# Setting up a Policy-Based VPN Tunnel

1. Bind interfaces to zones and assign them IP addresses:
set interface ethernet1 zone trust
set interface ethernet1 ip 10.1.1.1/24
set interface ethernet3 zone untrust
set interface ethernet3 ip 1.1.1.1/24
2. Set the addresses for the end entities beyond the two ends of the VPN tunnel:
set address trust host1 10.1.1.5/32
set address untrust host2 10.2.2.5/32
3. Define the IKE Phase 1 proposal and Phase 2 proposal. If you use the default proposals, you do not need to
define Phase 1 and Phase 2 proposals.
4. Define the remote gateway:
set ike gateway gw1 address 2.2.2.2 main outgoing-interface ethernet3 preshare
netscreen proposal pre-g2-3des-sha
5. Define the VPN tunnel as AutoKey IKE:
set vpn vpn1 gateway gw1 proposal g2-esp-des-md5
6. Set a default route (both the Trust and Untrust zones are in the trust-vr routing domain):
set vrouter trust-vr route 0.0.0.0/0 interface ethernet3 gateway 1.1.1.250
7. Set outbound and inbound policies:
set policy from trust to untrust host1 host2 any tunnel vpn vpn1
set policy from untrust to trust host2 host1 any tunnel vpn vpn1
The procedure for setting up a VPN tunnel for a dialup user with IKE also constitutes up to seven steps.
1. Bind interfaces to zones and assign them IP addresses.
2. Define the protected address that you want the dialup user to be able to access through the tunnel. (See the
set address command.)
3. Define the user as an IKE user. (See the set user command.)
4. Define the IKE Phase 1 proposal, Phase 2 proposal, and remote gateway. (Note: If you use the default
proposals, you do not need to define a Phase 1 or Phase 2 proposal.)
5. Define the VPN tunnel as AutoKey IKE. (See the set vpn command.)
6. Set a default route (both the Trust and Untrust zones are in the trust-vr routing domain).
7. Define an incoming policy, with Dial-Up VPN as the source address and the VPN tunnel you configured in
step 5.

저작자 표시 비영리 변경 금지
신고

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

저작자 표시 비영리 변경 금지
신고

정원엔시스템에서 2008년 버전의 메뉴얼입니다.


방화벽-VPN_UTM운영자메뉴얼.pdf

저작자 표시 비영리 변경 금지
신고

지난번 전원 작업으로 인해 내렸다 올렸을때 속을 썩이던 방화벽...
그래도 오늘은 기특하게 잘 올라와 줬다...
기다림의 연속이었던 작업...
피곤하다...
저작자 표시
신고


티스토리 툴바