CLI: Example for Configuring Mobile Office Users Accessing the Enterprise Intranet Using the SecoClient Through the L2TP over IPSec VPN Tunnel (Using USB Key Digital Signature Certificate Authentication)

Procedure

1. Configure basic data of the FW.
   1. Configure IP addresses for interfaces.

      # Configure an IP address for GigabitEthernet 1/0/1.

      <sysname> system-view
      [sysname] sysname FW
      [FW] interface GigabitEthernet1/0/1
      [FW-GigabitEthernet1/0/1] ip address 1.1.1.1 24
      [FW-GigabitEthernet1/0/1] quit

      # Configure an IP address for GigabitEthernet 1/0/2.

      [FW] interface GigabitEthernet1/0/2
      [FW-GigabitEthernet1/0/2] ip address 10.1.1.1 24
      [FW-GigabitEthernet1/0/2] quit

   2. Assign interfaces to security zones.

      # Assign GigabitEthernet 1/0/2 to the Trust zone.

      [FW] firewall zone trust
      [FW-zone-trust] add interface GigabitEthernet1/0/2
      [FW-zone-trust] quit

      # Assign GigabitEthernet 1/0/1 to the Untrust zone.

      [FW] firewall zone untrust
      [FW-zone-untrust] add interface GigabitEthernet1/0/1
      [FW-zone-untrust] quit

   3. Configure interzone security policies.

      # Configure an Untrust -> Local policy to allow mobile office users to establish an IPSec tunnel to the headquarters.

      [FW] security-policy
      [FW-policy-security] rule name l2tpipsec_ul
      [FW-policy-security-rule-l2tpipsec_ul] source-zone untrust
      [FW-policy-security-rule-l2tpipsec_ul] destination-zone local
      [FW-policy-security-rule-l2tpipsec_ul] destination-address 1.1.1.1 24
      [FW-policy-security-rule-l2tpipsec_ul] action permit
      [FW-policy-security-rule-l2tpipsec_ul] quit

      # Configure a Trust -> Untrust policy to allow the headquarters to initiate access to mobile office users.

      [FW-policy-security] rule name l2tpipsec_tu
      [FW-policy-security-rule-l2tpipsec_tu] source-zone trust
      [FW-policy-security-rule-l2tpipsec_tu] destination-zone untrust
      [FW-policy-security-rule-l2tpipsec_tu] source-address 10.1.2.0 24
      [FW-policy-security-rule-l2tpipsec_tu] destination-address range 172.16.1.1 172.16.1.100
      [FW-policy-security-rule-l2tpipsec_tu] action permit
      [FW-policy-security-rule-l2tpipsec_tu] quit

      # Configure an Untrust -> Trust policy to allow mobile office users to initiate access to the headquarters.

      [FW-policy-security] rule name l2tpipsec_ut
      [FW-policy-security-rule-l2tpipsec_ut] source-zone untrust
      [FW-policy-security-rule-l2tpipsec_ut] destination-zone trust
      [FW-policy-security-rule-l2tpipsec_ut] source-address range 172.16.1.1 172.16.1.100
      [FW-policy-security-rule-l2tpipsec_ut] destination-address 10.1.2.0 24
      [FW-policy-security-rule-l2tpipsec_ut] action permit
      [FW-policy-security-rule-l2tpipsec_ut] quit
      [FW-policy-security] quit

   4. Configure a route to the Internet.

      In the example, the next-hop IP address from the FW to the Internet is 1.1.1.2.

      [FW] ip route-static 0.0.0.0 0.0.0.0 1.1.1.2

2. Apply for certificates in online mode for the FW using SCEP.

   1. Create a 2048-bit RSA key pair rsa_scep, and set it to be exportable from the device.

      [FW] pki rsa local-key-pair create rsa_scep exportable 
       Info: The name of the new key-pair will be: rsa_scep  
       The size of the public key ranges from 2048 to 4096.  
       Input the bits in the modules:2048 
       Generating key-pairs...  
      ..................+++ 
      .+++   

   2. Configure entity information.

      [FW] pki entity user01 
      [FW-pki-entity-user01] common-name devicea 
      [FW-pki-entity-user01] country cn 
      [FW-pki-entity-user01] email test@user.com 
      [FW-pki-entity-user01] fqdn test.abc.com 
      [FW-pki-entity-user01] ip-address 1.1.1.1 
      [FW-pki-entity-user01] state beijing 
      [FW-pki-entity-user01] organization huawei 
      [FW-pki-entity-user01] organization-unit dev 
      [FW-pki-entity-user01] quit

   3. Apply for certificates in online mode using SCEP, and update the certificates.

      The fingerprint information of the CA certificate is obtained from the CA server. In the example, the CA server (IP address: 10.10.10.10) uses Windows Server 2008. Assume that the CA server uses the challenge password to process certificate application and the challenge password is 6AE73F21E6D3571D. The challenge password and fingerprint can be obtained at http://10.10.10.10:8080/certsrv/mscep_admin. The fingerprint information of the CA certificate is 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 in SHA1 mode and the URL at which the certificate is obtained is http://10.10.10.10:8080/certsrv/mscep/mscep.dll.

      [FW] pki realm usbkeyclient 
      # Configure a trusted CA. 
      [FW-pki-realm-usbkeyclient] ca id ca_root 
      # Bind an entity.  
      [FW-pki-realm-usbkeyclient] entity user01 
      # Configure the fingerprint of the CA certificate. In the example, the CA certificate fingerprint is 6330974fb2fe3c52d16bdac40140918b4bcd3ec7.
      [FW-pki-realm-usbkeyclient] fingerprint sha1 6330974fb2fe3c52d16bdac40140918b4bcd3ec7 
      # Configure the URL of the CA for certificate application. 
      [FW-pki-realm-usbkeyclient] enrollment-url http://10.10.10.10:8080/certsrv/mscep/mscep.dll ra 
      # Specify the RSA key pair for certificate application. 
      [FW-pki-realm-usbkeyclient] rsa local-key-pair rsa_scep 
      # Specify the challenge password. In the example, the challenge password is 6AE73F21E6D3571D.  
      [FW-pki-realm-usbkeyclient] password cipher 6AE73F21E6D3571D 
      [FW-pki-realm-usbkeyclient] quit 
      # Obtain the CA certificate and save it to the local computer.  
      [FW] pki get-certificate ca realm usbkeyclient

      The obtained CA certificate is named usbkeyclient_ca.cer and saved in the device storage.

      # Import the CA certificate to the memory.

      [FW_A] pki import-certificate ca filename usbkeyclient_ca.cer
       The CA's Subject is /CN=ca_root  
       The CA's fingerprint is: 
         MD5  fingerprint:1135 25D8 96D3 5936 C382 35EA 2CEE 80EB 
         SHA1 fingerprint:6330 974F B2FE 3C52 D16B DAC4 0140 918B 4BCD 3EC7 
       Is the fingerprint correct?(Y/N):y 
       Info: Succeeded in importing file.

      The device automatically obtains the local certificate usbkeyclient_local.cer and has it installed automatically.

3. Configure an L2TP access user and an authentication policy on the FW.
   1. Configure an address pool.

      [FW] ip pool pool0
      [FW-ip-pool-pool0] section 0 172.16.1.1 172.16.1.100
      [FW-ip-pool-pool0] quit

      If the address pool addresses and headquarters addresses reside on the same subnet, you must enable the ARP proxy function on the LNS interface connecting to the headquarters to ensure that the LNS can respond to the ARP requests from the servers at the headquarters.

   2. Configure an authentication scheme.

      [FW] aaa
      [FW-aaa] authentication-scheme scheme0
      [FW-aaa-authen-scheme0] authentication-mode local
      [FW-aaa-authen-scheme0] quit

   3. Configure a service scheme for access users.

      [FW-aaa] service-scheme l2tp
      [FW-aaa-service-l2tp] ip-pool pool0
      [FW-aaa-service-l2tp] quit

   4. Configure an authentication domain and reference the authentication scheme and the service scheme for access users.

      [FW-aaa] domain domain0
      [FW-aaa-domain-domain0] service-type l2tp
      [FW-aaa-domain-domain0] authentication-scheme scheme0
      [FW-aaa-domain-domain0] service-scheme l2tp
      [FW-aaa-domain-domain0] quit
      [FW-aaa] quit

   5. Configure a group and a user for the mobile office user.

      [FW] user-manage user user0001 domain domain0
      [FW-localuser-user0001@domain0] password Password@123
      [FW-localuser-user0001@domain0] quit

4. Configure L2TP on the FW.
   1. Enable the L2TP function.

      [FW] l2tp enable

   2. Configure the Virtual-Template interface.

      [FW] interface Virtual-Template 0
      [FW-Virtual-Template0] ppp authentication-mode pap
      [FW-Virtual-Template0] remote service-scheme l2tp
      [FW-Virtual-Template0] ip address 172.16.1.101 24
      [FW-Virtual-Template0] quit

      • The IP address of the Virtual-Template interface cannot overlap the address pool or replicate the IP addresses of other interfaces. You can set any IP address except the mentioned ones.
      • The service scheme for assigning IP addresses for the remote peers must be the same as the service scheme configured in the AAA domain. Otherwise, the LNS cannot assign addresses for clients.
      • A Virtual-Template interface can join any security zone. After you assign the Virtual-Template interface to a security zone, enable the security policy between the security zone of the Virtual-Template interface and the security zone of the headquarters network to permit the interzone traffic. You also need to enable the security policy between the Local zone and the security zone of the physical interface that the FW uses to send and receive L2TP tunnel packets to permit the traffic between the two zones.
   3. Add the Virtual-Template interface to the Untrust zone.

      [FW] firewall zone untrust
      [FW-zone-untrust] add interface Virtual-Template 0
      [FW-zone-untrust] quit

   4. Create an L2TP group, bind the Virtual-Template interface to the group, and configure the tunnel authentication function.

      [FW] l2tp-group l2tp-lns
      [FW-l2tp-l2tp-lns] allow l2tp virtual-template 0
      [FW-l2tp-l2tp-lns] tunnel authentication
      [FW-l2tp-l2tp-lns] tunnel password cipher Hello@123
      [FW-l2tp-l2tp-lns] quit

5. Configure an IPSec policy on the FW and apply it to the interface.
   1. Create advanced ACL 3000.

      [FW] acl 3000
      [FW_acl-adv-3000] rule 5 permit udp source-port eq 1701
      [FW_acl-adv-3000] quit

      During L2TP over IPSec encapsulation, L2TP encapsulation occurs before IPSec encapsulation. Therefore, the matching condition is L2TP port (port 1701). All L2TP packets are transmitted through the IPSec tunnel.

   2. Configure IPSec proposal prop0.

      [FW] ipsec proposal prop0
      [FW-ipsec-proposal-prop0] encapsulation-mode auto
      [FW-ipsec-proposal-prop0] transform esp
      [FW-ipsec-proposal-prop0] esp authentication-algorithm sha2-256
      [FW-ipsec-proposal-prop0] esp encryption-algorithm aes-256
      [FW-ipsec-proposal-prop0] quit

   3. Configure an IKE proposal.

      [FW] ike proposal 10
      [FW-ike-proposal-10] authentication-method rsa-signature
      [FW-ike-proposal-10] authentication-algorithm sha2-256
      [FW-ike-proposal-10] encryption-algorithm aes-256
      [FW-ike-proposal-10] dh group5
      [FW-ike-proposal-10] quit

   4. Configure an IKE peer.

      [FW] ike peer peer0
      [FW-ike-peer-peer0] ike-proposal 10
      [FW-ike-peer-peer0] exchange-mode auto
      [FW-ike-peer-peer0] local-id-type dn
      [FW-ike-peer-peer0] resource acl 3000
      [FW-ike-peer-peer0] certificate local-filename usbkeyclient_local.cer
      [FW-ike-peer-peer0] quit

      The resource acl command sets the ACL information that the headquarters gateway pushes to the mobile office user. After IKE SA phase 1 is established between the headquarters and mobile office user, the headquarters pushes the ACL information to the user upon the receipt of an ACL request from the user. The ACL restricts the access scope. Only the traffic destined for the IP addresses specified in the ACL can pass through the IPSec tunnel.

   5. Configure a template IPSec policy.

      [FW] ipsec policy-template policy_temp0 1
      [FW-ipsec-policy-template-policy_temp0-1] security acl 3000
      [FW-ipsec-policy-template-policy_temp0-1] proposal prop0
      [FW-ipsec-policy-template-policy_temp0-1] ike-peer peer0
      [FW-ipsec-policy-template-policy_temp0-1] quit
      [FW] ipsec policy ipsec_policy0 10 isakmp template policy_temp0

   6. Apply IPSec policy ipsec_policy0 to GigabitEthernet 1/0/1.

      [FW] interface GigabitEthernet1/0/1
      [FW-GigabitEthernet1/0/1] ipsec policy ipsec_policy0
      [FW-GigabitEthernet1/0/1] quit
      [FW] quit

6. Configure a route for the traffic from the headquarters gateway to the L2TP address pool.

   The headquarters gateway can communicate with mobile office users only when it has a route to the L2TP address pool. The next hop of the route must be the address of the LAN interface on the FW.

7. Configure the SecoClient at the mobile office user side.
   1. Download the CA certificate from the PC, and apply for and install the user (client) certificate.
   2. Export the user (client) certificate in .pfx format from the PC, insert the USB key, and import the certificate into the USB key.

      For details about how to import and install a certificate in the USB key, see the related guide of the USB key.

   3. Start the SecoClient. The main window is displayed.

      Select New Connection from the Connect drop-down list.

   4. Set L2TP VPN connection parameters.

      In the New Connection dialog box, select L2TP/IPSec from the left navigation tree and set connection parameters.

   5. Configure IPSec.

8. Log in to the L2TP over IPSec VPN gateway.
   1. Insert the USB key into the USB port of the terminal.
   2. Select the created L2TP over IPSec VPN connection from the Connect drop-down list, and click Connect.

   3. In the login dialog box, enter the user name and password, and select the identified USB key certificate.

   4. Click Login to initiate a VPN connection.

      If the VPN connection is successful, a message is displayed in the lower right corner of the page.

      After the connection is set up, mobile office users can access intranet resources as enterprise intranet users.