Array-AG之虚拟站点、Role配置手册

Array SPX工程安装配置手册虚拟站点配置部分一、 Array SPX工程安装配置手册1二、 虚拟站点配置部分1三、 SSL VPN门户（Virtual Site）的建立11. 增加Virtual Site12. 配置virtual site 的SSL协议及数字证书21.1 SSL 协议部分配置概述21.2 生成CSR31.3 导入virtual site 数字证书41.4 客户端数字证书验证配置61.5 Role的配置8SSL VPN门户（Virtual Site）的建立增加Virtual Site建立一个virtual site ，假设IP地址为85，Array 的SSL VPN 门户的地址可以使用设备端口地址。Base systemvirtual sitesadd上图是图形界面方式，此时需要在左上角Global Mode 为 config 状态下加入新的SSL门VPN户，即virtual site。其中：Site Name ：为站点的英文表示，取较易记忆的名字，如：enssSite FQDN：full qualified domain name，在IE等浏览器中输入的域名。如果使用域名登陆，此项输入域名，如：；如果使用IP地址登陆，此项需输入IP地址，如果需要IP和域名同时登陆，则需要同时输入域名和ip地址，格式如下IP Address：指virtual site 的IP地址。配置virtual site 的SSL协议及数字证书SSL 协议部分配置概述建议您在作此配置之前阅读一些关于PKI、数字证书、CA、SSL协议的相关材料，这样您就非常容易理解这些配置了。首先需要为virtual site 配置一个数字证书，供客户端进行检验，让客户端检查访问的是否信任的SSL VPN网关。需要在SPX上生成一个CSR ( certificate sign request)，即数字证书签名申请供CA(认证中心)生成数字证书。如果您有CA，您可以将CSR提交给他，并由他生成Virtual Site 的数字证书，然后将数字证书import到SPX内。如果您没有CA，SPX会为您自动签名一个证书。对于客户端的数字证书验证是可选的，在一些对客户端有较高安全验证的情况下会使用，这时您需要一个CA来进行客户端数字证书的颁发管理。同时，需要将CA的信任证书链导入的SPX内部作为客户端数字证书的签名验证。生成CSR图形界面为： 查看csr的生成，命令行为：AN (config)$show ssl csr如：-BEGIN CERTIFICATE REQUEST-MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAkJKMQ0wCwYDVQQHEwRFTlNTMQ0wCwYDVQQKEwRFTlNTMQ0wCwYDVQQLEwRFTlNTMQ0wCwYDVQQDEwRlbnNzMSIwIAYJKoZIhvcNAQkBFhNsaXVkb25nZmVuZ0AxNjMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3uihP8oYRLDp8bf+n+vh64fWdJOOegjTb9OMsebQs5OEm+7ab28VnmfNcAn3z19pEnmkA09d0ExmeADTkEJ1qL3MZV4SMbZOCoW3EJXh3c/NAnnmyRYuIbZvC6M8wYeRrj0iaYXAnJdny6MYzjn58QHOuOyKiRwc4LGP/itVKAEljehvuKdQUztoj3t15vGa9gxgqk5Vm5nnvfjDvjrxBcijs72NjZyTXDATgTJxYOhJAUju/oI9tInVxZMbIL2jtdzaHbZqhSUHn38WSuSaibNeJTLGtUP3YTGYuGujFH2MJLJHtsY7QIIcfqkyjRP2HklNq6ZI2aiv2qXC5jeJeQIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAF1Z4OtUBs5wF9zbY+18Z0vhZUeIfw9tmF1UdDefTVyddbbcukxM8q13c7UyM2QQdCEqmTosMDUIYejFOC2HkayuOLR9HSrjTHPlsrcjGw6usvoLti5F4noGG72wfgnpqGXyliMSyvxEWl6zOVwRcKCUwZm50WQs9kTJ402AHQunsvqpJy4achQi6HNSrA3v37LC4EEwd/vL/jmN2rZP2D0ce8JrBJ5xhER8Ep4mJzjmoPuoszpuVKhdSNIokBCfr8VA+j7/+wMPnLFV1EQ6qnX4CNkgDy4l2K+s+llKUv9YCkjVbhW1ltD8cTK1WOi6K7C33M3NkPuA28BU0Y799iA=-END CERTIFICATE REQUEST-导入virtual site 数字证书这时您可以将上面生成的csr 提交给CA生成数字证书，如过您没有CA，SPX会为您签名一个数字证书，您只需要enss (config)$ssl start Site Configuration-Security Settings-SSL Settings-General如果您有CA并为您的virtual site 签名了一个数字证书，您可以导入到virtual site 里面。如：SP-Demo(config)$ssl import certificate You may overwrite an existing certificate file, type YES without quotes to continue:YES Enter certificate, use . on a single line, without quotes, to terminate import-BEGIN CERTIFICATE-MIICnjCANgcANgEUMA0GCSqGSIb3DQEBBAUAMIG5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxHDAaBgNVBAoTE0NsaWNrQXJyYXkgTmV0d29yK4RHM11OClXVjm3xRhqKQnjzNboExIvkZsKIBbfLkBrM1eBnEaiYWXmsYGfxPkwdhKlQCLQgN+G3IKu2cRQLU= -END CERTIFICATE-.注意要以“”结尾。上面使用的是数字证书的PEM格式，如果您用其他格式，可以使用TFTP方式倒入。命令行为：enss(config)$ssl import certificate tftp_ip这时您需要在tftp服务器上存在 .crt这个数字证书文件。图形界面为：Site Configuration-SSL Certificates-Certificates-ImportSite Configuration-SSL Certificates-Certificates-Import Via TFTP通过如下命令可以查看ssl certificate:enss(config)$ show ssl certificate客户端数字证书验证配置如果您不需要认证客户端的数字证书，则可以越过本小节。需要将CA的证书输入SP.enss(config)$ ssl import rootcaThis command is used to import the certificate of a trusted Certificate Authority. This willbe utilized for the verification of client certificates. It must be present when clientauthentication is enabled for a virtual site.Site Configuration-SSL Certificates-Trusted Root CA将客户端证书验证功能打开：SP-Demo(config)$ssl settings clientauthThis command allows the user to establish client authorization for the host. All SSL clientsconnecting to the specified virtual site will be required to present a client certificate beforecommunication will be allowed to continue. Site Configuration-Security Settings-SSL Settings-Client AuthenticationRole的配置在登录vpn虚拟站点之前必须进行role的设定，只有user具有了role的权限之后才能够登录vpn系统访问相应的资源。User具有role的资格需要满足一些特定的条件，只有当限定条件满足时才能够获得相应的role。虚拟站点下role settingsrole nameadd a role虚拟站点role settingsrole qualificationadd点击add按钮，包含有很多的conditions，他们之间是and的关系，只有满足这些条件的user才属于这个role。Login year ：The value scope of YEAR from 1970 to 2999, it can have , =, 2011Login month ：The value scope from 1-12, it can have , =, 8Login day ：The value scope from 1-31, it can have , =, 8Login time : The value scope from 00:00 to 23:59, it can have , =, , =, 201005080000Login week ：The value scope from 1-7, 1 means Monday, 7 means Sunday. It can have , =, = field. For example: 1-5User Name: If this condition contains multiple users, separate them with comma. They have OR relationship. But the maximum user names in one line is 10. If you want to assign more than 10 users to a role, you can assign them into a group first, and then assign this group to the role. Or you can separate them in different qualification definitions. NOTICE, DO NOT define them in the same qualification, because different condition definitions in a qualification have AND relationship.Group Name: If this condition contains multiple groups, separate them with comma. They have OR relationship. But the maximum group names in one line is 10. NOTICE, DO NOT define them in the same qualification, because different condition definitions in a qualification have AND relationship.Source IP: You can add netmask following the IP address, for example:/24 or / or Auth Method: if AAA module can allow administrator define name for every auth method, then the auth method will be the self-defined methods. If t