IS200DVIBH1BAB自动化模块备件
e场景操作程序在上图中，“网关1”是总部A网络的网关，其内部网的子网为10.0.76.0/24。LAN接口的IP地址为10.0.76.2，WAN-1接口为203.95.80.22。“网关2”是分支机构B网络的网关，其内部网的子网为10.0.750/24。LAN接口的IP地址为10.0.75.2，WAN-1接口为118.18.81.33。它们都充当NAT安全网关。网关1生成根CA和自己签名的本地证书（HQCRT）。它将根CA和HQCRT的证书导入网关2的“可信CA证书列表”和“可信客户端证书列表”。网关2为其自己的证书（BranchCRT）生成证书签名请求（BranchCSR）（请在网关2中生成一个自签名证书，然后单击该CSR的“查看”按钮。只需下载它。）。获取要由网关1的根CA签名的CSR并获得BranchCRT证书（您需要重命名它）。将证书导入网关1的“可信客户端证书列表”和网关2的“本地证书列表”。网关2可以使用“站点到站点”方案以及到网关1的IKE和X.509协议建立IPsec VPN隧道。最后，10.0.750/24和10.0.76.0/24两个子网中的客户端主机可以相互通信。EW200工业蜂窝网关161我的证书设置转到“对象定义”>“证书”>“我的证书”选项卡。“我的认证”设置允许用户创建本地证书。在“我的证书”页面中，有两个“我的认证”功能的配置窗口。“本地证书列表”窗口显示用于表示网关的存储证书或CSR。“Local Certificate Configuration”（本地证书配置）窗口允许您输入所需的信息，以便由其自身生成相应的证书，或由其他CA签署相应的CSR。创建本地证书应用添加按钮后，将显示本地证书配置屏幕。证书或CSR需要填写的信息包括名称、密钥和使用者名称。如果选中“自签名”框，则为证书；否则，它是CSR。EW200工业蜂窝网关162本地证书配置项值设置描述名称1。字符串格式，任意文本2。必需设置输入证书名称。它将是一个证书文件名。如果选中了自签名，则将由根CA签名。如果未选中自签名，将生成证书签名请求（CSR）。需要密钥设置此字段用于指定证书的密钥属性。设置公钥密码系统的密钥类型。目前，仅支持RSA。Key Length设置密码算法中使用的密钥的长度（以位为单位）。它可以是512/768/1024/1536/2048。Digest Algorithm在证书的签名算法标识符中设置标识符。它可以是MD5/SHA-1。主题名称必填设置此字段用于指定证书的信息。国家（C）是组织所在国家的两个字母ISO代码。州（ST）是组织所在的州。位置（L）是组织所在的位置。
e Scenario Operation Procedure In the above diagram, "Gateway 1" is the gateway of Network-A in headquarters and the subnet of its Intranet is 10.0.76.0/24. It has the IP address of 10.0.76.2 for LAN interface and 203.95.80.22 for WAN-1 interface. "Gateway 2" is the gateway of Network-B in branch office and the subnet of its Intranet is 10.0.75.0/24. It has the IP address of 10.0.75.2 for LAN interface and 118.18.81.33 for WAN-1 interface. They both serve as the NAT security gateways. Gateway 1 generates the root CA and a local certificate (HQCRT) that is signed by itself. It importsthe certificates of the root CA and HQCRT into the "Trusted CA Certificate List" and "Trusted Client Certificate List" of Gateway 2. Gateway 2 generates a Certificate Signing Request (BranchCSR) for its own certificate (BranchCRT) (Please generate one t self-signed certificate in the Gateway 2, and click on the "View" button for that CSR. Just download it.). Take the CSR to be signed by the root CA of Gateway 1 and obtain the BranchCRT certificate (you need rename it). Import the certificate into the "Trusted Client Certificate List" of the Gateway 1 and the "Local Certificate List" of Gateway 2. Gateway 2 can establish an IPsec VPN tunnel with "Site to Site" scenario and IKE and X.509 protocols to Gateway 1. Finally, the client hosts in two subnets of 10.0.75.0/24 and 10.0.76.0/24 can communicate with each other. EW200 Industrial Cellular Gateway 161 My Certificate Setting Go to Object Definition > Certificate > My Certificate tab. The My Certificate setting allows user to create local certificates. In "My Certificate" page, there are two configuration windows for the "My Certificate" function. The "Local Certificate List" window shows the stored certificates or CSRs for representing the gateway. The "Local Certificate Configuration" window lets you enter the required information necessary for corresponding certificate to be generated by itself, or corresponding CSR to be signed by other CAs. Create Local Certificate When the Add button is applied, Local Certificate Configuration screen will appear. The required information to be filled for the certificate or CSR includes the name, key and subject name. It is a certificate if the "Self-signed" box is checked; otherwise, it is a CSR. EW200 Industrial Cellular Gateway 162 Local Certificate Configuration Item Value setting Description Name 1. String format, any text 2. Required setting Enter a certificate name. It will be a certificate file name If Self-signed is checked, it will be signed by root CA. If Self-signed is t checked, it will generate a certificate signing request (CSR). Key Required setting This field is to specify the key attributes of certificate. Key Type to set public-key cryptosystems. Currently, only RSA is supported. Key Length to set the length in bits of the key used in a cryptographic algorithm. It can be 512/768/1024/1536/2048. Digest Algorithm to set identifier in the signature algorithm identifier of certificates. It can be MD5/SHA-1. Subject Name Required setting This field is to specify the information of certificate. Country(C) is the two-letter ISO code for the country where your organization is located. State(ST) is the state where your organization is located. Location(L) is the location where your organization is located.
