srx dynamic vpn 配置

《srx dynamic vpn 配置》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、SRXdynamicvpn配置方法拓扑如下在这个案例中，Xauth客户端认证被本地执行，客户端的ip地址是由SRX上配置的地址池进行分配。然后标准转换集用来IKE和ipsec的协商。对于dynamicvpntunnel来说，积极模式是必须被配置的，并且第一阶段认证只支持与共享密钥。这个例子中设置连接的最大数量是10个。因为dynamicvpn必须基于策略的vpn，所以必须配置一个安全策略通过tunnel去转发流量。最后，这个为远程客户端配置的Xauth概述被应用于dynamicvpn。远程用户与配置的ipsecvpn有关。一

2、配置ip地址池setaccessaddress-assignmentpooldyn-vpn-address-poolfamilyinetnetwork10.10.10.0/24setaccessaddress-assignmentpooldyn-vpn-address-poolfamilyinetxauth-attributesprimary-dns202.96.64.68/32二配置xauthprofilesetaccessprofiledyn-vpn-access-profileclientclient1firewall

3、-userpassword"$9$HmPQ0ORhSeTz1hcy8LZUD"（client1，client1）setaccessprofiledyn-vpn-access-profileclientclient2firewall-userpassword"$9$yp6KvLg4ZUjq8XaUDi5TRhc"（client2，client2）setaccessprofiledyn-vpn-access-profileaddress-assignmentpooldyn-vpn-address-pool（地址池）三配置web认

4、证用xauthprofilesetaccessfirewall-authenticationweb-authenticationdefault-profiledyn-vpn-access-profile然后是配置vpntunnel四配置IKEpolicysetsecurityikepolicyike-dyn-vpn-policymodeaggressivesetsecurityikepolicyike-dyn-vpn-policyproposal-setstandard（standard就可以，不用自定义）setsecuri

5、tyikepolicyike-dyn-vpn-policypre-shared-keyascii-text"$9$1oJREyeK87NblegoGUHk"（与共享密钥abc123）五配置IKEgatewaysetsecurityikegatewaydyn-vpn-local-gwike-policyike-dyn-vpn-policysetsecurityikegatewaydyn-vpn-local-gwdynamichostnamedynvpnsetsecurityikegatewaydyn-vpn-local-gwd

6、ynamicconnections-limit10setsecurityikegatewaydyn-vpn-local-gwdynamicike-user-typeshared-ike-idsetsecurityikegatewaydyn-vpn-local-gwexternal-interfacege-0/0/0.0（对外接口）setsecurityikegatewaydyn-vpn-local-gwxauthaccess-profiledyn-vpn-access-profile（也调用xauthprofile）六配置i

7、psec（第二阶段转换集）setsecurityipsecpolicyipsec-dyn-vpn-policyproposal-setstandard（采用系统standard）setsecurityipsecvpndyn-vpnikegatewaydyn-vpn-local-gwsetsecurityipsecvpndyn-vpnikeipsec-policyipsec-dyn-vpn-policy（引用ipsecpolicy）七配置securitypolicysetsecuritypoliciesfrom-zoneunt

8、rustto-zonetrustpolicydyn-vpn-policymatchsource-addressanysetsecuritypoliciesfrom-zoneuntrustto-zonetrustpolicydyn-vpn-policymatchdestination-add