出差在外想直接连回公司内网？华为SSL VPN配AD认证一键接入
本文整理自华为官方发布的典型配置案例，命令与步骤均按原始文档呈现，供现场实施参考。
公司上了 AD 域，账号密码都在域控里管着，可老板和同事出差在家还想像在办公室一样打开内网系统，总不能把内网服务器直接暴露到公网上。华为防火墙的 SSL VPN 网络扩展功能正好解决这件事：用户拿到一个内网 IP，完全接入企业内部网络；身份认证直接对接 AD 服务器，用域账号密码登录，账号管理和权限跟随现成的 AD 体系，不用在防火墙上再养一套账号。
官方案例场景：企业使用 AD 服务器对接入用户进行身份认证，AD 主服务器 IP 地址为 10.2.0.155，从服务器 IP 地址为 10.2.0.156。GE0/0/1 是公网口（1.1.1.1/24），GE0/0/2 连内网（10.2.0.1/16）。
第一步，配置接口 IP 地址和安全区域。
<HUAWEI> system-view
[HUAWEI] sysname DeviceA
[DeviceA] interface GE0/0/1
[DeviceA-GE0/0/1] ip address 1.1.1.1 24
[DeviceA-GE0/0/1] quit
[DeviceA] interface GE0/0/2
[DeviceA-GE0/0/2] ip address 10.2.0.1 16
[DeviceA-GE0/0/2] quit
[DeviceA] firewall zone untrust
[DeviceA-zone-untrust] add interface GE0/0/1
[DeviceA-zone-untrust] quit
[DeviceA] firewall zone trust
[DeviceA-zone-trust] add interface GE0/0/2
[DeviceA-zone-trust] quit
第二步，配置 SSL VPN 的安全策略，共三条：允许用户与设备建立隧道、允许远程用户访问内网资源、允许设备和 AD 服务器通信。
[DeviceA] security-policy
[DeviceA-policy-security] rule name policy_sslvpn_1
[DeviceA-policy-security-rule-policy_sslvpn_1] source-zone untrust
[DeviceA-policy-security-rule-policy_sslvpn_1] destination-zone local
[DeviceA-policy-security-rule-policy_sslvpn_1] destination-address 1.1.1.0 24
[DeviceA-policy-security-rule-policy_sslvpn_1] action permit
[DeviceA-policy-security-rule-policy_sslvpn_1] quit
[DeviceA-policy-security] rule name policy_sslvpn_2
[DeviceA-policy-security-rule-policy_sslvpn_2] source-zone untrust
[DeviceA-policy-security-rule-policy_sslvpn_2] destination-zone trust
[DeviceA-policy-security-rule-policy_sslvpn_2] source-address range 172.16.1.1 172.16.1.100
[DeviceA-policy-security-rule-policy_sslvpn_2] destination-address 10.2.0.0 16
[DeviceA-policy-security-rule-policy_sslvpn_2] action permit
[DeviceA-policy-security-rule-policy_sslvpn_2] quit
[DeviceA-policy-security] rule name policy_sslvpn_3
[DeviceA-policy-security-rule-policy_sslvpn_3] source-zone local
[DeviceA-policy-security-rule-policy_sslvpn_3] destination-zone trust
[DeviceA-policy-security-rule-policy_sslvpn_3] destination-address 10.2.0.155 32
[DeviceA-policy-security-rule-policy_sslvpn_3] destination-address 10.2.0.156 32
[DeviceA-policy-security-rule-policy_sslvpn_3] action permit
[DeviceA-policy-security-rule-policy_sslvpn_3] quit
[DeviceA-policy-security] quit
第三步，创建 UCL 组并配置地址池。本例采用服务器授权，设备从 AD 服务器的 memberOf 属性取用户所属组作为安全组，设备上要创建与服务器同名的 UCL 组，否则角色无法引用。
[DeviceA] ucl-group name director
[DeviceA] ip pool addr_pool
[DeviceA-ip-pool-addr_pool] section 0 172.16.1.1 172.16.1.100
[DeviceA-ip-pool-addr_pool] quit
第四步，配置与 AD 服务器的对接参数，参数必须与 AD 服务器保持一致，配完用 test-aaa 测一把连通性。
[DeviceA] ad-server template ad_server
[DeviceA-ad-ad_server] ad-server authentication 10.2.0.155 88 no-ssl
[DeviceA-ad-ad_server] ad-server authentication 10.2.0.156 88 secondary no-ssl
[DeviceA-ad-ad_server] ad-server authentication base-dn dc=cce,dc=com
[DeviceA-ad-ad_server] ad-server authentication manager cn=administrator,cn=users YsHsjx@123
[DeviceA-ad-ad_server] ad-server authentication host-name info-server.cce.com
[DeviceA-ad-ad_server] ad-server authentication host-name info-server2.cce.com secondary
[DeviceA-ad-ad_server] ad-server authentication ldap-port 389 ldap-ssl-port 636
[DeviceA-ad-ad_server] test-aaa user_0001 YsHsjx@123 ad-template ad_server
[DeviceA-ad-ad_server] quit
第五步，创建虚拟网关并配置网络扩展：地址池用前面建的 addr_pool，路由模式为自适应模式，可访问资源定为内网网段 10.2.0.0/16。
[DeviceA] virtual-gateway example 1
[DeviceA-virtual-gateway-example] service address interface GE0/0/1 port 443
[DeviceA-virtual-gateway-example] max-online-user 100
[DeviceA-virtual-gateway-example] service
[DeviceA-virtual-gateway-example-service] network-extension keep-alive timeout 120
[DeviceA-virtual-gateway-example-service] network-extension ip-pool addr_pool
[DeviceA-virtual-gateway-example-service] network-extension mode adapt
[DeviceA-virtual-gateway-example-service] network-extension resource test ip-subnet 10.2.0.0 255.255.0.0
[DeviceA-virtual-gateway-example-service] quit
第六步，配置认证域与角色：认证和授权方案都指向 AD 模式，认证域绑定 ad_server 模板，虚拟网关绑定认证域；最后创建角色 staff，关联 UCL 组 director 和资源 test。
[DeviceA] aaa
[DeviceA-aaa] authentication-scheme ad
[DeviceA-aaa-authen-ad] authentication-mode ad
[DeviceA-aaa-authen-ad] quit
[DeviceA-aaa] authorization-scheme ad
[DeviceA-aaa-author-ad] authorization-mode ad
[DeviceA-aaa-author-ad] quit
[DeviceA-aaa] domain cce.com
[DeviceA-aaa-domain-cce.com] authentication-scheme ad
[DeviceA-aaa-domain-cce.com] authorization-scheme ad
[DeviceA-aaa-domain-cce.com] ad-server ad_server
[DeviceA-aaa-domain-cce.com] quit
[DeviceA-aaa] quit
[DeviceA-virtual-gateway-example] security
[DeviceA-virtual-gateway-example-security] authentication-domain cce.com
[DeviceA-virtual-gateway-example-security] quit
[DeviceA-virtual-gateway-example] quit
[DeviceA] virtual-gateway example
[DeviceA-virtual-gateway-example] role staff
[DeviceA-virtual-gateway-example-role-staff] group director
[DeviceA-virtual-gateway-example-role-staff] resource test
[DeviceA-virtual-gateway-example-role-staff] quit
[DeviceA-virtual-gateway-example] quit
有个官方提醒容易踩坑：虚拟网关绑定了认证域时，用户登录输入的用户名不能带认证域，例如绑定了 cce.com，登录时应输入 user_0001 而不是 user_0001@cce.com。
怎么验证？在浏览器输入网关地址 1.1.1.1 及端口 443 访问 SSL VPN 门户网站，按用户操作系统下载 UniVPN Client 安装并安装；在客户端主界面单击"+新建连接"，选择"SSL VPN"并配置网关地址等连接参数；接入虚拟网关后访问内网资源，能打开就说明隧道和授权都通了。
中小企业要做远程接入又不想另建账号体系，SSL VPN 加 AD 认证是很省心的一套组合。欢迎搜索关注贵州诚鑫致达科技，获取更多企业网络实战配置。
企业存储选型参考｜贵州诚鑫致达
做海量监控接入与长期归档，群晖机型参考：HD6500 · RS3621xs+ · DS2422+。需要选型建议或上门评估，搜「诚鑫致达」即可找到我们。
服务区域｜贵州诚鑫致达
贵州群晖NAS、贵阳存储、数据备份、信创云盘或 IT 集成服务，可联系贵州诚鑫致达科技，服务范围覆盖贵州全省各市州。重庆企业 NAS 存储、服务器运维与容灾备份方案。