虚拟专用网络 VPN-示例：Fortinet飞塔防火墙VPN配置:命令行配置

时间：2024-07-19 15:22:09

虚拟专用网络 VPN

命令行配置

物理接口配置

config system interface
   edit "port1"
        set vdom "root"
        set ip 11.11.11.11 255.255.255.0
        set type physical
next
    edit "IPsec"                                  //隧道接口配置信息
        set vdom "root"
        set type tunnel
        set interface "port1"               //隧道绑定的物理接口
               next                    
         end

接口划分区域配置

config system zone
    edit "trust"
        set intrazone allow
        set interface "A1"
    next
    edit "untrust"
        set intrazone allow
        set interface "port1 "
    next
end

地址对象配置

config firewall address
         edit "hw-172.16.0.0/24"
        set uuid f612b4bc-5487-51e9-e755-08456712a7a0
        set subnet 172.16.0.0 255.255.255.0              //云端地址网段
         next
    edit "local-10.10.0.0/16"
        set uuid 9f268868-5489-45e9-d409-5abc9a946c0c
        set subnet 10.10.0.0 255.255.0.0                     //本地地址网段
    next

IPsec配置

config vpn IPsec phase1-interface                                        //一阶段配置
    edit "IPsec"
        set interface "port1"
        set nattraversal disable
        set proposal aes128-sha1
        set comments "IPsec"
        set dhgrp 5
        set remote-gw 22.22.22.22
        set psksecret ENC dmFyLzF4tRrIjV3T+lSzhQeU2nGEoYKC31NaYRWFJl8krlwNmZX5SfwUi5W5RLJqFu82VYKYsXp5+HZJ13VYY8O2Sn/vruzdLxqu84zbHEIQkTlf5n/63KEru1rRoNiHDTWfh3A3ep3fKJmxf43pQ7OD64t151ol06FMjUBLHgJ1ep9d32Q0F3f3oUxfDQs21Bi9RA==
    next
end
config vpn IPsec phase2-interface                                        //二阶段配置
    edit "IP-TEST"
        set phase1name "IPsec "
        set proposal aes128-sha1
        set dhgrp 5
        set keylifeseconds 3600
        set src-subnet 10.10.0.0 255.255.0.0
        set dst-subnet 172.16.0.0 255.255.255.0
    next
end

访问策略配置

config firewall policy 
 edit 15                                                  //策略编号15，流入至内网策略，未启用NAT
        set uuid 4f452870-ddb2-51e5-35c9-38a987ebdb6c
        set srcintf "IPsec"
        set dstintf "trust"
        set srcaddr "hw-172.16.0.0/24"
        set dstaddr "local-10.10.0.0/16"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 29                                           //策略编号29，流出至云端策略，未启用NAT
        set uuid c2d0ec77-5254-51e9-80dc-2813ccf51463
        set srcintf "trust"
        set dstintf "IPsec"
        set srcaddr "local-10.10.0.0/16"
        set dstaddr "hw-172.16.0.0/24"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next

路由配置

config router static
    edit 24                                 //路由编号24，访问云端静态路由
        set dst 172.16.0.0 255.255.255.0
        set gateway 11.11.11.1
        set distance 10
        set device "port1"
config router policy
edit 2                         //策略路由编号2，云下访问云端策略路由
        set input-device "A1"
        set src "10.10.00/255.255.0.0"
        set dst "172.16.0.0/255.255.255.0"
        set gateway 11.11.11.1
        set output-device "port1"

上一篇：虚拟专用网络 VPN-示例：Fortinet飞塔防火墙VPN配置:拓扑连接

下一篇：虚拟专用网络 VPN-示例：Fortinet飞塔防火墙VPN配置:拓扑连接