AH no protocol P2 P2 P2 encryption {3des des aes aes-192 aes-256 null} [3des des aes aes-192 aes-256 null] [3des des aes aes-192 aes-256 null] 3des 3DES 192 StoneOS des DES 64 aes AES 128 aes bit AES 192 aes bit AES 256 null no encryption P2 P2 P2 hash {md5 sha sha256 sha384 sha512 null} [md5 sha sha256 sha384 sha512 null] [md5 sha sha256 sha384 sha512 null] md5 MD

26 sha SHA StoneOS sha256 SHA sha384 SHA sha512 SHA null no hash P2 P2 DEFLATE P2 compression deflate no compression PFS PFS Perfect Forward Security PFS PFS DH P2 PFS P2 group {nopfs 1 2 5} nopfs PFS 1 DH DH DH no group Hillstone SA SA P2 P2 lifetime seconds seconds lifesize kilobytes kilobytes 0 15

27 no no lifetime no lifesize IKE IPSec ISAKMP IKE ID IKE IKE tunnel ipsec tunnel-name auto tunnel-name - IKE CLI IKE IKE no tunnel ipsec tunnel-name auto IKE IPSec IKE IKE mode {transport tunnel} transport IPSec tunnel IPSec no mode ISAKMP IKE ISAKMP IKE isakmp-peer peer-name peer-name ISAKMP no isakmp-peer ISAKMP P2 IKE P2 IKE ipsec-proposal p2-name p2-name P2 no ipsec-proposal P2 ID IKE IPSec ID IKE 16

28 id {auto local ip-address/mask remote ip-address/mask service service-name} auto ID local ip-address/mask local ID remote ip-address/mask remote ID service service-name no id ID ID IKE ID IKE ID accept-all-proxy-id IKE no ID no accept-all-proxy-id SA 60 SA SA IKE auto-connect no auto-connect IKE IKE df-bit {copy clear set} copy IP DF clear set no df-bit anti -replay 17

29 IKE IPSec IKE IPSec anti-replay { } no anti-replay VPN Hillstone VPN VPN VPN VPN VPN VPN Hillstone VPN ECMP Hillstone VPN Ping VPN IKE IPSec vpn-track [A.B.C.D] [src-ip A.B.C.D] [interval time-value] [threshold value] A.B.C.D IP HillstoneHillstone IP IP src-ip A.B.C.D Ping IP HillstoneHillstone IP IP interval time-value Ping threshold value 18

30 no vpn-track VPN VPN VPN VPN VPN VPN VPN VPN VPN VPN VPN IKE IPSec track-event-notify {disable enable} disable enable VPN active dead show CLI VPN VPN show ipsec sa {id} VPN show tunnel ipsec {manual auto} {tunnel-name} VPN hostname(config)# show ipsec sa 5 VPN Name: vpn1 Outbound Gateway: VPN track status: alive Inbound Gateway: VPN track status: alive VPN hostname(config)# show tunnel ipsec auto vpn1 Name: vpn1 mode: tunnel... vpn-track: enable tracknotify: enable vpntrack destination

31 vpntrack source ip: vpntrack interval: 3 vpntrack threshold: 3 VPN VPN Commit Commit Commit Commit IKE IPSec Commit responder -set-commit Commit no responder-set-commit IKE IKE IPSec description string string IKE no description IKE VSYS VSYS IPSec VSYS Profile tunnel-ipsec max max-num reserve reserve-num max max-num reserve reserve-num VSYS IPSec maxmax-num reserve reserve-num 0 max (capacity*2/max-vsys-num, capacity/10) (capacity*2/max -vsys-num, capacity/10) 0 VSYS Profile no no tunnel-ipsec max max-num reserve reserve-num XAUTH XAUTH IKE RADIUS AAA IPSec VPN VPN XAUTH VPN VPN IP VPN XAUTH 20

32 XAUTH XAUTH XAUTH IP IP WINS DNS XAUTH XAUTH XAUTH ISAKMP xauth server ISAKMP no XAUTH no xauth server XAUTH XAUTH IP XAUTH IP DNS WINS XAUTH xauth pool pool-name pool-name - XAUTH XAUTH XAUTH XAUTH no XAUTH no xauth pool pool-name XAUTH IP XAUTH address start-ip end-ip netmask mask start-ip - XAUTH IP end-ip - XAUTH IP mask - XAUTH no IP no address IP XAUTH IP XAUTH IP IP XAUTH XAUTH exclude-address start-ip end-ip start-ip - XAUTH IP 21

33 end-ip - XAUTH IP XAUTH no IP no exclude-address XAUTH XAUTH XAUTH XAUTH XAUTH ISAKMP xauth pool-name pool-name pool-name - ISAKMP no no xauth pool-name IP IP XAUTH IP IP IP IP IP IP IP IP IP IP IP XAUTH IP IP IP 1. IP IP IP IP 2. IP IP IP IP IP XAUTH ip-binding user user-name ip ip-address user user-name - ip ip-address - IP XAUTH no IP no ip-binding user user-name IP XAUTH 22

34 ip-binding role role-name ip-range start-ip end-ip role role-name - ip-range start-ip end-ip - IP IP start-ip IP end-ip XAUTH no IP no ip-binding role role-name IP IP IP IP IP XAUTH move role-name1 {before role-name2 after role-name2 top bottom} role name1 - IP before role-name2 - IP IP role-name2 after role-name2 - IP IP role-name2 top - IP IP bottom - IP IP WINS/DNS DNS XAUTH dns address1 [address2] address1 - DNS IP 2 DNS XAUTH no DNS no dns WINS XAUTH wins address1 [address2] address1 - WINS IP 2 WINS XAUTH no WINS no wins XAUTH XAUTH XAUTH 23

35 exec xauth isakmp-peer-name kickout user-name isakmp-peer-name - ISAKMP user-name - IPSec show CLI IPSec P1 show isakmp proposal [p1-name] ISAKMP show isakmp peer [peer-name] P2 show ipsec proposal [proposal-name] VPN show tunnel ipsec manual [tunnel-name] IKE show tunnel ipsec auto [tunnel-name] IKE show isakmp sa [dsp_ip] IPSec show [id active ipsec sainactive] XAUTH show xauth pool [pool-name] XAUTH show xauth client isakmp-peer-name [user user-name] VPN IKE VPN XAUTH VPN VPN HillstoneHillstone A HillstoneHillstone B PC1 HillstoneHillstone A IP server1 HillstoneHillstone B IP PC /24 Server /24 VPN VPN ESP 3DES SHA1 DEFLATE 1 24

36 Hillstone Hillstone A hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit Hillstone B hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit Hillstone A hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route / hostname(config-vrouter)# exit Hillstone B hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route / hostname(config-vrouter)# exit VPN1 Hillstone A hostname(config)# tunnel ipsec vpn1 manual 25

37 hostname(config-tunnel-ipsec-manual)# interface ethernet0/1 hostname(config-tunnel-ipsec-manual)# protocol esp hostname(config-tunnel-ipsec-manual)# peer hostname(config-tunnel-ipsec-manual)# hash sha hostname(config-tunnel-ipsec-manual)# hash-key inbound 1234 outbound 5678 hostname(config-tunnel-ipsec-manual)# encryption 3des hostname(config-tunnel-ipsec-manual)# encryption-key inbound 00ff outbound 123a hostname(config-tunnel-ipsec-manual)# compression deflate hostname(config-tunnel-ipsec-manual)# spi hostname(config-tunnel-ipsec-manual)# exit Hillstone B hostname(config)# tunnel ipsec vpn1 manual hostname(config-tunnel-ipsec-manual)# interface ethernet0/1 hostname(config-tunnel-ipsec-manual)# protocol esp hostname(config-tunnel-ipsec-manual)# peer hostname(config-tunnel-ipsec-manual)# hash sha hostname(config-tunnel-ipsec-manual)# hash-key inbound 5678 outbound 1234 hostname(config-tunnel-ipsec-manual)# encryption 3des hostname(config-tunnel-ipsec-manual)# encryption-key inbound 123a outbound 00ff hostname(config-tunnel-ipsec-manual)# compression deflate hostname(config-tunnel-ipsec-manual)# spi hostname(config-tunnel-ipsec-manual)# exit Hillstone Hillstone A hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn1 hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone B hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn1 26

38 IKE VPN hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn1 hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone A Hillstone B /24 server /24 IKE HillstoneHillstone A HillstoneHillstone B PC1 HillstoneHillstone A IP Server1 HillstoneHillstone B IP PC /24 server /24 VPN VPN ESP 3DES SHA1 DEFLATE 1 Hillstone Hillstone A hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone trust hostname(config-if-tun1)# exit Hillstone B 27

39 hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone trust hostname(config-if-tun1)# exit Hillstone Hillstone A hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone B hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any 28

40 hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone A hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route /24 tunnel1 hostname(config-vrouter)# exit Hillstone B hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route /24 tunnel1 hostname(config-vrouter)# exit P1 Hillstone A hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash sha hostname(config-isakmp-proposal)# encryption 3des hostname(config-isakmp-proposal)# exit Hillstone B hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash sha hostname(config-isakmp-proposal)# encryption 3des hostname(config-isakmp-proposal)# exit ISAKMP Hillstone A hostname(config)# isakmp peer east hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share hello1 hostname(config-isakmp-peer)# exit Hillstone B hostname(config)# isakmp peer east hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 29

41 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share hello1 hostname(config-isakmp-peer)# exit P2 Hillstone A hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash sha hostname(config-ipsec-proposal)# encryption 3des hostname(config-ipsec-proposal)# compression deflate hostname(config-ipsec-proposal)# exit Hillstone B hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash sha hostname(config-ipsec-proposal)# encryption 3des hostname(config-ipsec-proposal)# compression deflate hostname(config-ipsec-proposal)# exit VPN Hillstone A hostname(config)# tunnel ipsec vpn auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer east hostname(config-tunnel-ipsec-auto)# id local /24 remote /24 service any hostname(config-tunnel-ipsec-auto)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# tunnel ipsec vpn hostname(config-if-tun1)# exit Hillstone B hostname(config)# tunnel ipsec vpn auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer east hostname(config-tunnel-ipsec-auto)# id local /24 remote /24 service any hostname(config-tunnel-ipsec-auto)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# tunnel ipsec vpn hostname(config-if-tun1)# exit Hillstone A Hillstone B /24 Server /24 30

42 VPN VPN HillstoneHillstone A HillstoneHillstone B IKE VPN VPN1 tunnel VPN2 tunnel server HillstoneHillstone A IP PC HillstoneHillstone B IP VPN1 tunnel VPN2 tunnel VPN VPN1 tunnel VPN2 tunnel 2 VPN Hillstone A hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit 31

43 hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# manage ping hostname(config-if-eth0/1)# exit hostname(config)# interface ethernet0/4 hostname(config-if-eth0/4)# zone untrust hostname(config-if-eth0/4)# ip address /24 hostname(config-if-eth0/4)# manage ping hostname(config-if-eth0/4)# exit P1 hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash md5 hostname(config-isakmp-proposal)# encryption des hostname(config-isakmp-proposal)# exit ISAKMP hostname(config)# isakmp peer gwa-peer-1 hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share U8FdHNEEBz6sNn5Mvqx3yWuLRWce hostname(config-isakmp-peer)# exit hostname(config)# isakmp peer gwa-peer-2 hostname(config-isakmp-peer)# interface ethernet0/4 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share i39jnnnicsh9rxb77oga7fg7bnqy hostname(config-isakmp-peer)# exit P2 hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash md5 hostname(config-ipsec-proposal)# encryption des hostname(config-ipsec-proposal)# exit VPN hostname(config)# tunnel ipsec vpn1-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwa-peer-1 32

44 hostname(config-tunnel-ipsec-auto)# vpn-track interval 3 threshold 9 hostname(config-tunnel-ipsec-auto)# track-event-notify enable hostname(config-tunnel-ipsec-auto)# exit hostname(config)# tunnel ipsec vpn2-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwa-peer-2 hostname(config-tunnel-ipsec-auto)# vpn-track src-ip interval 3 threshold 9 hostname(config-tunnel-ipsec-auto)# track-event-notify enable hostname(config-tunnel-ipsec-auto)# auto-connect hostname(config-tunnel-ipsec-auto)# exit VPN hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone untrust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel ipsec vpn1-tunnel hostname(config-if-tun1)# exit hostname(config)# interface tunnel2 hostname(config-if-tun2)# zone untrust hostname(config-if-tun2)# ip address /24 hostname(config-if-tun2)# tunnel ipsec vpn2-tunnel hostname(config-if-tun2)# exit hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route /24 tunnel1 10 hostname(config-vrouter)# ip route /24 tunnel2 20 hostname(config-vrouter)# exit hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any 33

45 hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone B hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# manage ping hostname(config-if-eth0/1)# exit hostname(config)# interface ethernet0/4 hostname(config-if-eth0/4)# zone untrust hostname(config-if-eth0/4)# ip address /24 hostname(config-if-eth0/4)# manage ping hostname(config-if-eth0/4)# exit P1 hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash md5 hostname(config-isakmp-proposal)# encryption des hostname(config-isakmp-proposal)# exit ISAKMP hostname(config)# isakmp peer gwb-peer-1 hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share U8FdHNEEBz6sNn5Mvqx3yWuLRWce hostname(config-isakmp-peer)# exit hostname(config)# isakmp peer gwb-peer-2 hostname(config-isakmp-peer)# interface ethernet0/4 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share i39jnnnicsh9rxb77oga7fg7bnqy hostname(config-isakmp-peer)# exit 34

46 P2 hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash md5 hostname(config-ipsec-proposal)# encryption des hostname(config-ipsec-proposal)# exit VPN hostname(config)# tunnel ipsec vpn1-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwb-peer-1 hostname(config-tunnel-ipsec-auto)# vpn-track interval 3 threshold 9 hostname(config-tunnel-ipsec-auto)# auto-connect hostname(config-tunnel-ipsec-auto)# exit hostname(config)# tunnel ipsec vpn2-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwb-peer-2 hostname(config-tunnel-ipsec-auto)# vpn-track src-ip interval 3 threshold 9 hostname(config-tunnel-ipsec-auto)# auto-connect hostname(config-tunnel-ipsec-auto)# exit VPN hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone untrust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel ipsec vpn1-tunnel hostname(config-if-tun1)# exit hostname(config)# interface tunnel2 hostname(config-if-tun2)# zone untrust hostname(config-if-tun2)# ip address /24 hostname(config-if-tun2)# tunnel ipsec vpn2-tunnel hostname(config-if-tun2)# exit hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route /24 tunnel1 1 hostname(config-vrouter)# ip route /24 tunnel2 2 hostname(config-vrouter)# exit hostname(config)# policy-global hostname(config-policy)# rule 35

47 hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# VPN Hillstone VPN VPN VPN HillstoneHillstone A HillstoneHillstone B server IP PC IP server PC VPN 3 VPN 36

48 Hillstone A hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# manage ping hostname(config-if-eth0/1)# exit P1 hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash md5 hostname(config-isakmp-proposal)# encryption des hostname(config-isakmp-proposal)# exit ISAKMP 37

49 hostname(config)# isakmp peer gwa-peer-1 hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share U8FdHNEEBz6sNn5Mvqx3yWuLRWce hostname(config-isakmp-peer)# exit P2 hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash md5 hostname(config-ipsec-proposal)# encryption des hostname(config-ipsec-proposal)# exit VPN hostname(config)# tunnel ipsec vpn1-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwa-peer-1 hostname(config-tunnel-ipsec-auto)# vpn-track interval 1 threshold 5 hostname(config-tunnel-ipsec-auto)# track-event-notify enable hostname(config-tunnel-ipsec-auto)# exit hostname(config)# policy-global hostname(config-policy)# rule id 1 hostname(config-policy-rule)# src-ip /24 hostname(config-policy-rule)# dst-ip /24 hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn1-tunnel hostname(config-policy-rule)# exit hostname(config-policy)# rule id 2 hostname(config-policy-rule)# src-ip /24 hostname(config-policy-rule)# dst-ip /24 hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn1-tunnel hostname(config-policy-rule)# exit hostname(config-policy)# rule id 3 hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# Hillstone B hostname(config)# interface ethernet0/0 38

50 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# manage ping hostname(config-if-eth0/1)# exit P1 hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# hash md5 hostname(config-isakmp-proposal)# encryption des hostname(config-isakmp-proposal)# exit ISAKMP hostname(config)# isakmp peer gwb-peer-1 hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share U8FdHNEEBz6sNn5Mvqx3yWuLRWce hostname(config-isakmp-peer)# exit P2 hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash md5 hostname(config-ipsec-proposal)# encryption des hostname(config-ipsec-proposal)# exit VPN hostname(config)# tunnel ipsec vpn1-tunnel auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# isakmp-peer gwb-peer-1 hostname(config-tunnel-ipsec-auto)# auto-connect hostname(config-tunnel-ipsec-auto)# exit hostname(config)# policy-global hostname(config-policy)# rule id 1 hostname(config-policy-rule)# src-ip /24 hostname(config-policy-rule)# dst-ip /24 hostname(config-policy-rule)# service any 39

51 hostname(config-policy-rule)# action fromtunnel vpn1-tunnel hostname(config-policy-rule)# exit hostname(config-policy)# rule id 2 hostname(config-policy-rule)# src-ip /24 hostname(config-policy-rule)# dst-ip /24 hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn1-tunnel hostname(config-policy-rule)# exit hostname(config-policy)# rule id 3 hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# VPN Hillstone VPN XAUTH XAUTH HillstoneHillstone XAUTH AAA VPN FTP XAUTH 40

52 4 XAUTU hostname(config)# interface ethernet0/6 hostname(config-if-eth0/7)# zone trust hostname(config-if-eth0/7)# ip address hostname(config-if-eth0/7)# manage ping hostname(config-if-eth0/7)# manage ssh hostname(config-if-eth0/7)# manage http hostname(config-if-eth0/7)# exit hostname(config)# interface ethernet0/7 hostname(config-if-eth0/6)# zone untrust hostname(config-if-eth0/6)# ip address hostname(config-if-eth0/6)# exit hostname(config)# rule top hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config)# AAA 41

53 hostname(config)# aaa-server local type local hostname(config-aaa-server)# user xauth hostname(config-user)# password test hostname(config-user)# ike-id key-id xauth hostname(config-user)# end hostname(config)# XAUTH hostname(config)# xauth pool pool hostname(config-xauth-pool)# address netmask hostname(config-xauth-pool)# exit hostname(config)# ISAKMP hostname(config)# isakmp peer xauth hostname(config-isakmp-peer)# mode aggresive hostname(config-isakmp-peer)# type usergroup hostname(config-isakmp-peer)# psk-sha-aes128-g2 hostname(config-isakmp-peer)# pre-share XhF44BilJO3b/2HFl5lVqXniqeMByq hostname(config-isakmp-peer)# aaa-server local hostname(config-isakmp-peer)# local-id key-id xauth hostname(config-isakmp-peer)# xauth pool-name pool hostname(config-isakmp-peer)# xauth server hostname(config-isakmp-peer)# interface ethernet0/7 hostname(config-isakmp-peer)# exit hostname(config)# IKE hostname(config)# tunnel ipsec xauth auto hostname(config-tunnel-ipsec-auto)# isakmp-peer xauth hostname(config-tunnel-ipsec-auto)# esp-sha-aes128-g0 hostname(config-tunnel-ipsec-auto)# accept-all-proxy-id hostname(config-tunnel-ipsec-auto)# exit hostname(config)# interface tunnel22 hostname(config-if-tun22)# zone trust hostname(config-if-tun22)# ip address hostname(config-if-tun22)# manage telnet hostname(config-if-tun22)# manage ssh hostname(config-if-tun22)# manage ping hostname(config-if-tun22)# manage http hostname(config-if-tun22)# manage https hostname(config-if-tun22)# manage snmp hostname(config-if-tun22)# tunnel ipsec xauth hostname(config-if-tun22)# exit hostname(config)# ios VPN xauth test IPSec / xauth 42

54 2 Secure Connect VPN Secure Connect VPN Hillstone SSL Secure Connect VPN SCVPN SCVPN StoneOS SCVPN SCVPN Hillstone IP DNS WINS IPSec Hillstone SCVPN Hillstone Secure Connect PC SCVPN Hillstone VPN SCVPN Hillstone SCVPN UDP SCVPN SCVPN USB Key 43

55 SCVPN SCVPN IP SCVPN IP DNS WINS SCVPN scvpn pool pool-name pool-name SCVPN SCVPN no SCVPN no scvpn pool pool-name SCVPN IP DNS WINS SCVPN address start-ip end-ip netmask A.B.C.D start-ip IP IP end-ip IP IP netmask A.B.C.D IP SCVPN no IP no address IP IP SCVPN IP IP FTP 44

56 SCVPN exclude address start-ip end-ip start-ip IP end-ip IP SCVPN no no exclude address IP Hillstone SCVPN IP IP IP IP IP IP IP IP IP IP IP SCVPN IP IP IP 1. IP IP IP IP 2. IP IP IP IP IP IP IP IP SCVPN ip-binding user user-name ip ip-address user user-name ip ip-address IP SCVPN no IP no ip-binding user user-name IP IP SCVPN ip-binding role role-name ip-range start-ip end-ip role role -name ip-range start-ip end-ip IP IP start-ip 45

57 IP end-ip SCVPN no IP no ip-binding role role-name IP IP IP Hillstone IP IP SCVPN move role-name1 {before role-name2 after role-name2 top bottom} role name1 IP before role-name2 IP IP ( role-name2 ) after role-name2 IP IP ( role-name2 ) top IP IP bottom IP IP DNS DNS SCVPN dns address1 [address2] [address3] [address4] address1 DNS IP 4 DNS SCVPN no DNS no dns WINS WINS SCVPN wins address1 [address2] address1 WINS IP WINS SCVPN no WINS no wins SCVPN SCVPN show scvpn pool [pool-name] 46

58 pool-name SCVPN SCVPN SCVPN hostname(config)# show scvpn pool pool_test1 Name: pool_test1 Address range: IP Exclude range: Netmask: Wins server: WINS wins1: Dns server: DNS dns1: IP Binding User: IP test IP Binding Role: IP role SCVPN show scvpn pool pool-name statistics pool-name SCVPN SCVPN hostname(config)# show scvpn pool pool_test1 statistics Total Ip Num Exclude Ip Num Fixed Ip Num Used Ip Num Fixed Used Ip Num Free Ip Num 10 IP 2 IP 6 IP 2 IP 0 IP 8 UDP SCVPN UDP scvpn-udp-port port-number port-number UDP SCVPN UDP no UDP no scvpn-udp-port SCVPN SCVPN 47

59 tunnel scvpn instance-name instance-name SCVPN SCVPN SCVPN SCVPN no SCVPN no tunnel scvpn instance-name SCVPN SSL PKI AAA HTTPS URL SCVPN SCVPN SCVPN SCVPN pool pool-name pool-name SCVPN SCVPN no no pool HTTPS SCVPN SCVPN interface interface-name interface-name SCVPN no 48

60 no interface SSL SCVPN SSL SCVPN ssl-protocol {sslv3 tlsv1 any} sslv3 SSLv3 tlsv1 TLSv1 any SSLv2 SSLv3 TLSv1 SCVPN no SSL no ssl-protocol PKI PKI HTTPS SCVPN PKI SCVPN trust-domain trust-domain-name trust-domain-name PKI trust_domain_default SCVPN no no trust-domain PKI PKI SCVPN SCVPN tunnel-cipher encryption {null des 3des aes aes192 aes256} hash {null md5 sha sha256 sha384 sha512} [compression defl] null des 3des aes aes192 aes256 3des null 1 IPSec null md5 sha sha256 sha384 sha512 sha null 1 IPSec compression defl DEFLATE 1 IPSec SCVPN no 49

61 no tunnel-cipher AAA AAA AAA AAA SCVPN aaa-server aaa-server-name [domain domain-name] aaa-server-name AAA domain domain-name AAA AAA SCVPN no AAA no aaa-server aaa-server-name [domain domain-name] HTTPS HTTPS HTTPS SCVPN https-port port-number port-number HTTPS WebUI HTTPS HTTPS 443 SCVPN HTTPS SCVPN no HTTPS no https-port anti -replay SCVPN anti-replay { } SCVPN no no anti-replay 50

62 SCVPN df-bit {copy clear set} copy IP DF clear set SCVPN no no df-bit SCVPN idle-time time-value time-value SCVPN no no idle-time SCVPN allow-multi-logon SCVPN allow-multi-logon number number number SCVPN no no allow-multi-logon URL URL SCVPN URL URL URL URL SCVPN redirect-url url title-en name title-zh name url URL

63 HTTP HTTPS URL title-en name URL 1 31 PC title-zh name URL 1 63 PC WebUI SCVPN no URL no redirect-url URL StoneOS URL HTTP URL UTF-8 URL + username=$user&password=$pwd GB2312 URL + username=$gbuser&password=$pwd URL URL URL SCVPN SCVPN SCVPN SCVPN SCVPN SCVPN split-tunnel-route ip-address/netmask [metric metric-number] ip-address/netmask metric metric-number SCVPN no no split-tunnel-route ip-address/netmask [metric metric-number] SCVPN SCVPN SCVPN tunnel scvpn instance-name 52

64 instance-name SCVPN no SCVPN no tunnel USB Key Hillstone USB Key USB Key Windows SDK Certificate Store Functions USB Key / + USB Key SCVPN USB Key USB Key USB Key SCVPN USB Key USB Key USB Key USB Key CN OU USB Key USB Key USB Key USB Key CA USB Key CA USB Key USB Key SCVPN USB Key client-cert-authentication [usbkey-only] usbkey-only USB Key USB Key / + USB Key SCVPN no USB Key no client-cert-authentication [usbkey-only] 53

65 USB Key CA FTP TFTP USB CA import pki trust-domain-name cacert from {ftp server ip-address [user user-name password password] tftp server ip-address usb0 usb1} file-name trust-domain-name PKI ftp server ip-address [user user-name password password] FTP IP tftp server ip-address TFTP IP usb0 usb1 USB usb0 usb1 U CA file-name CA USB Key CA USB Key CA Certification Authority CA SCVPN client-auth-trust-domain trust-domain trust-domain CA PKI 10 SCVPN no PKI no client-auth-trust-domain trust-domain PKI PKI SCVPN Hillstone Hillstone Hillstone GSM SIM GSM Hillstone SIM USB Hillstone USB 54

66 1 GSM GSM WAVECOM USB MODEM GSM MODEM GSM WAVECOM USB / / SCVPN sms-auth enable sms-auth disable SCVPN AD AD phone phone-number phone-number no no phone AD AD mobile SCVPN SCVPN sms-auth expiration expiration 55

67 expiration SCVPN no no sms-auth expiration sms modem {num-per-hour num-per-day} number {num-per-hour num-per-day} number num-per-hour num-per-day no no sms modem {num-per-hour num-per-day} exec sms send test-message to phone-number phone-number show sms modem Hillstone ID 1. Service Provider SP 2. SP SCVPN SP SP sms service-provider sp-name [protocol sgip] sp-name - SP 1 31 protocol sgip - SP SGIP SP SP 56

68 SP 2 SP no SP no sms service-provider instance-name [protocol sgip] SP ID VRouter SP source-number phone-number phone-number 1 21 SP no no source-number ID ID SP ID device-code code-number code-number - ID SP no ID no device-code SP gateway {host hostname ip ip-address} host hostname ip ip-address - IP SP no no gateway {host hostname ip ip-address} VRouter VRouter trust-vr VR SP VRouter 57

69 SP vrouter {trust-vr vr-name} trust-vr - SP VR VR vr-name VR SP no VR no vrouter {trust-vr vr-name} SP user username password password username 1 64 password 1 64 SP no no user username password password SP {num-per-hour num-per-day} number number numper-hour num-per-day SP no no {num-per-hour num-per-day} exec sms sp sp-name tunnel-name send test-message to phone-number phone-number tunnel-name SP / SP SCVPN SCVPN sms-auth enable sp-name sp-name SP SP

70 SCVPN no sms-auth disable sp-name show sms service-provider [sp-name] sp-name SP SP show tunnel scvpn scvpn-name smsp-statistice [clear] scvpn-name SCVPN clear SCVPN SCVPN PC SCVPN CPU ID BIOS MD5 32 ID ID SCVPN SCVPN SCVPN ID ID ID SSL SCVPN user-host-verify [allow-multi-host] [allow-shared-host] [auto-approved-first-bind] user-host-verify allow-multi-host 59

71 allow-shared-host auto-approved-first-bind ID SCVPN no no user-host-verify ID exec scvpn instance-name approve-binding user user-name host host-id scvpn instance-name SCVPN user user-name host host-id ID exec scvpn instance-name no-host-binding-check user user-name scvpn instance-name SCVPN user user-name exec scvpn instance-name host-binding-check user user-name exec scvpn instance-name no-user-binding-check host host-id scvpn instance-name SCVPN host host-id ID ID exec scvpn instance-name user-binding-check host host-id / ID ID ID 60

72 ID / exec scvpn instance-name increase-host-binding user user-name number scvpn instance-name SCVPN user user-name number 1 32 exec scvpn instance-name decrease-host-binding user user-name number scvpn instance-name SCVPN user user-name number 1 32 exec scvpn instance-name clear-binding [{user user-name [host host-id] host host-id }] scvpn instance-name SCVPN user user-name Host ID host host-id ID / FTP TFTP USB export scvpn user-host-binding to {ftp server ip-address [user user-name password password] tftp server ip-address usb0 usb1} [file-name] ftp server ip-address [user user-name password password] FTP user user-name password password FTP IP tftp server ip-address TFTP ip -address TFTP IP usb0 usb1 U file-name scvpn_bind_file import scvpn user-host-binding from {ftp server ip-address [user user-name password password] tftp server ip-address usb0 usb1} file-name 61

73 ftp server ip-address [user user-name password password] FTP user user-name password password FTP IP tftp server ip-address TFTP ip-address TFTP IP usb0 usb1 U file-name SCVPN SCVPN IE SCVPN Hillstone 2 Hillstone Windows 2000 Win dows 2003 Win dows XP Windows Vista Service Pack 1 Windows KB Windows IE 62

74 Hillstone SCVPN Profile WebUI Profile 3. Profile Hillstone Profile Profile Profile WebUI CLI Profile Profile WebUI Profile scvpn host-check-profile hostcheck-profile-name hostcheck-profile-name Profile Profile no scvpn host-check-profile hostcheck-profile-name Profile 63

75 WebUI Profile WebUI Profile WebUI Profile 1. SSL VPN < > 2. < > 3. Profile OS x Windows Profile 5 IE Internet zone IE IE IE Windows < > Windows Windows < > Windows

76 x Profile x Profile x Profile x Profile

77 - - - x Profile Profile SCVPN host-check [role role-name] profile profile-name [guest-role guestrole-name] [periodic-check period-time] role role-name AAA Profile Profile profile profile-name Profile guest-role guestrole-name periodic-check period-time SCVPN no host-check [role role-name] profile profile-name [guest-role guestrole-name] [periodic-check period-time] 66

78 CLI profile profile profile profile VPN ISP Internet Service Provider ISP VPN Hillstone SCVPN ISP SCVPN Hillstone SCVPN 67

79 5 SCVPN SCVPN ISP Internet SCVPN ISP Hillstone ISP SCVPN IP UDP 68

80 6 NAT SCVPN DNAT SCVPN DNAT SCVPN DNAT ISP Internet DNAT ISP DNAT Hillstone ISP DNAT IP UDP SCVPN SCVPN interface interface-name interface-name SCVPN no no interface interface-name SCVPN link-select [server-detect] [A.B.C.D [https-port port-number]] [A.B.C.D [https-port port-number]] [A.B.C.D [https-port port-number]] [A.B.C.D [https-port port-number]] server-detect A.B.C.D DNAT IP 69

81 https-port port-number DNAT HTTPS WebUI HTTPS HTTPS 443 SCVPN no link-select SCVPN SCVPN SCVPN exec scvpn instance-name kickout user-name instance-name SCVPN user-name Hillstone SCVPN AAA allow-pwd-change no allow-pwd-change SCVPN Hillstone Secure Connect SCVPN SCVPN 1. Hillstone Secure Connect 70

82 7 2. < > < > < < > < > 8 3. CSV 9 71

83 Excel CLI export aaa user-password to {tftp server ip-address ftp server ip-address [user user-name password password]} [file-name] ip-address FTP TFTP IP user user-name password password FTP file-name import aaa user-password from {tftp server ip-address ftp server ip-address [user user-name password password]} file-name ip-address FTP TFTP IP user user-name password password FTP file-name Hillstone SCVPN SCVPN 72

84 10 SCVPN import customize scvpn from {ftp server ip-address [user user-name password password] tftp server ip-address usb0 usb1} file-name ftp server ip-address [user user-name password password] FTP FTP IP tftp server ip-address TFTP TFTP IP usb0 usb1 USB USB0 USB1 U file-name Login_box_bg_e Login_box_bg_cn.gif 624px * 376px zip exec customize scvpn [language {en zh_cn}] default language {en zh_cn} en zh_cn Radius Radius Radius 73

85 show auth-user username user-name user-name Radius Radius Hillstone-user-policy-dst-ip-begin ipaddr IP IPv4 Hillstone-user-policy-dst-ip-end ipaddr IP IPv4 Radius Radius SCVPN Radius SCVPN show SCVPN SCVPN show tunnel scvpn [scvpn-instance-name] SCVPN HTTP show scvpn session scvpn-instance-name [user user-name] SCVPN show scvpn client scvpn-instance-name [user user-name] SCVPN show auth-user scvpn [interface interface-name vrouter vrouter-name slot slot-no] show scvpn user-host-binding scvpn-instance-name {host [host-id] user [user-name]} SCVPN SCVPN Hillstone Secure Connect Hillstone Secure Connect Windows 2000/2003/XP/Vista/Windows 7 74

86 PC SCVPN SCVPN / / + USB Key USB Key SCVPN Hillstone Secure Connect / + USB Key / / Hillstone Secure Connect 1. URL IP- Address Port -Number SCVPN IP interfaceinterface-name HTTPS https -port port-number Hillstone RADIUS + RSA Server RSA SecurID Token RADIUS Token PIN 12 PIN PIN 13 < > PIN + Token PIN

87 Token RADIUS + RSA Server RSA SecurID Token RADIUS PIN + Token 11 Hillstone Secure Connect 12 PIN 13 76

88 IE Firefox scvpn.exe scvpn.exe Hillstone Secure Connect PC 77

89 / + USB Key / + USB Key Hillstone Secure Connect 1. USB Key PC USB 2. URL IP- Address Port -Number SCVPN IP interfaceinterface-name HTTPS https -port port-number 3. < > 15 < > 16 UKey

90 Hillstone UKey Hillstone UKey 4. Hillstone IE Firefox scvpn.exe scvpn.exe Hillstone Secure Connect PC / + / + Hillstone Secure Connect URL IP- Address Port -Number SCVPN IP interfaceinterface-name HTTPS https -port port-number 3. < > 4. Hillstone IE Firefox scvpn.exe scvpn.exe Hillstone Secure Connect PC 79

91 USB Key USB Key Hillstone Secure Connect 1. USB Key PC USB 2. URL IP- Address Port -Number SCVPN IP interfaceinterface-name HTTPS https -port port-number 3. < > < > UKey IE Firefox scvpn.exe scvpn.exe Hillstone Secure Connect PC Hillstone Secure Connect URL IP- Address Port -Number SCVPN IP interfaceinterface-name HTTPS https -port port-number 3. < > 4. IE Firefox scvpn.exe scvpn.exe Hillstone Secure Connect PC 80

92 PC SCVPN Hillstone Secure Connect Web Web Web / + USB Key Web / / Web 1. IE URL Hillstone RADIUS + RSA Server RSA SecurID Token RADIUS Token PIN PIN PIN + Token PIN Token RADIUS + RSA Server RSA SecurID Token RADIUS PIN + Token 3. 1 VPN SCVPN 81

93 Web / + USB Key / + USB Key Web 1. USB Key PC USB 2. IE URL 3. < > < > UKey Hillstone <USB Key > UKey USB Key VPN SCVPN Web / + / + Web IE URL 3. < > 4. Hillstone 5. 82

94 1 VPN SCVPN Web USB Key USB Key Web 1. USB Key PC USB 2. IE URL 3. < > < > UKey <USB > Key UKey 1111 VPN SCVPN Web Web IE URL 3. < > VPN SCVPN / + USB Key / / 83

95 1. Hillstone Secure Connect Hillstone Secure Connect Hillstone Secure Connect 2. < > < / > / 19 Hillstone RADIUS + RSA Server RSA SecurID Token RADIUS Token PIN 20 PIN PIN 21 + Token PIN Token RADIUS + RSA Server RSA SecurID Token RADIUS PIN + Token 19 / 84

96 Secure Connect IP HTTPS 20 PIN < > 22 85

97 1 22 SCVPN / + USB Key / + USB Key 1. USB Key PC USB 2. Hillstone Secure Connect Hillstone Secure Connect Hillstone Secure Connect 3. < > < / + > < > USB Key USB Key USB Key USB Key 23 86

98 Hillstone Hillstone UKey USB Key USB Key USB Key USB Key USB Key USB Key 4. / + USB Key 24 / + USB Key 87

99 Secure Connect IP HTTPS PIN USB Key 1111 USB Key 5. < > 1 SCVPN / + / Hillstone Secure Connect Hillstone Secure Connect Hillstone Secure Connect 3. < > < / + > 88

100 25 4. / + 26 / + Secure Connect IP 89

101 HTTPS 5. < > 1 SCVPN USB Key USB Key 1. USB Key PC USB 2. Hillstone Secure Connect Hillstone Secure Connect Hillstone Secure Connect 3. < > < < > USB Key USB Key USB Key USB Key USB Key 90

102 Secure Connect IP HTTPS PIN USB Key 1111 USB Key SCVPN Hillstone Secure Connect Hillstone Secure Connect Hillstone Secure Connect 3. < > < < > Secure Connect IP 91

103 HTTPS SCVPN USB Key Hillstone Hillstone UKey USB Key SCVPN Hillstone USB Key SelectUSBKey SelectUSBKey USB Key SelectUSBKey USB Key USB Key CSP Name PC USB Key CSP Name 1. PC USB Key 2. USB Key 3. SelectUSBKey.exe <Select Default Certificate> 29 Select Default Certificate Export USB Key CSP Name.reg Update Close 4. <Certificate List> Export USB Key CSP Name 92

104 .reg 30 USB Key CSP Name USB Key CSP Name PC PC USB Key SCVPN USB Key GUI Hillstone Secure Connect < > < > 31 93

105 IP IP IP SCVPN SSL SCVPN SCVPN SSL IP SCVPN SCVPN SCVPN SCVPN 94

106 SCVPN SCVPN < > 32 SCVPN SCVPN SCVPN SCVPN MAC IP SCVPN IP SCVPN IP SCVPN SCVPN DNS DNS 95

107 WINS WINS < > 33 Hillstone Secure Connect 34 < > < > Hillstone Secure Connect 96

108 35 < > < > 36 < Hillstone Secure Connect> Hillstone Secure Connect 37 97

109 < > <Secure Connect > Secure Connect Hillstone Secure Connect Secure Connect < > <Secure Connect > 38 Secure Connect 98

110 <Secure Connect > < > SCVPN PC SCVPN VPN SCVPN PC > < > USB Key USB Key 39 Secure Connect > < > 1. <Secure Connect > < > 40 99

111 2. IP HTTPS < > < PIN> <PIN> < > / < > < > < PIN> / + USB Key < > < > < PIN > PIN <PIN > UKey <PIN> USB Key < PIN > PIN <PIN > UKey <Secure Connect > < > 100

112 2. < > PC Hillstone Secure Connect Hillstone Secure Connect Uninstall SCVPN SCVPN USB Key PC1 IP /24 HillstoneHillstone Server1 IP /21 SCVPN 101

113 41 SCVPN USB Key hostname(config)# aaa-server local hostname(config-aaa-server)# user user1 hostname(config-user)# password hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# SCVPN hostname(config)# scvpn pool pool1 hostname(config-pool-scvpn)# address netmask hostname(config-pool-scvpn)# dns hostname(config-pool-scvpn)# wins hostname(config-pool-scvpn)# exit hostname(config)# SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# pool pool1 hostname(config-tunnel-scvpn)# aaa-server local hostname(config-tunnel-scvpn)# interface ethernet0/5 hostname(config-tunnel-scvpn)# https-port 4433 hostname(config-tunnel-scvpn)# split-tunnel-route /21 102

114 hostname(config-tunnel-scvpn)# exit hostname(config)# SCVPN IP SCVPN IP hostname(config)# zone VPN hostname(config-zone-vpn)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone VPN hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel scvpn ssl1 hostname(config-if-tun1)# exit hostname(config)# VPN trust hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# PC1 user Hillstone Secure Connect Web SCVPN PC1 SCVPN trust USB Key USB Key Windows SDK Certificate Store Functions Hillstone UKey USB Key CA Hillstone UKey Hillstone UKey USB Key 103

115 # PKI stone terminal hostname(config)# pki trust-domain stone hostname(config-trust-domain)# enrollment terminal hostname(config-trust-domain)# exit hostname(config)# # SCVPN SSL1 USB Key CA hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# client-cert-auth required hostname(config-tunnel-scvpn)# client-auth-trust-domain stone hostname(config-tunnel-scvpn)# exit hostname(config)# # CA CA hostname(config)# exit hostname# import pki stone cacert from tftp server certnew.cer 1. PC Hillstone UKey 2. USB Key 3. SCVPN UK PIN USB Key URL OA Hillstone SCVPN 104

116 SCVPN OA URL 43 URL hostname(config)# aaa-server local hostname(config-aaa-server)# user test hostname(config-user)# password test hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# SCVPN hostname(config)# scvpn pool pool1 hostname(config-pool-scvpn)# address netmask hostname(config-pool-scvpn)# dns hostname(config-pool-scvpn)# wins hostname(config-pool-scvpn)# exit hostname(config)# SCVPN URL hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# pool pool1 hostname(config-tunnel-scvpn)# aaa-server local hostname(config-tunnel-scvpn)# interface ethernet0/5 hostname(config-tunnel-scvpn)# https-port 4433 hostname(config-tunnel-scvpn)# redirect-url 105

117 login.do?username=$user&password=$pwd title-en OA title-zh OA hostname(config-tunnel-scvpn)# split-tunnel-route /21 hostname(config-tunnel-scvpn)# exit hostname(config)# SCVPN IP SCVPN IP hostname(config)# zone VPN hostname(config-zone-vpn)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone VPN hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel scvpn ssl1 hostname(config-if-tun1)# exit hostname(config)# VPN trust hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# PC1 test test Hillstone Secure Connect Web SCVPN OA OA 44 OA 106

118 45 OA OA OA SCVPN PC HillstoneHillstone SCVPN PC SCVPN IP /24 IP /24dl IP /24 PC 107

119 46 SCVPN hostname(config)# aaa-server local type local hostname(config-aaa-server)# user pc1 hostname(config-user)# password xxxfcvg236 hostname(config-user)# exit hostname(config-aaa-server)# user pc2 hostname(config-user)# password xcabuv112 hostname(config-user)# exit hostname(config-aaa-server)# user pc3 hostname(config-user)# password xacfomg763 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# hostname(config)# role sw 108

120 hostname(config)# role dl hostname(config)# role-mapping-rule rule1 hostname(config-role-mapping)# match user pc1 role sw hostname(config-role-mapping)# match user pc1 role dl hostname(config-role-mapping)# match user pc2 role dl hostname(config-role-mapping)# exit hostname(config)# aaa-server local type local hostname(config-aaa-server)# role-mapping-rule rule1 hostname(config)# hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# Profile WebUI Profile hostname(config)# scvpn host-check-profile dl-security-check hostname(config-profile_scvpn)# exit hostname(config)# scvpn host-check-profile sw-security-check hostname(config-profile_scvpn)# exit hostname(config)# WebUI Profile 1. SSL VPN SCVPN 2. < > SCVPN 3. < > dl-security-check OS Win KB IE IE6.0 IE

121 6. < > sw-security-check OS WinXP SP3 1 KB IE IE7.0 IE 7. < 1> \Program Files\McAfee\VirusScan\Enterprise.exe 8. SCVPN hostname(config)# scvpn pool pool1 hostname(config-pool-scvpn)# address netmask hostname(config-pool-scvpn)# dns hostname(config-pool-scvpn)# wins hostname(config-pool-scvpn)# exit hostname(config)# SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# pool pool1 hostname(config-tunnel-scvpn)# aaa-server local hostname(config-tunnel-scvpn)# interface ethernet0/1 hostname(config-tunnel-scvpn)# https-port 4433 hostname(config-tunnel-scvpn)# split-tunnel-route /24 metric 10 hostname(config-tunnel-scvpn)# split-tunnel-route /24 metric 5 hostname(config-tunnel-scvpn)# split-tunnel-route /24 metric 3 hostname(config-tunnel-scvpn)# host-check role sw profile sw-security-check guest-role dl hostname(config-tunnel-scvpn)# host-check profile dl-security-check periodic-check

122 hostname(config-tunnel-scvpn)# exit hostname(config)# SCVPN IP SCVPN IP ostname(config)# zone VPN hostname(config-zone-vpn)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone VPN hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel scvpn ssl1 hostname(config-if-tun1)# exit hostname(config)# hostname(config)# address sw hostname(config-addr)# ip /24 hostname(config-addr)# exit hostname(config)# address dl hostname(config-addr)# ip /24 hostname(config-addr)# exit hostname(config)# address public hostname(config-addr)# ip /24 hostname(config-addr)# exit hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr sw hostname(config-policy-rule)# service any hostname(config-policy-rule)# role sw hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr dl hostname(config-policy-rule)# service any hostname(config-policy-rule)# role dl hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr public 111

123 hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# PC SCVPN 4 sw pc1 profile sw-security-check dl CLI host-check role sw profile sw-security-check guest-role dl default dl pc2 pc3 profile dl -security-check CLI host-check profile dl-security-check periodic-check 50 profile dl -security-check CLI host-check profile dl-security-check periodic-check

124 SCVPN Hillstone SCVPN ISP1 ethernet0/1 IP /24 ISP2 ethernet0/3 IP /24 Internet PC IP Server IP SCVPN hostname(config)# aaa-server local type local hostname(config-aaa-server)# user user1 hostname(config-user)# password drgrhrgerg231 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# hostname(config)# interface ethernet0/0 113

125 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# interface ethernet0/3 hostname(config-if-eth0/3)# zone untrust hostname(config-if-eth0/3)# ip address /24 hostname(config-if-eth0/3)# exit hostname(config)# SCVPN hostname(config)# scvpn pool pool1 hostname(config-pool-scvpn)# address netmask hostname(config-pool-scvpn)# dns hostname(config-pool-scvpn)# wins hostname(config-pool-scvpn)# exit hostname(config)# SCVPN SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# pool pool1 hostname(config-tunnel-scvpn)# aaa-server local hostname(config-tunnel-scvpn)# interface ethernet0/1 hostname(config-tunnel-scvpn)# interface ethernet0/3 hostname(config-tunnel-scvpn)# https-port 4433 hostname(config-tunnel-scvpn)# split-tunnel-route /24 metric 10 hostname(config-tunnel-scvpn)# link-select server-detect hostname(config-tunnel-scvpn)# exit hostname(config)# SCVPN IP SCVPN IP hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone untrust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel scvpn ssl1 hostname(config-if-tun1)# exit hostname(config)# hostname(config)# address dst hostname(config-addr)# ip /24 hostname(config-addr)# exit hostname(config)# policy-global 114

126 hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr dst hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# ISP hostname(config)# isp-network isp1 hostname(config-isp)# subnet /24 hostname(config-isp)# subnet /24 hostname(config-isp)# exit hostname(config)# PC ISP2 PC IP SCVPN ethernet0/1 IP ISP1 IP PC ISP1 Server SCVPN SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# link-select PC ISP2 SCVPN ethernet0/1 ethernet0/3 IP UDP Hillstone SCVPN DNAT ISP1 IP /24 ISP2 IP /24 Internet PC IP Server IP

127 48 SCVPN hostname(config)# aaa-server local type local hostname(config-aaa-server)# user user1 hostname(config-user)# password drgrhrgerg231 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone trust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone dmz hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# SCVPN 116

128 hostname(config)# scvpn pool pool1 hostname(config-pool-scvpn)# address netmask hostname(config-pool-scvpn)# dns hostname(config-pool-scvpn)# wins hostname(config-pool-scvpn)# exit hostname(config)# SCVPN SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# pool pool1 hostname(config-tunnel-scvpn)# aaa-server local hostname(config-tunnel-scvpn)# interface ethernet0/1 hostname(config-tunnel-scvpn)# https-port 4433 hostname(config-tunnel-scvpn)# split-tunnel-route /24 metric 10 hostname(config-tunnel-scvpn)# link-select server-detect https-port https-port 3367 hostname(config-tunnel-scvpn)# exit hostname(config)# SCVPN IP SCVPN IP hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone untrust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel scvpn ssl1 hostname(config-if-tun1)# exit hostname(config)# dmz trust hostname(config)# address dst hostname(config-addr)# ip /24 hostname(config-addr)# exit hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone dmz hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr dst hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# ISP hostname(config)# isp-network isp1 hostname(config-isp)# subnet /24 117

129 hostname(config-isp)# subnet /24 hostname(config-isp)# exit hostname(config)# PC ISP2 DNAT DNAT :3367 SCVPN :4433 PC IP DNAT IP /24 ISP1 DNAT IP PC ISP1 Server SCVPN SCVPN hostname(config)# tunnel scvpn ssl1 hostname(config-tunnel-scvpn)# link-select https-port https-port 3367 PC ISP2 DNAT :3367 SCVPN :4433 DNAT IP UDP 118

130 3 VPN VPN VPN VPN VPN VPN IKE VPN VPN VPN StoneOS VPN VPN Hillstone VPN VPN Hub-and-spoke VPN VPN P1 ISAKMP P2 P1 P1 IKE ISAKMP SA IKE DH P1 P1 IKE 119

131 isakmp proposal p1-name p1-name P1 CLI P1 P1 no isakmp proposal p1-name P1 IKE IKE P1 authentication {pre-share rsa-sig dsa-sig} pre-share rsa-sig RSA dsa-sig DSA SHA-1 no authentication StoneOS 3DES DES 128bit AES 192bit AES 256bit AES IKE P1 encryption {3des des aes aes-192 aes-256} 3des 3DES 192 StoneOS des DES 64 aes AES 128 aes bit AES 192 aes bit AES 256 no encryption StoneOS MD5 SHA-1 SHA-2 SHA-256 SHA-384 SHA-512 IKE P1 hash {md5 sha sha256 sha384 sha512} md5 MD5 128 sha SHA StoneOS 120

132 sha256 SHA sha384 SHA sha512 SHA no hash DH Diffie-Hellman DH DH DH DH IKE 5 DH DH SA DH DH DH ISAKMP DH DH DH P1 group {1 2 5} 1 DH DH DH no group SA ISAKMP SA SA SA SA P1 lifetime time-value time-value SA no lifetime ISAKMP ISAKMP ISAKMP IKE ISAKMP IP IKE PKI ID ISAKMP ID ISAKMP ISAKMP NAT 121

133 ISAKMP ISAKMP : isakmp peer peer-name peer-name ISAKMP CLI ISAKMP ISAKMP no isakmp peer peer-name ISAKMP ISAKMP ISAKMP ISAKMP aaa-server server-name server-name local Radius ISAKMP no no aaa-server ISAKMP ISAKMP ISAKMP ISAKMP interface interface-name interface-name no interface IKE IKE main aggressive modemode IKE IP IP IKE ISAKMP mode {main aggressive} main ID aggressive no mode ISAKMP ISAKMP 122

134 type usergroup ISAKMP no no type P1 ISAKMP P1 ISAKMP isakmp-proposal p1-proposal1 [p1-proposal2] [p1-proposal3] [p1-proposal3] p1-proposal1 P1 ISAKMP 4 P1 no isakmp-proposal P1 ISAKMP ISAKMP pre-share string string no pre-share PKI PKI ISAKMP PKI ISAKMP trust-domain string string PKI no trust-domain PKI PKI PKI ID StoneOS FQDN Asn1dn ID ISAKMP local-id {fqdn string asn1dn [string] u-fqdn string} fqdn string FQDN ID string ID asn1dn [string] Asn1dn ID string ID ID ID u-fqdn string U-FQDN ID 123

135 no local-id ID ISAKMP ISAKMP connection-type {bidirectional initiator-only responder-only} bidirectional ISAKMP initiator-only ISAKMP responder-only ISAKMP VPN bidirectional responder-only no connection-type NAT IPSec IKE VPN NAT NAT VPN NAT IPSec IKE NAT N NAT ISAKMP nat-traversal no nat-traversal NAT DPD DPD Dead Peer Detection DPD ISAKMP DPD ISAKMP dpd [interval seconds] [retry times] interval seconds DPD retry times ISAKMP ISAKMP no dpd DPD 124

136 ISAKMP ISAKMP description string string ISAKMP no description ISAKMP P2 P2 SA P2 P2 P2 IPSec ipsec proposal p2-name p2-name P2 CLI P2 P2 no ipsec proposal p2-name IPSec proposal P2 AH ESP P2 P2 protocol {esp ah} esp ESP ah AH no protocol ESP P2 P2 P2 encryption {3des des aes aes-192 aes-256 null} [3des des aes aes-192 aes-256 null] [3des des aes aes-192 aes-256 null] 3des 3DES 192 StoneOS des DES 64 aes AES 128 aes bit AES 192 aes bit AES

137 null no encryption P2 P2 P2 hash {md5 sha sha256 sha384 sha512 null} [md5 sha sha256 sha384 sha512 null] [md5 sha sha256 sha384 sha512 null] md5 MD5 128 sha SHA StoneOS sha256 SHA sha384 SHA sha512 SHA null no hash PFS PFS Perfect Forward Security PFS PFS DH P2 PFS P2 group {nopfs 1 2 5} nopfs PFS 1 DH DH DH no group Hillstone SA SA P2 P2 lifetime seconds 126

138 seconds lifesize kilobytes kilobytes 0 no no lifetime no lifesize IKE IPSec ISAKMP IKE ID IKE IKE tunnel ipsec tunnel-name auto tunnel-name - IKE CLI IKE IKE no tunnel ipsec tunnel-name auto IKE IPSec IKE IKE mode tunnel no mode ISAKMP IKE ISAKMP IKE isakmp-peer peer-name peer-name ISAKMP no isakmp-peer ISAKMP P2 IKE P2 IKE ipsec-proposal p2-name p2-name P2 no ipsec-proposal p2-name P2 127

139 ID IKE IPSec ID IKE id {auto local ip-address/mask remote ip-address/mask service service-name} auto ID local ip-address/mask local ID remote ip-address/mask remote ID VPN ID ID /0 service service-name no id SA 60 SA SA IKE auto-connect no auto-connect IKE IKE df-bit {copy clear set} copy IP DF clear set no df-bit anti -replay IKE IPSec IKE IPSec anti-replay { }

140 no anti-replay Commit Commit Commit Commit IKE IPSec Commit responder -set-commit Commit no responder-set-commit IKE IPSec idle-time time-value time-value IKE IPSec no no idle-time IKE IKE IPSec description string string IKE no description IKE VPN PnPVPN PnPVPN IP ISAKMP 129

141 generate-route VPN local ID IP IP ID PnPVPN DHCP IP DHCP dhcp-pool-addr-start & dhcp-pool-netmask IP IP DHCP CLI PnPVPN no generate-route VPN local ID /0 no reverse-route user user-name aaa-server local user-name IKE ID ike_id {fqdn string asn1dn string} fqdn string FQDN IKE ID string ID asn1dn string Asn1dn ID string ID no IKE ID no ike_id IKE ID exec generate-user-key rootkey pre-share-key userid string pre-share-key string IKE ID 130

142 P1 P2 ISAKMP ISAKMP ID VPN VPN User1 User /24 VPN PC PC1 PC2 Server1 49 VPN hostname(config)# zone vpnzone hostname(config-zone-vpnzone)# exit hostname(config)# interface ethernet0/0 hostname(config-if-eth0/0)# zone vpnzone hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/5 131

143 hostname(config-if-eth0/5)# zone trust hostname(config-if-eth0/5)# ip address /24 hostname(config-if-eth0/5)# exit hostname(config)# hostname(config)# aaa-server local hostname(config-aaa-server)# user user1 hostname(config-user)# ike_id fqdn hillstone1 hostname(config-user)# exit hostname(config-aaa-server)# user user2 hostname(config-user)# ike_id fqdn hillstone2 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# exit hostname# exec generate-user-key rootkey userid hillstone1 userkey: 3zPNDY6MmI8Wejk5fa3jhPU39p8= hostname# exec generate-user-key rootkey userid hillstone2 userkey: tafw+48hcar15+ncism6tzjzzgu= hostname# configure hostname(config)# IKE VPN hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer test hostname(config-isakmp-peer)# aaa-server local hostname(config-isakmp-peer)# interface ethernet0/0 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# mode aggressive hostname(config-isakmp-peer)# pre-share hostname(config-isakmp-peer)# type usergroup hostname(config-isakmp-peer)# exit hostname(config)# tunnel ipsec vpn auto hostname(config-tunnel-ipsec-auto)# isakmp-peer test hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# id local /24 remote /0 service any hostname(config-tunnel-ipsec-auto)# exit hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust 132

144 hostname(config-policy-rule)# dst-zone vpnzone hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone vpnzone hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 1 hostname(config)# interface ethernet0/1 hostname(config-if-eth0/0)# zone untrust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/4 hostname(config-if-eth0/5)# zone trust hostname(config-if-eth0/5)# ip address /24 hostname(config-if-eth0/5)# exit hostname(config)# IKE VPN hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer test hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# mode aggressive hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share 3zPNDY6MmI8Wejk5fa3jhPU39p8= hostname(config-isakmp-peer)# local-id fqdn hillstone1 hostname(config-isakmp-peer)# exit hostname(config)# tunnel ipsec vpn auto hostname(config-tunnel-ipsec-auto)# isakmp-peer test hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# id local /24 remote /24 service any hostname(config-tunnel-ipsec-auto)# exit 133

145 hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 2 hostname(config)# interface ethernet0/1 hostname(config-if-eth0/0)# zone untrust hostname(config-if-eth0/0)# ip address /24 hostname(config-if-eth0/0)# exit hostname(config)# interface ethernet0/4 hostname(config-if-eth0/5)# zone trust hostname(config-if-eth0/5)# ip address /24 hostname(config-if-eth0/5)# exit hostname(config)# IKE VPN hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer test hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# mode aggressive hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share tafw+48hcar15+ncism6tzjzzgu= hostname(config-isakmp-peer)# local-id fqdn hillstone2 hostname(config-isakmp-peer)# exit 134

146 hostname(config)# tunnel ipsec vpn auto hostname(config-tunnel-ipsec-auto)# isakmp-peer test hostname(config-tunnel-ipsec-auto)# ipsec-proposal p2 hostname(config-tunnel-ipsec-auto)# id local /24 remote /24 service any hostname(config-tunnel-ipsec-auto)# exit hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone untrust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action tunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action fromtunnel vpn hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 135

147 4 PnPVPN PnPVPN IPSec VPN Hillstone VPN PnPVPN VPN PnPVPN PnPVPN Server PnPVPN Client PnPVPN Server IT PnPVPN Server Hillstone Hillstone PnPVPN Server PnPVPN Client ID IP Server Server DNS WINS DHCP PnPVPN Client Hillstone SR Hillstone PnPVPN Server PnPVPN Client Server VPN PnPVPN PnPVPN 1. ID 2. ID DHCP DHCP DHCP WINS DNS PC IP IP VPN PnPVPN PnPVPN CLI WebUI CLI PnPVPN PnPVPN IPSec VPN PnPVPN 136

148 PnPVPN VPN DNS WINS DHCP DNS WINS IKE IKE IKE DNS WINS aaa-server aaa-server-name type local AAA user user-name user-name DHCP DHCP dns A.B.C.D [A.B.C.D] [A.B.C.D] [A.B.C.D] A.B.C.D DNS IP 1 DNS 3 no dns wins A.B.C.D [A.B.C.D] A.B.C.D WINS IP WINS WINS no wins split-tunnel-route A.B.C.D/Mask A.B.C.D/Mask A.B.C.D IP Mask 128 no split-tunnel-route A.B.C.D/Mask dhcp-pool-address start-ipaddr end-ipaddr start-ipaddr end-ipaddr DHCP IP IP no dhcp-pool-address dhcp-pool-netmask A.B.C.D A.B.C.D DHCP no dhcp-pool-netmask dhcp-pool-gateway A.B.C.D A.B.C.D DHCP PnPVPN IP PC PC IP DHCP 137

149 DHCP no dhcp-pool-gateway DNS WINS IKE DNS WINS IKE tunnel ipsec tunnel-name auto tunnel-name IKE DNS WINS dns A.B.C.D [A.B.C.D] [A.B.C.D] [A.B.C.D] A.B.C.D DNS IP 1 DNS 3 no dns wins A.B.C.D [A.B.C.D] A.B.C.D WINS IP WINS WINS no wins split-tunnel-route A.B.C.D/Mask A.B.C.D/Mask A.B.C.D IP Mask 128 no split-tunnel-route A.B.C.D/Mask ISAKMP PnPVPN Server Radius ISAKMP Hillstone VPN ISAKMP PnPVPN Server Hillstone PnPVPN Server Radius ISAKMP ISAKMP peer-id fqdn wildcard string fqdn FQDN wildcard string ID abc.com no peer-id PnPVPN StoneOS PnPVPN IP SNAT PnPVPN Hillstone SR 138

150 SR PnPVPN aaa-server aaa-server-name type local AAA user user-name user-name PnPVPN tunnel-ip-address A.B.C.D [snat] A.B.C.D IP IP snat SNAT SNAT no PnPVPN no tunnel-ip-address WebUI WebUI IKE VPN PnPVPN Local Radius Radius Radius 1. < > < 2. < > < > < > 3. < > 4. < > < > 5. IKE ID <IKE > <FQDN> <IKE > ID PnPVPN Client ID 139

151 6. <PnPVPN > DHCP DNS WINS DNS WINS IKE VPN IKE VPN P1 P2 P1 1. IPSec VPN IPSec VPN P1 2. P1 < 1 > 3. P1 < > P1 4. pre -share 5. DH Group P2 1. IPSec VPN IPSec VPN P2 2. P2 < 2 > 3. P2 < > P2 4. PFS IPSec VPN IPSec VPN VPN 2. <VPN > 3. < > 4. < > 140

152 5. < > < > 6. <AAA > 7. P1 < 1> P1 8. < > <> ID < > PnPVPN Client 11. Radius 1. IPSec VPN IPSec VPN IPSec VPN IPSec 2. IKE VPN <IKE VPN > 3. < 1 > < > ISAKMP 4. < 2 > 5. < > 6. <tunnel> 7. <p2 > DNS WINS DNS WINS DNS WINS > 141

153 3. < > <tunnel> 4. < > < > 5. < > 6. < > <IPSec VPN> <VPN > VPN < > 3. IP < > < > IP 4. < > < > < VPN < > IP PnPVPN PnPVPN WebUI WebUI PnPVPN 1. IPSec VPN IPSec VPN 2. < > PnPVPN <PnPVPN > 3. IP ID IKE 142

154 < > PnPVPN DHCP WINS VPN VPN Internet VPN VPN PC PnPVPN < > < > PnPVPN <bgroup > <bgroup > bgroup < > < > < > 4. IPSec VPN PnPVPN PnPVPN Internet VPN VPN VPN PnPVPN 22-1 Hillstone PnPVPN Server Hillstone PnPVPN Client VPN 143

155 50 PnPVPN /24 ethernet0/0 trust /24 ethernet0/2 trust Hillstone ethernet0/1 IP Internet untrust Internet IP Internet IP PnPVPN Server / /24 144

156 AAA hostname(config)# aaa-server test type local hostname(config-aaa-server)# exit hostname(config)# hostname(config)# aaa-server test type local hostname(config-aaa-server)# user shanghai hostname(config-user)# password shanghaiuser hostname(config-user)# ike-id fqdn shanghai hostname(config-user)# dhcp-pool-address hostname(config-user)# dhcp-pool-netmask hostname(config-user)# dhcp-pool-gateway hostname(config-user)# split-tunnel-route /24 hostname(config-user)# split-tunnel-route /24 hostname(config-user)# split-tunnel-route /24 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# hostname(config)# aaa-server test type local hostname(config-aaa-server)# user guangzhou hostname(config-user)# password guangzhouuser hostname(config-user)# ike-id fqdn guangzhou hostname(config-user)# dhcp-pool-address hostname(config-user)# dhcp-pool-netmask hostname(config-user)# dhcp-pool-gateway hostname(config-user)# split-tunnel-route /24 hostname(config-user)# split-tunnel-route /24 hostname(config-user)# split-tunnel-route /24 hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# PnPVPN Server hostname(config)# isakmp proposal test1 hostname(config-isakmp-proposal)# group 2 hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal test2 hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer test1 hostname(config-isakmp-peer)# type usergroup hostname(config-isakmp-peer)# mode aggressive hostname(config-isakmp-peer)# interface ethernet0/1 hostname(config-isakmp-peer)# aaa-server test hostname(config-isakmp-peer)# isakmp-proposal test1 hostname(config-isakmp-peer)# pre-share hostname(config-isakmp-peer)# exit 145

157 hostname(config)# tunnel ipsec test auto hostname(config-tunnel-ipsec-auto)# ipsec-proposal test2 hostname(config-tunnel-ipsec-auto)# isakmp-peer test1 hostname(config-tunnel-ipsec-auto)# mode tunnel hostname(config-tunnel-ipsec-auto)# id auto hostname(config-tunnel-ipsec-auto)# dns hostname(config-tunnel-ipsec-auto)# wins hostname(config-tunnel-ipsec-auto)# exit hostname(config)# hostname(config)# exec generate-user-key rootkey userid shanghai userkey: kyzakmlwcc5nz75fsedim2r+4vg= hostname(config)# exec generate-user-key rootkey userid guangzhou userkey: SdqhY4+dPThTtpipW2hs2OMB5Ps= hostname(config)# zone VPN hostname(config-zone-vpn)# exit hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone VPN hostname(config-if-tun1)# tunnel ipsec test hostname(config-if-tun1)# exit hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone VPN hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone VPN hostname(config-policy-rule)# dst-zone VPN hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 146

158 hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# ip route /24 tunnel hostname(config-vrouter)# ip route /24 tunnel hostname(config)# 1. WebUI IPSec VPN IPSec VPN 2. < > PnPVPN <PnPVPN > ID shanghai kyzakmlwcc5nz75fsedim2r+4vg= kyzakmlwcc5nz75fsedim2r+4vg= VPN ethernet0/0 VPN ethernet0/ WebUI IPSec VPN IPSec VPN 2. < > PnPVPN <PnPVPN > ID guangzhou SdqhY4+dPThTtpipW2hs2OMB5Ps= SdqhY4+dPThTtpipW2hs2OMB5Ps= VPN ethernet0/0 VPN ethernet0/3 147

159 3. 148

160 5 GRE GRE GRE Generic Routing Encapsulation StoneOS GRE over IPSec GRE StoneOS GRE GRE GRE GRE GRE GRE GRE tunnel gre gre-tunnel-name gre-tunnel-name GRE GRE GRE GRE no GRE no tunnel gre gre-tunnel-name GRE GRE / IPSec VPN GRE GRE 149

161 source {interface interface-name ip-address } interface interface-name IP GRE interface-name ip-address GRE GRE no no source GRE GRE destination ip-address ip-address GRE GRE no no destination GRE GRE interface interface-name interface-name GRE no no interface IPSec VPN GRE over IPSec IPSec VPN IPSec IPSec VPN GRE next-tunnel ipsec tunnel-name tunnel-name IPSec VPN GRE no IPSec VPN no next-tunnel GRE GRE key key-value key-value GRE no no key 150

162 GRE GRE GRE tunnel gre gre-tunnel-name [gw ip-address] gre-tunnel-name GRE GRE gw ip-address GRE IP IP no GRE no tunnel gre gre-tunnel-name GRE GRE show tunnel gre [gre-tunnel-name] gre-tunnel-name GRE Hillstone GRE over IPSec with OSPF Center Branch1 Internet OSPF GRE over IPSec 51 GRE over IPSec 151

163 Center Branch1 IPSec VPN OSPF hostname(config)# interface ethernet0/0 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone trust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# IPSec VPN hostname(config)# isakmp proposal branch1 hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal branch1 hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer branch1 hostname(config-isakmp-peer)# interface ethernet0/0 152

164 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share hostname(config-isakmp-peer)# isakmp branch1 hostname(config-isakmp-peer)# exit hostname(config)# tunnel ipsec branch1 auto hostname(config-tunnel-ipsec-auto)# isakmp-peer branch1 hostname(config-tunnel-ipsec-auto)# ipsec-proposal branch1 hostname(config-tunnel-ipsec-auto)# exit hostname(config)# GRE hostname(config)# tunnel gre center-branch1 hostname(config-tunnel-gre)# source hostname(config-tunnel-gre)# destination hostname(config-tunnel-gre)# interface ethernet0/0 hostname(config-tunnel-gre)# next-tunnel ipsec branch1 hostname(config-tunnel-gre)# exit hostname(config)# GRE hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone trust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel gre center-branch1 gw hostname(config-if-tun1)# exit hostname(config)# OSPF hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# router ospf hostname(config-router)# router-id hostname(config-router)# network /24 area 0 hostname(config-router)# network /24 area 0 hostname(config-router)# exit hostname(config-vrouter)# exit hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit 153

165 hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# hostname(config)# interface ethernet0/0 hostname(config-if-eth0/1)# zone trust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit hostname(config)# IPSec VPN hostname(config)# isakmp proposal center hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal center hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer center hostname(config-isakmp-peer)# interface ethernet0/0 hostname(config-isakmp-peer)# peer hostname(config-isakmp-peer)# pre-share hostname(config-isakmp-peer)# isakmp center hostname(config-isakmp-peer)# exit hostname(config)# tunnel ipsec center auto hostname(config-tunnel-ipsec-auto)# isakmp-peer center hostname(config-tunnel-ipsec-auto)# ipsec-proposal center hostname(config-tunnel-ipsec-auto)# exit hostname(config)# GRE hostname(config)# tunnel gre branch1 hostname(config-tunnel-gre)# source hostname(config-tunnel-gre)# destination hostname(config-tunnel-gre)# interface ethernet0/0 154

166 hostname(config-tunnel-gre)# next-tunnel ipsec center hostname(config-tunnel-gre)# exit hostname(config)# GRE hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone trust hostname(config-if-tun1)# ip address /24 hostname(config-if-tun1)# tunnel gre branch1 gw hostname(config-if-tun1)# exit hostname(config)# OSPF hostname(config)# ip vrouter trust-vr hostname(config-vrouter)# router ospf hostname(config-router)# router-id hostname(config-router)# network /24 area 0 hostname(config-router)# network /24 area 0 hostname(config-router)# exit hostname(config-vrouter)# exit hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone trust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 155

167 6 L2TP L2TP Layer Two Tunneling Protocol L2TP L2TP L2TP LAC VPN PPP L2TP LNS IP Hillstone L2TP LNS L2TP LAC IP DNS WINS L2TP RFC2661 L2TP L2TP 52 L2TP Hillstone LN S L2TP L2TP LNS Windows 2000/2003/XP/Vista Linux L2TP 156

168 53 LAC Hillstone LNS L2TP PSTN/ISDN LAC LAC LNS VPN LAC LNS LAC PPP LNS L2TP L2TP over IPSec L2TP L2TP IPSec IPsec L2TP L2TP over IPSec 1. L2TP IPSec Windows L2TP XP L2TP over IPSec 2. IPSec VPN 1 IPSec 3. L2TP IPSec 4. Windows L2TP Windows L2TP IKE LNS IKE accept-all-peer-id ISAKMP ID LNS IPSec VPN IP L2TP Windows IPSec transport LNS IPSec 157

169 LNS LNS L2TP L2TP L2TP LNS IP LNS LNS IP DNS WINS L2TP l2tp pool pool-name pool-name L2TP L2TP no L2TP no l2tp pool pool-name L2TP IP L2TP address start-ip end-ip start-ip IP IP end-ip IP IP IP L2TP no IP no address IP IP LNS IP 158

170 IP FTP L2TP exclude-address start-ip end-ip start-ip IP end-ip IP L2TP no no exclude address IP L2TP IP IP IP IP -IP IP IP IP -IP IP LNS IP IP IP 1. IP IP IP IP 2. -IP IP IP IP -IP IP IP IP L2TP ip-binding user user-name ip-address user user-name ip-address IP L2TP no IP no ip-binding user user-name -IP -IP L2TP ip-binding role role-name ip-range start-ip end-ip role role-name 159

171 ip-range start-ip end-ip IP IP start-ip IP end-ip L2TP no -IP no ip-binding role role-name -IP -IP -IP Hillstone -IP IP L2TP move role-name1 {before role-name2 after role-name2 top bottom} role name1 -IP before role-name2 -IP - IP ( role-name2 ) after role-name2 -IP - IP ( role-name2 ) top -IP -IP bottom -IP -IP L2TP L2TP tunnel l2tp tunnel-name tunnel-name L2TP L2TP L2TP L2TP no L2TP no tunnel l2tp tunnel-name L2TP IP DNS WINS 160

172 AAA PPP Hello LNS AVP IP IP LNS AAA IP DNS LNS IP L2TP IP L2TP assign-client-ip from { pool aaa-server } pool IP DNS aaa-server AAA IP DNS L2TP L2TP L2TP pool pool-name pool-name L2TP L2TP no no pool DNS DNS L2TP dns address1 [address2] address1 DNS IP 2 DNS L2TP no DNS no dns 161

173 WINS WINS L2TP wins address1 [address2] address1 WINS IP 2 WINS L2TP no WINS no wins L2TP interface interface-name interface-name L2TP no no interface AAA AAA LNS L2TP AAA AAA L2TP aaa-server aaa-server-name [domain domain-name [keep-domain-name]] aaa-server-name AAA domain domain-name AAA AAA keep-domain-name L2TP no AAA no aaa-server aaa-server-name [domain domain-name] PPP LNS LAC PPP PAP CHAP PPP L2TP ppp-auth {pap chap any} pap PPP PAP chap PPP CHAP any CHAP PAP L2TP no no ppp-auth LCP Echo PPP LNS LCP Echo LCP Echo 162

174 L2TP ppp-lcp-echo interval time time LCP Echo LCP Echo 30 L2TP no no ppp-lcp-echo interval Hello L2TP Hello LNS L2TP LAC Hello Hello L2TP keepalive time time Hello L2TP no no keepalive LNS LAC L2TP tunnel-authentication L2TP no no tunnel-authentication LNS L2TP secret secret-string [peer-name name] secret-string 1 31 peer-name name LAC LAC LNS LAC LAC L2TP no no secret secret-string [peer-name name] 163

175 LNS LNS L2TP local-name name name LNS 1 31 LNS L2TP no no local-name AVP L2TP AVP attribute value pair L2TP AVP AVP L2TP AVP AVP avp-hidden AVP no vp-hidden a AVP L2TP tunnel-receive-window window-size window-size L2TP no no tunnel-receive-window L2TP allow-multi-logon no -multi-logon allow IP IP LNS IP IP IP L2TP IP 164

176 IP a ccept-client-ip IP no accept-client-ip L2TP L2TP L2TP transmit-retry times times L2TP no no transmit-retry IPSec L2TP over IPSec IPSec L2TP L2TP L2TP IPSec next-tunnel ipsec tunnel-name tunnel-name IPSec VPN L2TP no IPSec no next-tunnel ipsec L2TP L2TP L2TP L2TP L2TP L2TP LNS VR L2TP L2TP L2TP VPN VR LNS L2TP L2TP tunnel l2tp tunnel-name [bind-to-domain domain-name] tunnel-name L2TP bind-to-domain domain-name L2TP domain name L2TP 165

177 LNS no L2TP no tunnel l2tp tunnel-name no tunnel l2tp tunnel-name bind-to-domain domain-name L2TP LNS exec l2tp tunnel-name kickout user user-name tunnel-name L2TP user-name clear l2tp tunnel-name tunnel-name L2TP L2TP show L2TP L2TP show tunnel l2tp [l2tp-tunnel-name] L2TP show l2tp tunnel l2tp-tunnel-name L2TP show l2tp client {tunnel-name l2tp-tunnel-name [user user-name] tunnel-id ID} L2TP show l2tp pool [pool-name] L2TP show l2tp pool pool-name statistics L2TP show auth-user l2tp [interface interface-name vrouter vrouter-name slot slot-no] L2TP L2TP Hillstone LNS L2TP 166

178 L2TP Windows 2000/2003/XP/Vista L2TP Windows 2000/2003/XP/Vista Windows L2TP LNS Hillstone Secure Defender L2TP L2TP L2TP VPN 54 L2TP LNS L2TP LNS Hillstone hostname(config)# interface ethernet0/1 hostname(config-if-eth0/1)# zone untrust hostname(config-if-eth0/1)# ip address /24 hostname(config-if-eth0/1)# exit 167

179 hostname(config)# interface ethernet0/2 hostname(config-if-eth0/2)# zone trust hostname(config-if-eth0/2)# ip address /24 hostname(config-if-eth0/2)# exit hostname(config)# AAA hostname(config)# aaa-server local hostname(config-aaa-server)# user shanghai hostname(config-user)# password hostname(config-user)# exit hostname(config-aaa-server)# exit hostname(config)# LNS IP hostname(config)# l2tp pool pool1 hostname(config-l2tp-pool)# address hostname(config-l2tp-pool)# exit hostname(config)# L2TP hostname(config)# tunnel l2tp test hostname(config-tunnel-l2tp)# pool pool1 hostname(config-tunnel-l2tp)# dns hostname(config-tunnel-l2tp)# interface ethernet0/1 hostname(config-tunnel-l2tp)# ppp-auth any hostname(config-tunnel-l2tp)# keepalive 1800 hostname(config-tunnel-l2tp)# aaa-server local hostname(config-tunnel-l2tp)# exit hostname(config)# L2TP test hostname(config)# interface tunnel1 hostname(config-if-tun1)# zone untrust hostname(config-if-tun1)# ip address hostname(config-if-tun1)# manage ping hostname(config-if-tun1)# tunnel l2tp test hostname(config-if-tun1)# exit hostname(config)# hostname(config)# policy-global hostname(config-policy)# rule hostname(config-policy-rule)# src-zone untrust hostname(config-policy-rule)# dst-zone trust hostname(config-policy-rule)# src-addr any hostname(config-policy-rule)# dst-addr any hostname(config-policy-rule)# service any hostname(config-policy-rule)# action permit hostname(config-policy-rule)# exit hostname(config-policy)# exit hostname(config)# 168

180 Windows XP L2TP 1. L2TP IPSec L2TP Windows XP L2TP 1. Internet L2TP IP LNS IP L2TP L2TP 1. L2TP 55 L2TP 169

181 2. L2TP 3. L2TP 4. CHAP 170

182 56 5. L2TP VPN L2TP IP Internet TCP/IP 171

183 57 L2TP 6. Windows XP L2TP IPSec Windows XP IPSec L2TP 1. Regedt32 2. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\Paramet ers 3. Parameters DWORD Parameters DWORD ProhibitIPSec REG_DWORD 1 172

184 58 4. LNS LNS LNS VPN LNS L2TP shanghai

185 59 L2TP Web FTP MS-DOS ipconfig LNS LNS PC IP L2TP over IPSec L2TP over IPSec L2TP VPN Web PC LNS IPSec 174

186 60 L2TP over IPSec LNS L2TP LNS Hillstone hostname(config)# interface ethernet0/2 hostname(config-if-eth0/2)# zone trust hostname(config-if-eth0/2)# ip address /24 hostname(config-if-eth0/2)# exit hostname(config)# interface ethernet0/3 hostname(config-if-eth0/3)# zone untrust hostname(config-if-eth0/3)# ip address /24 hostname(config-if-eth0/3)# exit hostname(config)# IPSec VPN hostname(config)# isakmp proposal p1 hostname(config-isakmp-proposal)# authentication pre-share hostname(config-isakmp-proposal)# hash sha hostname(config-isakmp-proposal)# exit hostname(config)# ipsec proposal p2 hostname(config-ipsec-proposal)# protocol esp hostname(config-ipsec-proposal)# hash sha hostname(config-ipsec-proposal)# encryption 3des hostname(config-ipsec-proposal)# exit hostname(config)# isakmp peer east hostname(config-isakmp-peer)# interface ethernet0/3 hostname(config-isakmp-peer)# type usergroup hostname(config-isakmp-peer)# accept-all-peer-id hostname(config-isakmp-peer)# mode main hostname(config-isakmp-peer)# isakmp-proposal p1 hostname(config-isakmp-peer)# pre-share hello1 hostname(config-isakmp-peer)# aaa-server local hostname(config)# tunnel ipsec vpn1 auto hostname(config-tunnel-ipsec-auto)# mode transport hostname(config-tunnel-ipsec-auto)# isakmp-peer east 175