{"id":1334,"date":"2012-03-10T22:39:53","date_gmt":"2012-03-10T14:39:53","guid":{"rendered":"http:\/\/blog.pmail.idv.tw\/?p=1334"},"modified":"2012-03-10T22:39:53","modified_gmt":"2012-03-10T14:39:53","slug":"fortigate-60b%e8%88%87netscreen-5xp-site-to-site-vpn-%e8%a8%ad%e5%ae%9a","status":"publish","type":"post","link":"https:\/\/blog.pmail.idv.tw\/?p=1334","title":{"rendered":"Fortigate-60B\u8207Netscreen-5xp site to site vpn \u8a2d\u5b9a"},"content":{"rendered":"

\u624b\u4e0a\u6709Fortigate-60B\u8207Netscreen-5xp\u8a2d\u5099 <\/p>\n

\u627e\u4e86\u5b98\u65b9\u7db2\u7ad9\u6587\u4ef6\u4f86\u7814\u7a76\u5f8c\uff0c\u7df4\u7fd2\u4e00\u4e0b\u5169\u5bb6\u4e0d\u540c\u8a2d\u5099site to site VPN \u7684\u8a2d\u5b9a <\/p>\n

\u7c21\u55ae\u7684\u67b6\u69cb\u5716 <\/p>\n

\"fg601\"<\/a><\/p>\n

<\/p>\n

\u74b0\u5883\u8aaa\u660e <\/p>\n

Fortigate 60B  <\/p>\n

WAN1 IP :a.a.a.a <\/p>\n

LAN-A  : 192.168.3.0\/24 <\/p>\n

Netscreen 5XP <\/p>\n

Untrust IP : b.b.b.b <\/p>\n

LAN-B  : 192.168.1.0\/24 <\/p>\n

\u9054\u6210\u76ee\u7684 <\/p>\n

WAN1 \u8207 Uustrust \u505aVPN ,\u8b93LANA \u8207LANB \u53ef\u4ee5\u4e92\u901a <\/p>\n

===================================== <\/p>\n

Fortgate 60B \u8a2d\u5b9a <\/p>\n

1.\u5148\u8a2d\u5b9aIP\u7db2\u6bb5\u7269\u4ef6,\u5728WEB\u4ecb\u9762\u4e0a\u8a2d\u5b9a <\/p>\n

   firewall –> Address  \u65b0\u589e\u5169\u908a\u5167\u90e8\u7db2\u6bb5\u7684\u7269\u4ef6 <\/p>\n

\u540d\u7a31: 5XP_Network (\u5982\u4e0b\u5716) <\/p>\n

\"fg60-2\"<\/a> <\/p>\n

\u540d\u7a31: FG60_Network (\u5982\u4e0b\u5716) <\/p>\n

\"fg60-3\"<\/a> <\/p>\n

2.\u8a2d\u5b9aVPN,\u5728WEB\u4ecb\u9762\u4e0a\u8a2d\u5b9a <\/p>\n

    #1:\u5148\u5efa\u7acb Phase1 <\/p>\n

    VPN –>  IPSEC –> Auto key (IKE)Create Phase1 <\/p>\n

\"fg60-4\"<\/a> <\/p>\n

Name : \u81ea\u8a02\u540d\u7a31 <\/p>\n

     Remote Gateway : \u9078 Static IP Address <\/p>\n

     IP Address : \u8a2d\u5b9aNetScreen 5xp  Untrust\u7684IP <\/p>\n

     Local Interface: \u8a2d\u5b9a\u8981\u8207Netscreen5xp \u505aVPN\u7684\u4ecb\u9762(\u6211\u662f\u7528WAN1) <\/p>\n

     Mode : Main <\/p>\n

     Authentication Method : \u8a2d\u5b9a\u4f7f\u7528Preshared key <\/p>\n

     pre-share-key : \u8a2d\u5b9a\u4e00\u7d44key (FG60B\u82075XP\u90fd\u9700\u8a2d\u5b9a\u4e00\u6a23) <\/p>\n

     Phase1\u9032\u968e\u8a2d\u5b9a\u90e8\u4efd(\u5982\u4e0b\u5716) <\/p>\n

\"fg60-5\"<\/a> <\/p>\n

#2:\u5148\u5efa\u7acb Phase2 <\/p>\n

     VPN –>  IPSEC –> Auto key (IKE)Create Phase2(\u5982\u4e0b\u5716) <\/p>\n

\"fg60-6\"<\/a> <\/p>\n

Name : \u540d\u7a31\u81ea\u8a02 <\/p>\n

      Phase1 :\u9078\u4e4b\u524dPhase1 \u8a2d\u5b9a\u7684\u540d\u7a31 <\/p>\n

      \u5176\u4ed6\u53c3\u8003\u4e0a\u5716\u8a2d\u5b9a\u5373\u53ef <\/p>\n

3.\u5efa\u7acbpolicy <\/p>\n

  \u5728web \u4ecb\u9762 \u2013> policy <\/p>\n

\"fg60-6\"<\/a> <\/p>\n

Source Interface\/Zone : internal (FG60B LAN) <\/p>\n

   Source Address :\u524d\u9762\u6b65\u9a5f\u8a2d\u5b9a\u7684\u7db2\u8def\u7269\u4ef6 ( FG60_Network ) <\/p>\n

   Destination Interface\/Zone : wan1 (\u82075xp\u9023\u7dda\u7684\u5c0d\u5916port) <\/p>\n

   Schedule :  always <\/p>\n

   service : any <\/p>\n

   Action : IPSEC <\/p>\n

   VPN Tunnel : \u9078\u524d\u9762Phase 1 \u7684\u540d\u7a31 p1 <\/p>\n

   \u8a2d\u5b9a\u597d\u5c07\u6b64\u898f\u5247\u8abf\u6574\u81f3\u6700\u4e0a\u9762 <\/p>\n

\"fg60-7\"<\/a> <\/p>\n

PS: FG60B \u898f\u5247\u53ea\u9700\u8981\u8a2d\u5b9a\u4e00\u689d\u5373\u53ef <\/p>\n

NetScreen 5XP \u8a2d\u5b9a <\/p>\n

1.\u5148\u8a2d\u5b9aIP\u7db2\u6bb5\u7269\u4ef6,\u5728WEB\u4ecb\u9762\u4e0a\u8a2d\u5b9a <\/p>\n

    object –> Address <\/p>\n

    Untrust : FG60_NET (192.168.3.0\/24) <\/p>\n

    Trust : 5xp_NET (192.168.1.0\/24) <\/p>\n

\"fg60-8\"<\/a> <\/p>\n

\"fg60-9\"<\/a> <\/p>\n

2.\u8a2d\u5b9aVPN,\u5728WEB\u4ecb\u9762\u4e0a\u8a2d\u5b9a <\/p>\n

    #1:\u5148\u5efa\u7acb Phase1 <\/p>\n

      VPNs > AutoKey Advanced > Gateway <\/p>\n

\"fg60-10\"<\/a> <\/p>\n

Gateway Name : \u81ea\u5b9a (\u6211\u8a2d\u5b9ap1) <\/p>\n

   Security Level : Custom <\/p>\n

   Remote Gateway Type :  Static IP Address (\u5728\u6b64\u53f3\u908a\u5c07FG60B \u5c0d\u5916IP\u8a2d\u5b9a\u4e0a\u53bb) <\/p>\n

   Preshared Key: \u8a2d\u5b9a\u8207FG60B\u76f8\u540c\u7684key <\/p>\n

   Advanced \u90e8\u5206: <\/p>\n

\"fg60-11\"<\/a> <\/p>\n

Phase 1 Proposal : \u9078 pre-g2-3des-sha , pre-g2-3des-md5  <\/p>\n

  \u52fe\u9078 Enable NAT-Traversal  <\/p>\n

  \u5176\u4ed6\u9810\u8a2d\u503c\u5373\u53ef <\/p>\n

#2:\u5148\u5efa\u7acb Phase2 <\/p>\n

    VPNs > AutoKey IKE <\/p>\n

\"fg60-12\"<\/a> <\/p>\n

VPN Name  : \u81ea\u8a02(\u6211\u8a2d\u5b9ap2) <\/p>\n

  Security Level  : Custom <\/p>\n

  Remote Gateway  : \u9078 Predefined,\u53f3\u908a\u8a2d\u5b9ap1(\u4e0a\u9762\u6b65\u9a5f\u8a2d\u5b9a\u7684phase1) <\/p>\n

  Advanced \u90e8\u5206: <\/p>\n

\"fg60-13\"<\/a> <\/p>\n

Phase 2 Proposal : \u9078 g2-esp-des-md5 , g2-dsp-3des-md5 , g2-esp-3des-sha <\/p>\n

   \u52fe\u9078 Replay Protection  <\/p>\n

   Bind to \u9078 nono <\/p>\n

   proxy ID : \u53ef\u4ee5\u4e0d\u7528\u8a2d\u5b9a <\/p>\n

3.\u5efa\u7acbpolicy <\/p>\n

Untrust To Trust :  <\/p>\n

\"fg60-14\"<\/a> <\/p>\n

Source Address: FG60_NET <\/p>\n

Destination Address : 5xp_NET <\/p>\n

Action : Tunnel  <\/p>\n

Tunnel  VPN : \u9078p2 (phase2) <\/p>\n

\u52fe\u9078 Modify matching bidirectional VPN policy <\/p>\n

Trust To Untrus <\/p>\n

\"fg60-15\"<\/a> <\/p>\n

Source Address: 5xp_NET <\/p>\n

Destination Address : FG60_NET <\/p>\n

Action : Tunnel  <\/p>\n

Tunnel  VPN : \u9078p2 (phase2) <\/p>\n

\u52fe\u9078 Modify matching bidirectional VPN policy <\/p>\n

\u8a2d\u5b9a\u597d\u5982\u4e0b\u5716 <\/p>\n

\"fg60-16\"<\/a><\/p>\n

\n