Dynamic ×××  //最新远程×××解决方案，默认2个授权！
xp-------srx-----inside1
set system services web-management https system-generated-certificate
set security zones security-zone Outside interface fe-0/0/0.0 host-inbound-traffic ssh
set security zones security-zone Outside interface fe-0/0/0.0 host-inbound-traffic ike
set security zones security-zone Outside interface fe-0/0/0.0 host-inbound-traffic ping
set security zones security-zone Outside interface fe-0/0/0.0 host-inbound-traffic https

edit access address-assignment pool dyn-***-address-pool
edit family inet
set network 123.1.1.0/24
edit range d***-range
set low 123.1.1.100
set high 123.1.1.200
set xauth-attributes primary-dns 8.8.8.8/32

 

配置Access Profile
edit profile dyn-***-access-profile
set client remoteuser firewall-user password cisco
set address-assignment pool dyn-***-address-pool
set firewall-authentication web-authentication default-profile dyn-***-access-profile

 

配置第一阶段策略：
edit security ike policy ike-dyn-***-policy
set mode aggressive
set proposal-set standard  //调用系统标准的proposal
set pre-shared-key ascii-text cisco

edit gaeway dyn-***-local-gw
set ike-policy ike-dyn-***-policy
edit dynamic
set hostname dy***
set connection-limit 10
set ike-user-type group-ike-id    //所有的用户都用相同的用户ID！
up
up

set external-interface fe-0/0/0.0
set xauth access-profile dyn-***-access-profile

 

配置第二阶段策略：
edit ipsec policy ipsec-dyn-***-policy
set proposal-set standard 
up
edit *** dyn-*** ike
set gatway dyn-***-local-gw
set ipsec psec-dyn-***-policy

 

配置Dynamic ×××策略！
edit dynamic-***
set access-profile dyn-***-access-profile
edit clients all
set remote-protected-resources 10/8  //类似隧道分割10.0.0.0/8
set remote-exceptions 0/0
set ipsec-*** dyn-***  //把×××关联
set user remoteuser   //把相应的用户关联！

 

配置Security Policy  //放行×××流量
edit security policies from-zone Outside to-zone Inside1 policy dyv-***-policy
set match source-address any
set match destination-address any
set match application any
set then permit tunnel ipsec-*** dyn-***

commit  //提交！！！
----------------------------------------------
show security ike security-associations
show security ike active-peer
show security ipsec security-associations
show security dynamic-*** users