IS200DTCIH1ABB工控备件机器人模块
它导入一个受信任的证书（BranchCRT）——网关2的BranchCSR证书，由网关1的根CA签名。网关2创建一个CSR（BranchCSR），让网关1的根CA将其签名为BranchCRT证书。它将证书作为本地证书导入网关2。它还将网关1的根CA的证书作为可信证书导入网关2。（请参阅“我的证书”和“颁发证书”部分）。IPsec VPN隧道可以使用IKE和X.509协议从任何一个对等点开始建立，这样这两个子网中的所有客户端主机都可以相互通信。参数设置示例与“我的证书”部分所述相同。对于HQ EW200工业蜂窝网关165的Network-A，下表列出了参数配置，作为IPsec VPN隧道建立的用户身份验证中使用的“可信证书”功能的示例，如上图所示。配置示例必须与“我的证书”和“颁发证书”部分中的示例结合起来，以完成整个用户场景的设置。配置路径[受信任的证书]-[受信任客户端证书列表]命令按钮导入配置路径[可信证书]-[Trusted Client Certificate Import from a File]File BranchCRT.crt For Network-B at Branch Office配置路径[信任证书]-[Crusted CA证书列表]Command Button导入配置路径[Trusted Certificate]-[从文件导入受信任的CA证书]文件HQRootCA.crt配置路径[受信任的证书]-[受信任客户端证书列表]命令按钮导入配置路径[可信证书]-〔从文件导入可信客户端证书〕文件HQCRT.crt场景操作过程（与“我的证书”部分中所述相同）在上图中，“网关1”是位于总部的网络A的网关，其内部网的子网为10.0.76.0/24。LAN接口的IP地址为10.0.76.2，WAN-1接口为203.95.80.22。“网关2”是位于分支机构的网络B的网关，其内部网的子网为10.0.750/24。LAN接口的IP地址为10.0.75.2，WAN-1接口为118.18.81.33。它们都充当NAT安全网关。网关2将网关1生成并签名的根CA和HQCRT的证书导入网关2的“可信CA证书列表”和“可信客户端证书列表”。它将获得的BranchCRT证书（网关1的根CA签名之后的派生BranchCSR证书）导入网关1的“可信客户端证书列表”和网关2的“本地证书列表”。有关更多详细信息，请参阅本手册“我的证书”部分中的网络B操作程序。网关2可以使用“站点到站点”方案以及到网关1的IKE和X.509协议建立IPsec VPN隧道。最后，10.0.750/24和10.0.76.0/24两个子网中的客户端主机可以相互通信。
It imports a trusted certificate (BranchCRT) – a BranchCSR certificate of Gateway 2 signed by root CA of Gateway 1. Gateway 2 creates a CSR (BranchCSR) to let the root CA of Gateway 1 sign it to be the BranchCRT certificate. It imports the certificate into the Gateway 2 as a local certificate. It also imports the certificates of the root CA of Gateway 1 into the Gateway 2 as trusted ones. (Refer to "My Certificate" and "Issue Certificate" sections). An IPsec VPN tunnel can be established with IKE and X.509 protocols starting from either peer, so that all client hosts in these both subnets can communicate with each other. Parameter Setup Example is the same as described in "My Certificate" section. For Network-A at HQ EW200 Industrial Cellular Gateway 165 The following tables list the parameter configuration as an example for the "Trusted Certificate" function used in the user authentication of IPsec VPN tunnel establishing, as shown in the above diagram. The configuration example must be combined with the ones in "My Certificate" and "Issue Certificate" sections to complete the setup for the whole user scenario. Configuration Path [Trusted Certificate]-[Trusted Client Certificate List] Command Button Import Configuration Path [Trusted Certificate]-[Trusted Client Certificate Import from a File] File BranchCRT.crt For Network-B at Branch Office Configuration Path [Trusted Certificate]-[Trusted CA Certificate List] Command Button Import Configuration Path [Trusted Certificate]-[Trusted CA Certificate Import from a File] File HQRootCA.crt Configuration Path [Trusted Certificate]-[Trusted Client Certificate List] Command Button Import Configuration Path [Trusted Certificate]-[Trusted Client Certificate Import from a File] File HQCRT.crt Scenario Operation Procedure (same as described in "My Certificate" section) In the above diagram, "Gateway 1" is the gateway of Network-A located at headquarters and the subnet of its Intranet is 10.0.76.0/24. It has the IP address of 10.0.76.2 for LAN interface and 203.95.80.22 for WAN-1 interface. "Gateway 2" is the gateway of Network-B located at the branch office and the subnet of its Intranet is 10.0.75.0/24. It has the IP address of 10.0.75.2 for LAN interface and 118.18.81.33 for WAN-1 interface. They both serve as the NAT security gateways. Gateway 2 imports the certificates of the root CA and HQCRT that were generated and signed by Gateway 1 into the "Trusted CA Certificate List" and "Trusted Client Certificate List" of Gateway 2. It imports the obtained BranchCRT certificate (the derived BranchCSR certificate after Gateway 1’s root CA signature) into the "Trusted Client Certificate List" of the Gateway 1 and the "Local Certificate List" of the Gateway 2. For more details, refer to the Network-B operation procedure in "My Certificate" section of this manual. Gateway 2 can establish an IPsec VPN tunnel with "Site to Site" scenario and IKE and X.509 protocols to Gateway 1. Finally, the client hosts in two subnets of 10.0.75.0/24 and 10.0.76.0/24 can communicate with each other.
