Thông tin tài liệu
&KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V In the following examples, the preshared key is h1p8A24nG5. It is assumed that both participants already have RSA certificates and are using Entrust as the certificate authority (CA). (For information about obtaining and loading certificates, see “Certificates and CRLs” on page 29.) :HE8,7RN\R 1. VPNs > AutoKey Advanced > Gateway > New: Enter the following, and then click OK: Gateway Name: To_Paris Security Level: Custom Remote Gateway Type: Static IP Address: (select), IP Address: 203.3.3.10 (Preshared Key) Preshared Key: h1p8A24nG5 Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Note: The full AutoKey IKE configuration also involves the following procedures: • Defining security zone interface IP addresses • Creating an unnumbered tunnel interface • Making address book entries for the local and remote end entities • Setting up routes • Configuring policies However, because these steps are the same as those explained in “Example: Routing-Based LAN-to-LAN VPN, Manual Key” on page 59, they are omitted here. &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V Security Level: Custom Phase 1 Proposal (for Custom Security Level): pre-g2-3des-sha Mode (Initiator): Main (ID Protection) (Certificates) Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Security Level: Custom Phase 1 Proposal (for Custom Security Level): rsa-g2-3des-sha Preferred certificate (optional) Peer CA: Entrust Peer Type: X509-SIG 2. VPNs > AutoKey IKE > New: Enter the following, and then click OK: VPN Name: Tokyo_Paris Security Level: Compatible Remote Gateway: Predefined (select), To_Paris > Advanced: Enter the following advanced settings, and then click Return to return to the basic AutoKey IKE configuration page: Security Level: Compatible Bind to Tunnel Interface: (select), tunnel.1 Proxy-ID: (select) Local IP/Netmask: 192.168.10.0/24 Remote IP/Netmask: 172.16.5.0/24 Service: ANY &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V :HE8,3DULV 1. VPNs > AutoKey Advanced > Gateway > New: Enter the following, and then click OK: Gateway Name: To_Tokyo Security Level: Custom Remote Gateway Type: Static IP Address: (select), IP Address: 201.22.3.14 (Preshared Key) Preshared Key: h1p8A24nG5 Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Security Level: Custom Phase 1 Proposal (For Custom Security Level): pre-g2-3des-sha Mode (Initiator): Main (ID Protection) (Certificates) Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Security Level: Custom Phase 1 Proposal (for Custom Security Level): rsa-g2-3des-sha Preferred certificate (optional) Peer CA: Entrust Peer Type: X509-SIG &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V 2. VPNs > AutoKey IKE > New: Enter the following, and then click OK: Name: Paris_Tokyo Security Level: Custom Remote Gateway: Predefined (select), To_Tokyo > Advanced: Enter the following advanced settings, and then click Return to return to the basic AutoKey IKE configuration page: Security Level: Compatible Bind to Tunnel Interface: (select), tunnel.1 Proxy-ID: (select) Local IP/Netmask: 172.16.5.0/24 Remote IP/Netmask: 192.168.10.0/24 Service: ANY &/,7RN\R 3UHVKDUHG.H\ 1. set ike gateway to_paris ip 203.3.3.10 main outgoing-interface ethernet3 preshare h1p8A24nG5 proposal pre-g2-3des-sha 2. set vpn tokyo_paris gateway to_paris sec-level compatible 3. set vpn tokyo_paris bind interface tunnel.1 4. set vpn tokyo_paris proxy-id local-ip 192.168.10.0/24 remote-ip 172.16.5.0/24 any 5. save &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V &HUWLILFDWH 1. set ike gateway to_paris ip 203.3.3.10 main outgoing-interface ethernet3 proposal rsa-g2-3des-sha 2. set ike gateway to_paris cert peer-ca 1 7 3. set ike gateway to_paris cert peer-cert-type x509-sig 4. set vpn tokyo_paris gateway to_paris sec-level compatible 5. set vpn tokyo_paris bind interface tunnel.1 6. set vpn tokyo_paris proxy-id local-ip 192.168.10.0/24 remote-ip 172.16.5.0/24 any 7. save &/,3DULV 3UHVKDUHG.H\ 1. set ike gateway to_tokyo ip 201.22.3.14 main outgoing-interface ethernet3 preshare h1p8A24nG5 proposal pre-g2-3des-sha 2. set vpn paris_tokyo gateway to_tokyo sec-level compatible 3. set vpn paris_tokyo bind interface tunnel.1 4. set vpn paris_tokyo proxy-id local-ip 172.16.5.0/24 remote-ip 192.168.10.0/24 any 5. save &HUWLILFDWH 1. set ike gateway to_tokyo ip 201.22.3.14 main outgoing-interface ethernet3 proposal rsa-g2-3des-sha 2. set ike gateway to_tokyo cert peer-ca 1 7 3. set ike gateway to_tokyo cert peer-cert-type x509-sig 4. set vpn paris_tokyo gateway to_tokyo sec-level compatible 5. set vpn paris_tokyo bind interface tunnel.1 6. set vpn paris_tokyo proxy-id local-ip 172.16.5.0/24 remote-ip 192.168.10.0/24 any 7. save 7. The number 1 is the CA ID number. To discover the CA’s ID number, use the following command: get pki x509 list ca-cert. &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V ([DPSOH5RXWLQJ%DVHG/$1WR/$1931'\QDPLF3HHU In this example, a VPN tunnel securely connects the users in the Trust zone behind NetScreen A to the mail server in the corporate DMZ zone, protected by NetScreen B. The Untrust zone interface for NetScreen B has a static IP address. The ISP serving NetScreen A assigns the IP address for its Untrust zone interface dynamically via DHCP. Because only NetScreen B has a fixed address for its Untrust zone, VPN traffic must originate from hosts behind NetScreen A. After NetScreen A has established the tunnel, traffic through the tunnel can originate from either end. All security and tunnel zones are in the trust-vr. Internet Mail Server 203.10.30.5 VPN Tunnel NetScreen A NetScreen B SMTP or POP3 Request IDENT Request Branch Office Trust Zone eth1, 10.10.10.1/24 Outgoing Interface Untrust Zone eth3 and gateway dynamically assigned by ISP Corporate Office DMZ Zone eth2, 203.10.30.1/24 Outgoing Interface Untrust Zone eth3, 203.10.20.1/24 Gateway 203.10.20.2 Note: Before making an SMTP or POP3 connection to the corporate mail server, Phil must first initiate an HTTP, FTP, or Telnet connection so that NetScreen A can authenticate him. DHCP Server 203.2.3.1 Tunnel Interface Tunnel.1 Tunnel Interface Tunnel.1 Topology of the zones configured on NetScreen A at the branch office. Trust Zone Untrust Zone DMZ Zone Untrust Zone AB A B Topology of the zones configured on NetScreen B at the corporate site. &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V In this example, local auth user Phil (login name: pmason; password: Nd4syst4) wants to get his e-mail from the mail server at the corporate site. When he attempts to do so, he is authenticated twice: first, NetScreen A authenticates him locally before allowing traffic from him through the tunnel 8 ; second, the mail server program authenticates him, sending the IDENT request through the tunnel. The preshared key is h1p8A24nG5. It is assumed that both participants already have RSA certificates from the certificate authority (CA) Verisign, and that the e-mail address pmason@abc.com appears in the local certificate on NetScreen A. (For information about obtaining and loading certificates, see “Certificates and CRLs” on page 29.) For the Phase 1 and 2 security levels, you specify one Phase 1 proposal—either pre-g2-3des-sha for the preshared key method or rsa-g2-3des-sha for certificates—and select the predefined “Compatible” set of proposals for Phase 2. :HE8,1HW6FUHHQ$ ,QWHUIDFHV²6HFXULW\=RQHVDQG7XQQHO 1. Network > Interfaces > Edit (for ethernet1): Enter the following, and then click OK: Zone Name: Trust IP Address/Netmask: 10.10.10.1/24 2. Network > Interfaces > Edit (for ethernet3): Enter the following, and then click Apply: Zone Name: Untrust Enter the following, and then click OK: Obtain IP using DHCP: (select) 8. Because Phil is an authentication user, before he can make an SMTP of POP3 request, he must first initiate an HTTP, FTP, or Telnet connection so that NetScreen A can respond with a firewall user/login prompt to authenticate him. After NetScreen A authenticates him, he has permission to contact the corporate mail server via the VPN tunnel. Note: The mail server can send the IDENT request through the tunnel only if the NetScreen A and B administrators add a custom service for it (TCP, port 113) and set up policies allowing that traffic through the tunnel to the 10.10.10.0/24 subnet. &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V 3. Network > Interfaces > Tunnel IF New: Enter the following, and then click OK: Tunnel Interface Name: tunnel.1 Zone: Untrust Unnumbered: (select) Interface: ethernet3(Untrust) 8VHU 4. Objects > Users > Local > New: Enter the following, and then click OK: User Name: pmason Status: Enable Authentication User: (select) User Password: Nd4syst4 Confirm Password: Nd4syst4 $GGUHVVHV 5. Objects > Addresses > List > New: Enter the following, and then click OK: Address Name: Trusted network IP Address/Domain Name: IP/Netmask:10.10.10.0/24 Zone: Trust 6. Objects > Addresses > List > New: Enter the following, and then click OK: Address Name: Mail Server IP Address/Domain Name: IP/Netmask: 203.10.30.5/32 Zone: Untrust &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V 6HUYLFHV 7. Objects > Services > Custom > New: Enter the following, and then click OK: Service Name: Ident Service Timeout: Use protocol default: (select) Transport Protocol: TCP (select) Source Port: Low 0, High 65535 Destination Port: Low 113, High 113 8. Objects > Services > Group > New: Enter the following, move the following services, and then click OK: Group Name: Remote_Mail Select the following services and use the << button to move them from the Available Members column to the Group Members column: FTP HTTP MAIL POP3 Telnet Ident 931 9. VPNs > AutoKey Advanced > Gateway > New: Enter the following, and then click OK: Gateway Name: To_Mail Security Level: Custom Remote Gateway Type: Static IP Address: (select), IP Address: 203.10.20.1 &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V (Preshared Key) Preshared Key: h1p8A24nG5 Local ID: pmason@abc.com Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Security Level: Custom Phase 1 Proposal (For Custom Security Level): pre-g2-3des-sha Mode (Initiator): Aggressive (Certificates) Local ID: pmason@abc.com Outgoing Interface: ethernet3 > Advanced: Enter the following advanced settings, and then click Return to return to the basic Gateway configuration page: Security Level: Custom Phase 1 Proposal (For Custom Security Level): rsa-g2-3des-sha Mode (Initiator): Aggressive Preferred Certificate (optional): Peer CA: Verisign Peer Type: X509-SIG [...]... following, and then click OK: User Name: pmason Status: Enable Authentication User: (select) User Password: Nd4syst4 Confirm Password: Nd4syst4 $GGUHVVHV 5 Objects > Addresses > List > New: Enter the following, and then click OK: Address Name: Trusted network IP Address/Domain Name: IP/Netmask:10.10.10.0/ 24 Zone: Trust 6 Objects > Addresses > List > New: Enter the following, and then click OK: Address Name:... 7XQQHO 1 2 3 4 5 6 7 set interface ethernet1 zone trust set interface ethernet1 ip 10.10.10.1/ 24 set interface ethernet3 zone untrust set interface ethernet3 dhcp set dhcp client server 201.2.3.1 set interface tunnel.1 zone untrust set interface tunnel.1 ip unnumbered interface ethernet3 8VHU 8 set user pmason password Nd4syst4 $GGUHVVHV 9 set address trust “trusted network” 10.10.10.0/ 24 10 set address... traffic from that source After the NetScreen- Remote client establishes the tunnel, traffic through the tunnel can originate from either end All zones on the NetScreen device are in the trust-vr routing domain Outgoing Interface Untrust Zone eth3, 203.10.20.1/ 24 Gateway 203.10.20.2 Remote User: Phil NetScreen- Remote SMTP Request Corporate Office DMZ Zone eth2, 203.10.30.1/ 24 Mail Server 203.10.30.5 Internet... 23 set policy top from untrust to trust “mail server” “trusted network” remote_mail permit 24 save &/, 1HW6FUHHQ % ,QWHUIDFHV ² 6HFXULW\ =RQHV 1 2 3 4 5 6 set interface ethernet2 zone dmz set interface ethernet2 ip 203.10.30.1/ 24 set interface ethernet3 zone untrust set interface ethernet3 ip 203.10.20.1/ 24 set interface tunnel.1 zone dmz set interface tunnel.1 ip unnumbered interface ethernet2 $GGUHVVHV... 931V &KDSWHU 5RXWLQJ%DVHG 931V 'LDOXSWR/$1 931 '\QDPLF 3HHU ',$/8372/$1 931 ' Interfaces > Edit (for ethernet3): Enter the following, and then click OK: Zone Name: Untrust IP Address: 203.10.20.1/ 24 3 Network > Interfaces > Tunnel IF New: Enter the following, and then click OK: Tunnel Interface Name: tunnel.1 Zone: DMZ Unnumbered: (select) Interface: ethernet2(DMZ) $GGUHVVHV 4 Objects > Addresses > List > New: Enter the...&KDSWHU 5RXWLQJ%DVHG 931V /$1WR/$1 931V In this example, local auth user Phil (login name: pmason; password: Nd4syst4) wants to get his e-mail from the mail server at the corporate site When he attempts to do so, he is authenticated twice: first, NetScreen A authenticates him locally before allowing traffic from him through the tunnel8; second, the mail server program authenticates... Name: DMZ IP Address/Netmask: 203.10.30.1/ 24 2 Network > Interfaces > Edit (for ethernet3): Enter the following, and then click OK: Zone Name: Untrust IP Address/Netmask: 203.10.20.1/ 24 3 Network > Interfaces > Tunnel IF New: Enter the following, and then click OK : Tunnel Interface Name: tunnel.1 Zone: DMZ Unnumbered: (select) Interface: ethernet2(DMZ) $GGUHVVHV 4 Objects > Addresses > List > New: Enter . zone behind NetScreen A to the mail server in the corporate DMZ zone, protected by NetScreen B. The Untrust zone interface for NetScreen B has a static IP address. The ISP serving NetScreen A. ethernet3(Untrust) 8VHU 4. Objects > Users > Local > New: Enter the following, and then click OK: User Name: pmason Status: Enable Authentication User: (select) User Password: Nd4syst4 Confirm Password: Nd4syst4 $GGUHVVHV 5 compatible 3. set vpn tokyo_paris bind interface tunnel.1 4. set vpn tokyo_paris proxy-id local-ip 192.168.10.0/ 24 remote-ip 172.16.5.0/ 24 any 5. save &KDSWHU5RXWLQJ%DVHG931V /$1WR/$1931V 1HW6FUHHQ&RQFHSWV([DPSOHV²9ROXPH931V
Ngày đăng: 14/08/2014, 18:22
Xem thêm: netscreen concepts examples vpns phần 4 pot
