R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

163

NOTE:

The configuration procedure covers only the configurations for IKE negotiation using RSA digital

signature. For an IPsec tunnel to be established, you also need to perform IPsec configurations. For more

information about IPsec configuration, see the chapter “IPsec configuration.”

Configuring a certificate attribute-based access control policy

1. Network requirements

• The client accesses the remote HTTP Security (HTTPS) server through the HTTPS protocol.

• Configure SSL to ensure that only legal clients log into the HTTPS server.

• Create a certificate attribute-based access control policy to control access to the HTTPS server.

Figure 90 Configure a certificate attribute-based access control policy

2. Configuration procedure

NOTE:

• For more information about SSL configuration, see the chapter “Network Management Configuration

Guide.”

• For more information about HTTPS configuration, see

Getting Started Guide

• The PKI domain to be referenced by the SSL policy must be created in advance. For how to confi

ure a

PKI domain, see “Configure the PKI domain.”

a. Configure the HTTPS server

# Configure the SSL policy for the HTTPS server to use.

<Firewall> system-view

[Firewall] ssl server-policy myssl

[Firewall-ssl-server-policy-myssl] pki-domain 1

[Firewall-ssl-server-policy-myssl] client-verify enable

[Firewall-ssl-server-policy-myssl] quit

b. Configure the certificate attribute group

# Create certificate attribute group mygroup1 and add two attribute rules. The first rule defines that the

DN of the subject name includes the string aabbcc, and the second rule defines that the IP address of the

certificate issuer is 10.0.0.1.

[Firewall] pki certificate attribute-group mygroup1

[Firewall-pki-cert-attribute-group-mygroup1] attribute 1 subject-name dn ctn aabbcc

[Firewall-pki-cert-attribute-group-mygroup1] attribute 2 issuer-name ip equ 10.0.0.1

[Firewall-pki-cert-attribute-group-mygroup1] quit