Background Information: The client has requests on O&M remote access, but has not purchased eSurfing Cloud platform's SSL VPN service. In this case, the SSL VPN service of eSurfing Cloud Firewall can be used, which can be configured separately.

Configuration process Description

No.	Sub-process	Configuration Content
1	Sort out VPN users and login passwords	Sort out the internal login permissions.
2	Create VPC address pool	Go toNetwork>VPN>SSL VPN>New.
3	Create users	Go toObjects>User>Local User>New.
4	Create tunnel interfaces	Go toNetwork>Interface>New, edit security zones, corresponding addresses, and link tunnels.
5	Configure security policies	Identify the access objects that require filtering and configure security policies by going toPolicy>Security Policy>New.

Configuration Content

Configuring the VPN Address Pool

Go to Network > VPN > SSL VPN and create a new one.

5.2.2.1配置VPN地址池1.png

5.2.2.1配置VPN地址池2.png

5.2.2.1配置VPN地址池3.png

Go to Create > SSL VPN Configuration , enter the start IP, end IP, netmask, and DNS1.

Note: This address pool is the range of VPN addresses that users can obtain after connecting to the VPN. It must be in the same segment as the address in the tunnel interface and should not overlap.

5.2.2.1配置VPN地址池4.png

Configuring the VPN User

Go to Object > User > Local User > New , enter the name and password, then confirm the password.

Configuration information for this session: Name: test_user ; Password: 123 .

5.2.2.2VPN用户配置1.png

5.2.2.2VPN用户配置2.png

Configuring the VPN Security Zone

Go to Network > Zone and use the VPN Zone.

5.2.2.3配置VPN安全域.png

Creating the SSL VPN Tunnel Interface

Go to Network > Interface and create a tunnel interface.

5.2.2.4新建SSL VPN隧道接口.png

Configure interface name: tunnel10 ; Zone: VPNHub ; IP address configuration: 10.1.1.1/24 .

Note: This IP address is the gateway address used for VPN login and is typically set as XX.XX.XX.1/24. This IP address range is related to the configuration of the SSL VPN address pool below. Please plan according to your own network.

Reverse route: Disabled to prevent routing loops.

Configuring Egress Policies

SNAT configuration: VPN address pool translated to firewall interface address.

5.2.2.5配置出向策略1.png

Security policy access: VPN zone > Translated interface zone.

5.2.2.5配置出向策略2.png

VPN Login

After the configuration is complete, enter https://IP:4433 in the browser on PC1, download and install the Windows client. Open the installed VPN client, enter the server IP, port, username, password, and other information to connect to the VPN.