【正文】 WebUI (東京)1. 接口Network Interfaces Edit (對于ethernet1 ): 輸入以下內(nèi)容，然后單擊Apply:Zone Name: TrustStatic IP: (出現(xiàn)時選擇此選項)IP Address/Netmask: 選擇以下內(nèi)容，然后單擊OK:Interface Mode: NATNetwork Interfaces Edit (對于ethernet3 ): 輸入以下內(nèi)容，然后單擊OK:Zone Name: UntrustStatic IP: (出現(xiàn)時選擇此選項)IP Address/Netmask: Network Interfaces New Tunnel IF: 輸入以下內(nèi)容，然后單擊OK:Tunnel Interface Name: Zone (VR): Untrust (trustvr)Unnumbered: (選擇)Interface: ethernet3 (trustvr)2. 地址Objects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Trust_LANIP Address/Domain Name:IP/Netmask: (選擇), Zone: TrustObjects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Paris_OfficeIP Address/Domain Name:IP/Netmask: (選擇), Zone: Untrust3. VPNVPNs AutoKey Advanced Gateway New: 輸入以下內(nèi)容，然后單擊OK:Gateway Name: To_ParisSecurity Level: CustomRemote Gateway Type:Static IP Address: (選擇), IP Address/Hostname: 預(yù)共享密鑰Preshared Key: h1p8A24nG5Outgoing Interface: ethernet3Advanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本Gateway配置頁:Security Level: CustomPhase 1 Proposal (for Custom Security Level ):preg23desshaMode (Initiator): Main (ID Protection)(或)證書Outgoing Interface: ethernet3 Advanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本Gateway配置頁:Security Level: CustomPhase 1 Proposal (for Custom Security Level ):rsag23desshaPreferred certificate (optional)Peer CA: EntrustPeer Type: X509SIGVPNs AutoKey IKE New: 輸入以下內(nèi)容，然后單擊OK:VPN Name: Tokyo_ParisSecurity Level: CompatibleRemote GatewayPredefined: (選擇), To_ParisAdvanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本“AutoKeyIKE”配置頁:Security Level: CompatibleBind To: Tunnel Interface, ProxyID: (選擇)Local IP/Netmask: Remote IP/Netmask: Service: ANY4. 路由Network Routing Routing Entries trustvr New: 輸入以下內(nèi)容，然后單擊OK:Network Address/Netmask: Gateway: (選擇)Interface: ethernet3Gateway IP Address: Network Routing Routing Entries trustvr New: 輸入以下內(nèi)容，然后單擊OK:Network Address/Netmask: Gateway: (選擇)Interface: Gateway IP Address: 5. 策略Policies (From: Trust, To: Untrust) New: 輸入以下內(nèi)容，然后單擊OK:Name: To ParisSource Address: Trust_LANDestination Address: Paris_OfficeService: ANYAction: PermitPosition at Top: (選擇)Policies (From: Untrust, To: Trust) New: 輸入以下內(nèi)容，然后單擊OK:Name: From ParisSource Address: Paris_OfficeDestination Address: Trust_LANService: ANYAction: PermitPosition at Top: (選擇)WebUI (巴黎)1. 接口Network Interfaces Edit (對于ethernet1 ): 輸入以下內(nèi)容，然后單擊Apply:Zone Name: TrustStatic IP: (出現(xiàn)時選擇此選項)IP Address/Netmask: 選擇以下內(nèi)容，然后單擊OK:Interface Mode: NATNetwork Interfaces Edit (對于ethernet3 ): 輸入以下內(nèi)容，然后單擊OK:Zone Name: UntrustStatic IP: (出現(xiàn)時選擇此選項)IP Address/Netmask: Network Interfaces New Tunnel IF: 輸入以下內(nèi)容，然后單擊OK:Tunnel Interface Name: Zone (VR): Untrust (trustvr)Unnumbered: (選擇)Interface: ethernet3 (trustvr)2. 地址Objects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Trust_LANIP Address/Domain Name:IP/Netmask: (選擇), Zone:TrustObjects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Tokyo_OfficeIP Address/Domain Name:IP/Netmask: (選擇), Zone: Untrust3. VPNVPNs AutoKey Advanced Gateway New: 輸入以下內(nèi)容，然后單擊OK:Gateway Name: To_TokyoSecurity Level: CustomRemote Gateway Type:Static IP Address: (選擇), IP Address/Hostname: 預(yù)共享密鑰Preshared Key: h1p8A24nG5Outgoing Interface: ethernet3Advanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本Gateway 配置頁:Security Level: CustomPhase 1 Proposal (for Custom Security Level ):preg23desshaMode (Initiator): Main (ID Protection)(或)證書Outgoing Interface: ethernet3Advanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本Gateway配置頁:Security Level: CustomPhase 1Proposal (for Custom Security Level ):rsag23desshaPreferred certificate (optional)Peer CA: EntrustPeer Type: X509SIGVPNs AutoKey IKE New: 輸入以下內(nèi)容，然后單擊OK:Name: Paris_TokyoSecurity Level: CustomRemote Gateway:Predefined: (選擇), To_TokyoAdvanced: 輸入以下高級設(shè)置，然后單擊Return，返回基本“AutoKeyIKE”配置頁: Security Level: CompatibleBind To: Tunnel Interface, ProxyID: (選擇)Local IP/Netmask: Remote IP/Netmask: Service:ANY4. 路由Network Routing Routing Entries trustvr New: 輸入以下內(nèi)容，然后單擊OK:Netw。在以下例子中，預(yù)共享密鑰為h1p8A24nG5。 中輸入通向外部路由器的缺省路由，并輸入通過通道接口通向目的地的路由。 通道，在Untrust 區(qū)段內(nèi)指定其外向接口，將其綁定到通道接口，并配置其代理ID。所有區(qū)段都在trustvr 中。在本例中，“自動密鑰IKE”通道使用預(yù)共享機(jī)密或一對證書(通道兩端各一個)，提供東京和巴黎分公司之間的安全連接。由于只有那些位于動態(tài)對等方后面的主機(jī)的遠(yuǎn)程網(wǎng)關(guān)才有固定的IP 地址，并且可以從它們的本地網(wǎng)關(guān)到達(dá)，因此只有它們才能使用動態(tài)對等方站點(diǎn)到站點(diǎn)VPN 發(fā)起VPN 通道設(shè)置。由于遠(yuǎn)程網(wǎng)關(guān)的IP 地址保持不變而可以到達(dá)，因此，位于通道任一端的主機(jī)可使用靜態(tài)站點(diǎn)到站點(diǎn)VPN 發(fā)起VPN 通道設(shè)置。在兩個設(shè)備上用作外向接口的物理接口或子接口都有一個固定的IP 地址，同時內(nèi)部主機(jī)也擁有靜態(tài)IP 地址。CLI1. 接口set interface ethernet1 zone trustset interface ethernet1 ip set interface ethernet3 zone untrustset interface ethernet3 ip 2. URL過濾服務(wù)器set url server 15868 10set url failmode permitset url type NetScreenset url message “We’re sorry, but the requested URL is prohibited. If thisprohibition appears to be in error, contact .”set url config enable3. 路由set vrouter trustvr route interface ethernet3 gateway set vrouter trustvr route 4. 策略set policy from trust to untrust any any permit urlfilter 典型配置（9）――站點(diǎn)到站點(diǎn)IPSEC VPN 配置IPSec VPN 通道存在于兩個網(wǎng)關(guān)之間，同時每個網(wǎng)關(guān)都需要一個IP 地址。WebUI1. 接口Network Interfaces Edit (對于ethernet1 ): 輸入以下內(nèi)容，然后單擊Apply:Zone Name: TrustStatic IP: (有此選項時將其選定)IP Address/Netmask: 輸入以下內(nèi)容，然后單擊OK:Interface Mode: NATNetwork Interfaces Edit (對于ethernet3 ): 輸入以下內(nèi)容，然后單擊OK:Zone Name: UntrustStatic IP: (有此選項時將其選定)IP Address/Netmask: 2. URL過濾服務(wù)器Screening URL Filtering: 輸入以下內(nèi)容，然后單擊Apply:Enable URL Filtering via Websense Server: (選擇)Websense Server Name: Websense Server Port: 15868Communication Timeout: 10 (秒)If connectivity to the Websense server is lost ... all HTTP requests: PermitBlocked URL Message Type: NetScreenNetScreen Blocked URL Message: We39。兩個區(qū)段都位于trustvr 路由域中。re sorry, but therequested URL is prohibited. If this prohibition appears to be in error, contact .”Untrust 區(qū)段的接口是ethernet3 且擁有IP 。如果NetScreen 設(shè)備失去與URL 過濾服務(wù)器的連接，則您希