CLI: Example for Connecting a Mobile Office User to the Headquarters VPN Through a ShrewSoft VPN Client in IKEv1+xAuth Mode
Networking Requirements
As shown in Figure 3-39, a PC connects to the enterprise headquarters over the Internet. An IPSec tunnel needs to be established between the PC and headquarters for encrypted data transmission between them. The enterprise headquarters wants to verify the identities of mobile office users to improve intranet access security.
IKEv1+xAuth can be configured on the headquarters gateway to achieve these purposes.
Data Plan
Item |
Data |
|---|---|
FW |
Interface number: GigabitEthernet 1/0/1 IP address: 1.1.1.2/24 Security zone: Untrust |
Interface number: GigabitEthernet 1/0/2 IP address: 10.1.1.1/24 Security zone: Trust |
|
Address pool and AAA configuration IP pool 1 Address range: 10.2.1.2 to 10.2.1.100 RADIUS server IP address: 10.1.1.5 RADIUS server authentication password: huawei@12 |
|
IPSec configuration IPSec policy type: IPSec policy template Security protocol: ESP ESP authentication algorithm: SHA2-256 ESP encryption algorithm: AES-128 IKE authentication algorithm: SHA2-256 IKE encryption algorithm: AES-256 IKE negotiation mode: aggressive mode Pre-shared key: huawei@123 Local ID type: IP Peer ID type: any |
|
PC |
Internet address: 2.1.1.2/24 User name: huawei User password: Hello@123 Pre-shared key: huawei@123 |
Configuration Roadmap
- Complete basic configurations, including the interfaces, security policies, and routes on the FW.
- Complete the IPSec configuration on the FW.
- Complete the IPSec configuration on the PC. The IPSec parameters on the PC must match those on the FW.
Procedure
- Configure the FW.
- Configure inter-zone security policies.
# Configure a security policy to allow headquarters users to actively initiate access to the PC users.
[FW] security-policy [FW-policy-security] rule name policy1 [FW-policy-security-rule-policy1] source-zone trust [FW-policy-security-rule-policy1] destination-zone untrust [FW-policy-security-rule-policy1] source-address 10.1.1.0 24 [FW-policy-security-rule-policy1] destination-address 10.2.1.0 24 [FW-policy-security-rule-policy1] action permit [FW-policy-security-rule-policy1] quit
# Configure a security policy to allow PC users to actively initiate access to the headquarters users.
[FW-policy-security] rule name policy2 [FW-policy-security-rule-policy2] source-zone untrust [FW-policy-security-rule-policy2] destination-zone trust [FW-policy-security-rule-policy2] destination-address 10.1.1.0 24 [FW-policy-security-rule-policy2] action permit [FW-policy-security-rule-policy2] quit
# Configure security policies to allow the PC and headquarters to negotiate an IPSec tunnel.
The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP and port 500 for UDP (port 4500 also in NAT traversal scenarios).
[FW-policy-security] rule name policy3 [FW-policy-security-rule-policy3] source-zone local [FW-policy-security-rule-policy3] destination-zone untrust [FW-policy-security-rule-policy3] source-address 1.1.1.2 32 [FW-policy-security-rule-policy3] action permit [FW-policy-security-rule-policy3] quit
[FW-policy-security] rule name policy4 [FW-policy-security-rule-policy4] source-zone untrust [FW-policy-security-rule-policy4] destination-zone local [FW-policy-security-rule-policy4] destination-address 1.1.1.2 32 [FW-policy-security-rule-policy4] action permit [FW-policy-security-rule-policy4] quit [FW-policy-security] quit
- Configure inter-zone security policies.
- Configure the ShrewSoft VPN client on the PC.
- Open the ShrewSoft VPN client (VPN Access Manager) and click Add.
- On the General tab, configure the public network interface address of the peer, select Obtain Automatically, and retain the default values for the other options.
- On the Client tab, retain the default values for all options.
- On the Name Resolution tab, retain the default values for all options.
- On the Authentication tab, set Authentication Method to Mutual PSK + XAuth.
- On the Local Identity tab, set Identification Type to IP Address and retain the default values for all the other options.
- On the Remote Identity tab, retain the default values for all options.
- On the Credentials tab, set Pre Shared Key to huawei@123 and retain the default values for all the other options.
- On the Phase 1 tab, set parameters for phase 1 IKE SA negotiation.
- On the Phase 2 tab, set parameters for phase 2 IPSec SA negotiation.
- On the Policy tab, retain the default values for all options.
- Click Save and change the name to IPSec.
- Open the ShrewSoft VPN client (VPN Access Manager) and click Add.
- Verify the configuration.
- Open VPN Access Manager, select IPSec, and click Connect.
Enter the user name and password and click Connect.
After successful connection, you can find that the PC is allocated an IP address in the 10.2.1.2/24 to 10.2.1.100/24 segment, and it can normally access the headquarters gateway.
- Open VPN Access Manager, select IPSec, and click Connect.
Configuration Script
# sysname FW # radius-server template temp1 radius-server shared-key cipher huawei@12 radius-server authentication 10.1.1.5 1812 weight 80 undo radius-server user-name domain-included radius-server group-filter class # acl number 3001 rule 5 permit ip destination 10.2.1.0 0.0.0.255 # ipsec proposal tran1 encapsulation-mode tunnel transform esp esp authentication-algorithm sha2-256 esp encryption-algorithm aes-128 # ike proposal 1 encryption-algorithm aes-256 dh group5 authentication-algorithm sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # ike peer peer1 xauth type chap undo version 2 exchange-mode aggressive pre-shared-key huawei@123 ike-proposal 1 xauth enable # ipsec policy-template policy_temp 1 security acl 3001 ike-peer peer1 proposal tran1 # ipsec policy policy 10 isakmp template policy_temp # ip pool pool1 network 10.2.1.0 mask 255.255.255.0 section 1 10.2.1.2 10.2.1.100 # aaa authentication-scheme xauth authentication-mode radius service-scheme serv1 ip-pool pool1 domain xauth authentication-scheme xauth service-scheme serv1 radius-server temp1 service-type internetaccess ike internet-access mode password reference user current-domain new-user add-temporary group /xauth # interface GigabitEthernet1/0/1 undo shutdown ip address 1.1.1.2 255.255.255.0 ipsec policy policy # interface GigabitEthernet1/0/2 undo shutdown ip address 10.1.1.1 255.255.255.0 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/2 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/1 # ip route-static 2.1.1.0 255.255.255.0 1.1.1.1 ip route-static 10.2.1.0 255.255.255.0 1.1.1.1 # security-policy rule name policy1 source-zone trust destination-zone untrust source-address 10.1.1.0 mask 255.255.255.0 destination-address 10.2.1.0 mask 255.255.255.0 action permit rule name policy2 source-zone untrust destination-zone trust destination-address 10.1.1.0 mask 255.255.255.0 action permit rule name policy3 source-zone local destination-zone untrust source-address 1.1.1.2 mask 255.255.255.255 action permit rule name policy4 source-zone untrust destination-zone local destination-address 1.1.1.2 mask 255.255.255.255 action permit # return