{{ getBottomFeedbackTxt(displayPage) }}
{{ $t('bottomFeedback.selectTags') }}
{{ item.name }}
{{ $t('bottomFeedback.moreAdvice') }}
{{ $t('bottomFeedback.email') }}
{{ $t('bottomFeedback.agreeRecall') }}
{{ $t('bottomFeedback.submitAdvice') }}
{{ tipmsg }}
{{ getBottomFeedbackTxt(page) }}
{{ $t('rightFeedback.close') }}
{{ $t('rightFeedback.submitSuccess') }}
{{ getTitle() }} {{ $t('rightFeedback.feedback') }}
{{ $t('rightFeedback.warningTip') }}
{{ $t('rightFeedback.onlineServiceLink') }}
.
{{ getBottomFeedbackTxt(page) }}
{{ $t('bottomFeedback.selectTags') }}
{{ item.name }}
{{ $t('bottomFeedback.moreAdvice') }}
{{ $t('bottomFeedback.email') }}
{{ $t('bottomFeedback.agreeRecall') }}
{{ $t('bottomFeedback.submitAdvice') }}
{{ getTitle() }} {{ $t('rightFeedback.feedback')}}
{{ getTitle() }} {{ $t('rightFeedback.feedback')}}
{{ $t('rightFeedback.warningTip')}}
{{ $t('rightFeedback.onlineService')}}
.
{{ getBottomFeedbackTxt(page) }}
{{ $t('bottomFeedback.selectTags') }}
{{ item.name }}
{{ $t('bottomFeedback.moreAdvice') }}
{{ $t('bottomFeedback.markedContent')}}
{{ dialog_sign_txt }}
{{ $t('bottomFeedback.email') }}
{{ $t('bottomFeedback.agreeRecall') }}
{{ $t('bottomFeedback.submitAdvice') }}
{{ menuItem.name }}
{{ menuItem.name }}
{{subMenu.name}}
{{ menuItem.name }}
{{ secondMenu.name }}
{{thirdMenu.name}}
{{ $t('productSubHeader.searchLabel') }}
No Data
{{ $t('productSubHeader.searchLabel') }}
# {{ $t('index.trendingSearches') }} #
{{ $t('index.search.noSearchRecords')}}
{{ item }}
# {{ $t('index.search.searchHistory') }} #
{{ $t('index.search.deleteAll')}}
{{ $t('index.search.complete')}}
{{ $t('index.search.noSearchRecords')}}
{{ item }}
{{getProductJoinVersion(item.product,item.version)}}
{{ $t('index.search.viewMore')}}
{{language}}
{{ item.value}}
{{ $t('sangforUser.login') }}
{{ $t('sangforUser.mySangfor') }}
{{user.username}}
{{ $t('sangforUser.uid') }}{{user.uid}}
{{ $t('sangforUser.accountInfo') }}
{{ $t('sangforUser.identityTip') }}
{{ $t('sangforUser.goToAuth') }}
{{ $t('sangforUser.myFollowedProducts') }}
{{ $t('sangforUser.myCollection') }}
{{ $t('sangforUser.unreadMessages') }}
{{unreadMsg}}
{{ $t('sangforUser.logout') }}
搜索
{{getProductJoinVersion(item.product,item.version)}}
查看更多
{{ language }}
{{ item.label }}
{{item.name}}
{{subitem.name}}
{{ $t('index.prodDialog.interestsProductLine') }}
{{item.name}}
{{ $t('index.prodDialog.notFollowProductLine') }}，
{{ $t('index.prodDialog.clickToFocus') }}
{{ $t('index.prodDialog.allProductsAndServices') }}
{{ $t('index.prodDialog.notFoundWith') }}“
{{searchName}}
”{{ $t('index.prodDialog.productLinesReEnter') }}
{{item.name}}
{{subitem.name}}
{{ $t('index.prodDialog.noData') }}
{{ $t('index.qiyuProductLineDialog.hotProductLine') }}
{{item.name}}
{{ $t('index.qiyuProductLineDialog.noContent') }}
{{ $t('index.qiyuProductLineDialog.securityProducts') }}
{{item.name}}
{{item.name}}
{{subitem.name}}
{{ $t('snGuideDialog.question1') }}
{{ $t('snGuideDialog.question2') }}
{{ $t('versionGuideDialog.contactCustomerService') }}
{{ $t('versionGuideDialog.intelligentCustomerService') }}
{{ $t('versionGuideDialog.getVersionInfo') }}
{{ $t('addFollow.popover') }}
{{ $t('addFollow.setEmail') }}
{{ $t('addFollow.tipDailyLimit') }}
{{ $t('bindEmailModal.cannotSeeChange')}}
{{ $t('addFollow.getCode') }}
{{ timerSecond }}{{ $t('addFollow.secondsLater') }}
{{ $t('saveSetForm.problemTip1') }}
{{ $t('saveSetForm.problemTip2') }}
{{ $t('addFollow.successTip') }}
{{ $t('addFollow.confirm') }}
{{ $t('addFollow.cancel') }}
{{ $t('caseDetail.pageCatalog') }}
{{ $t('helpTip.prefix') }}
{{ $t('helpTip.onlineService') }}
{{ $t('helpTip.suffix') }}.
{{ $t('downloadWarnModal.contentOnlyFor') }} {{powertip}}
{{ $t('downloadWarnModal.pleaseAuthFirst') }}
{{ $t('downloadWarnModal.authAsCustomer') }}
{{ $t('downloadWarnModal.authAsPartner') }}
{{ $t('downloadWarnModal.authAsEmployee') }}
{{ $t('downloadWarnModal.goToAuth') }}
{{ $t('downloadWarnModal.onlineService') }}
{{ $t('downloadWarnModal.clickToLearnAuth') }}
{{ showPowerText +' '+ $t('toolList.permission') + getPowerName }}
{{ $t('common.buttons.selectAll') }}
{{ node.label }}
{{ $t('common.buttons.cancel') }}
{{ $t('common.buttons.confirm') }}
{{ $t('toolList.download') }}
{{ $t('toolList.downloadPdf') }}
{{ $t('toolList.download') }}
{{ $t('toolList.shareContent') }}
{{ $t('toolList.copyLinkSuccess') }}
{{ $t('toolList.copyLink') }}
{{ $t('toolList.share') }}
|
{{isCurCollection ? $t('toolList.cancelCollect') : $t('toolList.collectContent')}}
{{isCurCollection ? $t('toolList.cancelCollect') : $t('toolList.collect')}}
|
{{ $t('toolList.copyMd5') }}
|
Size:{{ fileSize }}
{{ $t('index.defaultHeader.chromeBrowserTip') }}
{{ $t('index.defaultHeader.logo') }}
Athena NGFW (Next-Generation Firewall)
Athena NGFW (previously known as Network Secure) provides comprehensive protection for every network perimeter, ensuring the safety of your valuable assets, data, and users from emerging threats.
{{ $t('productSubHeader.tabs.document') }}
{{ $t('productSubHeader.tabs.bestPractice') }}
{{ $t('productSubHeader.tabs.case') }}
{{ $t('productSubHeader.tabs.software') }}
{{ $t('productSubHeader.tabs.bbs') }}
{{ $t('productDocDetail.guideClickSwitch') }}
{{ $t('productDocDetail.know') }}
{{ $t('productDocDetail.dontRemind') }}
8.0.108
{{item.code}}
Release Notes
Overview
Version Values
New Features
Changed Features
Deleted Features
Upgrade Path
Upgrade Impacts
Impacts on Services
Impacts on O&M
Upgrade Schedule
Customer Upgrade Preparations
Recommendations
Notes
Upgrade Guide
Preparations for Upgrade
Upgrade Methods
Environment Information
Customer Resource Coordination
Pre-Upgrade Check
Upgrade Limitations
Environment Check Using Pre-Upgrade Check Package
Procedure
Upgrade Procedures
Standalone Device Upgrade
HA Device Upgrade
Post-Upgrade Check
Network Connectivity Check
System Health Check
Service Status Check
Upgrade Methods
Upgrade from the GUI
Overall Upgrade Process
Upgrade Procedure
Upgrade via Central Manager
Overall Upgrade Process
Upgrade Procedure
Troubleshooting Upgrade Failures
Rollback Instructions
Precheck Error Handling
Installation of Pre-Upgrade Check Package
Recommendations for Installation Success Scenarios
0000-0002: Pre-Upgrade Check Passed
Message
Description
Reinstallation of Pre-Upgrade Check Package
0000-0004: Recommended Update Package Type
Message
Description
0002-0001: Blacklist and Whitelist Compatibility Issues (No Impact on Upgrade)
Error Message
Troubleshooting
0002-0003: Platform Connection Error (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0004: Missing Integration Key for XDR Connection (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0005: Some Platform-X Domains Inaccessible (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0006: Different CorpIDs for Connection to Platform-X and XDR (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0008: Abnormal Integration Bus Status (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0009: Potential Service Error Due to Changes in OOBM Settings (No Impact on Upgrade)
Error Message
Cause and Solution (Customer-Operable)
0002-0010: Simultaneous Connection to Cyber Guardian and Omni-Command Not Supported (No Impact on Upgrade)
Error Message
Cause and Solution (Not Customer-Operable)
0002-0011: Overload Risk Due to Traffic Forwarding Through DNS Proxy (No Impact on Upgrade)
Error Message
Cause and Solution (Not Customer-Operable)
0002-0012: Post-upgrade, historical custom/built-in URL category library data is preserved, but language switching fails during category conflicts between custom and built-in URL libraries. (No Impact on Upgrade)
Error Message
Cause and Solution (Not Customer-Operable)
0002-0013: Following the expiration of Neural-X New Threat Update license, the system upgrade to version 107 results in the built-in URL. (No Impact on Upgrade)
Error Message
Cause and Solution (Not Customer-Operable)
Recommendations for Installation Failure Scenarios
0001-0001
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
0001-0002
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
0001-0003
Error Message
Cause
Solution
0001-0004
Error Message
Cause and Solution
Recommendations
0001-0005
Error Message
Cause
0001-0006
Error Message
Cause
0002-0007
Error Message
Cause
0003-0001
Error Message
Cause
Recommendations
0003-0002
Error Message
Cause and Solution
0004-0001
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
0004-0002
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0003
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0004
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0005
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0006
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0007
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0008
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0004-0009
Error Message
Error Detection and Fixing in the Frontend (Customer-Operable)
Configuration Query in the Backend
0005-0001
Error Message
Cause
Solution
0005-0002
Error Message
Cause and Solution (Optional)
0005-0003
Error Message
Cause and Solution
0005-0005
Error Message
Cause (User Notice)
Troubleshooting
0005-0006
Error Message
Cause (User Notice)
Troubleshooting
0005-0008
Error Message
Cause (User Notice)
0005-0012
Error Message
Cause (User Notice)
Solution
SP_AF_OS_JG_php_50-108
Package Information
Upgrade Impacts
Impacts on Services
Impacts on O&M
Impacts on Customer Network
Other Impacts
Upgrade Preparations
Notes
Implementation Procedure
Post-Upgrade Service Check
Rollback Instructions
Upgrade Guide
Preparations for Upgrade
Upgrade Tools
Environment Information
Customer Resource Coordination
Pre-Upgrade Check
Notes
Upgrade Conditions
Smooth Upgrade of Configurations, Logs, and Data
Upgrade Recommendations
Sangfor CMC/Central Manager
HA/Multiple Nodes/Cluster/Distributed Nodes
Upgrade Procedure
Upgrade Path
Upgrade Procedure
Platform Check
Service Status Check
Troubleshooting Upgrade Failures
Rollback Instructions
Hardware Guide
Device Appearance
Appearance of 1U Device
Appearance of 2U Device
Deployment Environment Requirements
Data Center Power Distribution System
Data Center Environment
Data Center Layout Recommendations
Data Center Lightning Protection and Grounding
Data Center Safety Hazard Inspection
Device Installation
Device Relocation
Electrical Safety
ESD Protection
Laser Safety
Rack-Mounted Installation
Ventilation and Heat Dissipation
Temperature and Humidity
Cleanliness
System Grounding
Device Installation
Installation Tools
Installation Flowchart
Pre-installation Inspection
Rack Mounting for Desktop Devices
Rack Mounting for 1U Devices
Rack Mounting for 2U Devices
Installation of Selected NICs
Post-installation Inspection
Hardware Troubleshooting
The Device Fails to Power on After the Power Cable Is Connected and the Power Button Is Pressed
The Device Repeatedly Restarts
The Logo/POWER Indicator Remains Off
The Device Buzzes
Indicators on Multiple Consecutive Ports Remain Off
The Network Port Indicator Remains Off After the Network Cable Is Connected
The Optical Port Indicator Remains Off After the Optical Module Is Connected
The ALARM Indicator Remains On
The ALARM Indicator Blinks
The ALARM and HA Indicators Blink Alternately
The BYPASS Indicator Remains On
The STATUS Indicator Remains On During Device Operation
Quick Start & Deployment
Getting Started
Device Appearance
Deployment Environment Requirements
Device Installation
Hardware Troubleshooting
Device Management and License Activation
License Introduction
License Expiration
Web Console Overview
Deployment Guide
Basic Network Configuration
Deployment Troubleshooting
Deploy vNGFW Instances on Virtualization Platforms
Deployment Notes
Configuration Conversion Platform
Key Features and Benefits
Limits
User Guide
Prerequisites
Configuration Conversion Procedure
Import Converted Configurations to Athena NGFW
Roll Back Imported Configurations
Replacing Fortigate with NGFW
Overview and Migration Process Overview
Overview
List of Key Feature Compatibility Features and Migration Order
Pre-Migration Preparation (Critical)
Device and Version Information
Network and Service Review
FortiGate Configuration Export and Backup
FortiGate Configuration Export Methods (CLI / Web Interface)
Sangfor Firewall Initialization and Configuration Backup
Key Functional Differences Between Fortigate and Sangfor NGFW
VODM
Fortigate VDOM
Virtual System of NGFW
NAT
Fortigate's Central NAT and Regular NAT
NGFW’s NAT
IPSEC
IPSEC
How to Migrate from FortiGate to Sangfor NGFW
SD-WAN and Policy-Based Routing
FortiGate SD-WAN and Policy-Based Routing
NGFW SDWAN and Policy Based Routing
Firewall Policy
Firewall Policy of Fortigate
Policy of NGFW
Manual Migration Configuration
Modify the Interface Configuration
Bind the Interface and Zone
Migrate Software Switch Interface
Policy Template Migration
WAF
IPS
URL Filter
Antivirus
Security Protection Policy Migration
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
SSL Decryption
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
Logs and Alert
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
AD / LDAP
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
HA
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
Fortigate IPSec Migration
Fortigate Configuration Example
Fortigate Parameter Explanation and Conversion Suggestions
Migrate to Sangfor NGFW
SD-WAN Migration
PBR
SD-WAN
Testing and Validation
Functional Validation Checklist
Verification Methods and Common Troubleshooting
Cutover and Rollback Plan
Cutover Objectives and Principles
Cutover Timing and Window Selection
Pre-Cutover Checklist
Configuration Preparation
Environment Preparation
Cutover Procedure
Phase 1: Preparation
Phase 2: Network Cutover Implementation
Business Verification
Rollback Plan
Principles
Rollback Steps
Fast Rollback Tips
Post-Cutover Optimization and Best Practices
Policy Optimization
Merge Duplicate Policies
Delete Unused Objects
Object Hierarchical Management
Log and Reporting Configuration
Integrate with log center
Enable Alert Notifications
Security Policy Audit Recommendations
Appendices and Support Information
Administrator Guide
Network
Interface
Interface Overview
Physical Interfaces
Subinterfaces
VLAN Interfaces
Aggregate Interfaces
Local Loopback Interfaces
GRE Tunnels
VPN Tunnel Interfaces
Link State Propagation
Interface Notes
Zone
Introduction
Scenarios
Principles
Procedure
Case: Configure Zones for Control Based on Security Policies in the Scenario of Enterprise Intranet/Internet Isolation
Notes
Troubleshooting of Typical Issues
Virtual Wire
Introduction
Principle
Configuration Steps and Example
Configuration Notes
Troubleshooting
Static Routes
Introduction
Scenarios
Principles
Configure IPv4 Static Routes
Configure IPv6 Static Routes
Bulk Create Static Routes
Configure Routes for the Access Between Virtual Systems
Notes
Case: Configure a Default Route for Internet Access
Case: Configure Cross-Layer 3 Network Routes
Case: Configure Floating Static Routes for Route Backup
Troubleshooting of Typical Issues
Maintenance Commands
Policy-Based Routes
Introduction
Scenarios
Principles
Configure a Source-Based Route
Configure a Link Load-Balancing Route
Configure ISP-Based Routing
Notes
Case: Configure a Source-Fixed Policy-Based Route
Case: Configure a Link Load-Balancing.Route
Case: Configure a Multi-ISP Policy-Based Route
Troubleshooting of Typical Issues
Maintenance Commands
Multicast Routes
Introduction
Scenarios
Principles
Configure a Multicast Route
Notes
Case: Configure Multicast Forwarding for Video Conferencing
Case: Configure Multicast Forwarding for Surveillance Video Streams
Troubleshooting of Typical Issues
Maintenance Commands
Dynamic Routes
Introduction
OSPF Scenarios
OSPF Principles
OSPFv2 Configuration Steps
OSPFv3 Configuration Steps
Case: Single-Area OSPF Networking.
Case: Multi-Area OSPF Networking
OSPF Configuration Notes
Troubleshooting of Typical OSPF Issues
BGP Scenarios
BGP Principles
BGP Configuration Steps
BGPv6 Configuration Steps
Case: Basic eBGP Networking
Case: iBGP Full-Mesh Networking
BGP Configuration Notes
Troubleshooting of Typical BGP Issues
RIP Scenarios
RIP Principles
RIP Configuration Steps
Case: Basic RIP Networking
RIP Configuration Notes
Troubleshooting of Typical RIP Issues
Route Testing
Introduction
Scenarios
Principles
Conduct Route Testing
Notes
Troubleshooting of Typical Issues
Access Lists
Introduction
Principles for Access Lists
Access List Parameters
Route Maps
Introduction
Principles for Route Maps
Route Map Parameters
DNS
Introduction
Limits
DNS Service Configuration on Athena NGFW
Introduction and Configuration of DNS Proxy
Introduction and Configuration of DNS64
Introduction and Configuration of DNS Transparent Proxy
Introduction and Configuration of DNS-Mapping
Introduction and Configuration of DDNS
DNS Log Audit Configuration
Notes
Troubleshooting of Typical Issues
DHCP
Introduction
Scenarios
Introduction and Configuration of the DHCP Server
Case: DHCP Automatic Assignment in an Enterprise Office Network
Introduction and Configuration of the DHCP Relay
Case: Centralized DHCP Address Assignment Across Subnets
Introduction and Configuration of DHCPv6
Notes
Troubleshooting of Typical Issues
ARP
Introduction
Introduction and Configuration of Static ARP
Introduction and Configuration of ARP Proxy
Introduction and Configuration of ARP Spoofing Protection
Configuration Notes
Troubleshooting of Typical Issues
Advanced
TCP MSS
Optical Bypass Module
Second-Passthrough Traffic
SSL VPN
Online Users
Deployment
Local Users
Resources
Roles
Login Options
Virtual IP Pool
Logging In
Authentication
Certificate
Resource Options
Local DNS
Policies
Policy System Overview
Access Control Policies
Application Control Policies
Configuration Steps
Geolocation Blocking
Local ACL
Connection Control
NAT Policy
Overview
Introduction
IPv4 SNAT
IPv4 DNAT
Bidirectional NAT
NAT64
DNS Mapping
Security Protection Policies
Overview
Introduction
Security Protection Policy Creation
Content Security Policies
Intrusion Prevention Policy
Botnet Detection
Anti-DDoS
IoT Security
Advanced Settings
SSL Decryption Policy
Introduction
Configuration Steps
Bandwidth Management Policy
Introduction
Virtual Links
Virtual Link Rules
Channel Configuration
Configuration Case for Bandwidth Management Policy
User Internet Access Security Case
Internet Access Security - URL Filtering (QUIC)
Internet Access Security - Application Control Policy Configuration
Enterprise Internal Network Security Management (NAT + ACL + IPS + Whitelist + Traffic Control)
Server Protection Case
Server Service Protection (NAT + IPS + ACL)
SSL Decryption + Security Protection
Object Management
Object System Overview
Role of Objects in Athena NGFW Policies
Object Type Description
Reference Between Objects and Policies
Network Object Management
Introduction
Parameter Description
Link State Probe
Quality Detection
Failure Detection
Services
Services
Service Groups
Security Policy Template
Intrusion Prevention
Web App Firewall
Botnet Detection
Content Security Policy
Threat Signature Database
Overview
Security Database
Custom Database
Content Identification Database
Overview
Application Signatures
URL Category
File Types
SLB Server Pools
IP Location Database
ISP
IP Location
Schedule
One-Time Schedule
Recurring Schedule
Monitor
Security Logs
Security Logs
Threat Deception Logs
Unauthorized Outbound Access Logs
Spoofed Access Logs
Phishing Email Protection Logs
Access Logs
Application Control Logs
User Authentication Logs
SSL VPN Logs
System Logs
Admin Operation Logs
System Security Logs
Local ACL Logs
Top N
Top N Options
Sessions
Session List
Traffic Ranking
Suspicious Traffic
Session Ranking
Bandwidth Management
Statistics
Application
Traffic
Report
Security Report
Report Subscription
Diagnosis
Packet Tracing
SOC
Security Operations
IoT Security
Assets
Asset Discovery
Private Network Access
IoT Solution
Business Asset Security
Summary
Attack Events
User Security
Summary
Attack Events
Specialized Protection
Asset Management
Ransomware Protection
IP Reputation
Account Protection
Blacklist/Whitelist
Blacklist
Whitelist
Next-Gen Security
IPsec
Basics of IPsec VPN
IPsec VPN Tunnel Establishment Process
IPsec Encapsulation Modes
IPsec Security Protocols
IKEv1 and IKEv2
Route- and Policy-Based IPsec VPNs
IPsec VPN in Athena NGFW
Deployment Scenarios
Requirements for Establishing IPsec VPN Tunnels with Third-Party Devices
Major Steps for IPsec Configuration in Athena NGFW
Basic Configuration for IPsec VPN Tunnel Establishment in Athena NGFW
VPN Service Management and Status Monitoring
VPN Tunnel Status Alerts
VPN Links
Multi-Link IPsec VPN
VPN Tunnel Interface
IPsec VPN Authentication Methods
IPsec VPN Logs and Troubleshooting
Design and Planning of IPsec VPN Networking
Policy-Based IPsec VPN Configuration in Site-to-Site Single-Link Scenarios
Policy-Based IPsec VPN Configuration in Site-to-Site Multi-Link Scenarios
One-to-One IPsec Tunnel Construction in Dual-Site Multi-WAN Scenarios
Many-to-Many IPsec Tunnel Construction in Dual-Site Multi-WAN Scenarios
One-to-Many IPsec Tunnel Construction in Single-Side Multi-WAN Scenarios
Policy-Based IPsec Tunnel Redundancy and Path Selection in Multi-Link Scenarios
Redundancy Mechanism of Policy-Based IPsec VPN Tunnels
Path Selection Mechanism of Policy-Based IPsec VPN Tunnels
OSPF over GRE over IPsec Configuration in Policy-Based Mode
Route-Based IPsec VPN Configuration in Site-to-Site Single-Link Scenarios
Route-Based IPsec VPN Configuration in Site-to-Site Multi-Link Scenarios
One-to-One IPsec Tunnel Construction in Dual-Site Multi-WAN Scenarios
Many-to-Many IPsec Tunnel Construction in Dual-Site Multi-WAN Scenarios
One-to-Many IPsec Tunnel Construction in Single-Side Multi-WAN Scenarios
Route-Based IPsec VPN Tunnel Redundancy and Path Selection in Multi-Link Scenarios
Route-based IPsec VPN Tunnel Redundancy
IPsec VPN Tunnel Redundancy and Path Selection via Policy-Based Routing
IPsec VPN Tunnel Redundancy and Path Selection via Dynamic Routing
IPsec VPN Configuration in Hub-and-Spoke Scenarios
Hub-and-Spoke Architecture Introduction
Scenario and IPsec Type Selection
Establishment of IPsec VPN Tunnels with Third-Party Devices
IPsec VPN Tunnel Between Athena NGFW and Fortinet (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and Fortinet (Policy Mode)
IPsec VPN Tunnel Between Athena NGFW and Palo Alto (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and GCP (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and Microsoft Azure (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and AWS (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and Juniper (Route Mode)
IPsec VPN Tunnel Between Athena NGFW and Cisco (Route Mode, IKEv1)
IPsec VPN Tunnel Between Athena NGFW and Cisco (Route Mode, IKEv2)
Use Cases
Troubleshooting for Common Issues
IPsec VPN Tunnel Negotiation Failure
Service Communication Failure After Successful IPsec VPN Tunnel Establishment
Slow or Degraded Performance After Successful IPsec VPN Tunnel Establishment
Unexpected IPsec VPN Tunnel Disconnections
Sangfor VPN
Basic Principles
Overview and Core Concepts
Roles and Network Topology
Tunnel Negotiation Process
Data Encapsulation and Routing
IPv6 Support
Routing Mechanism
VPN Route Types
VPN Route Matching Rules
Route Priority Settings
Network Configuration Process and Functional Components
Overview of the Network Configuration Process
Prerequisites
Functional Components
Monitoring Status
VPN Status
VPN Device Roles
Throughput on VPN Interface
Tunnels
Basic Component Configuration
VPN Links
Certificate System
Intranet Service Publishing
VPN Users
Add a VPN User
VPN Connections
Multi-HQ VPN
SD-WAN Path Selection
Tunnel Routes
RIP Routes
Multicast Services
Schedules
VPN Wizard
Advanced Features
Auto VPN
Global Acceleration
Sangfor VPN Quick Configuration Example
Network Planning
Configuration Steps
Result Verification
Case 1: Branch‑to‑Branch Communication
Case 2: Branch-to-Internet via HQ
Case 3: Sangfor VPN Multi-Center
Case 4: Tunnel NAT
Case 5: Establish Tunnels Between HQ and Branches via Auto VPN
Troubleshooting
Pre-Inspection for Common Items
Failed VPN Connection
Abnormal VPN Interconnection
VPN Packet Loss
SD-WAN Smart Path Selection and Link Optimization
Overview
Principles of the BEST Smart Path Selection
Application Identification Technology
Link Quality Test
SD-WAN Smart Path Selection Policy
SD-WAN Link Switching Rules
Tunnel QoS
Principle of the SOFAST Link Optimization Engine
Adaptive FEC
Adaptive FEC Process
Scenarios
Multi-Link Hybrid Networking
Automatic Switch upon Link Degradation
High Packet-Loss Network Optimization
Core Business Guarantee
Configuration Steps
Configure BEST Path Selection
Configure SOFAST Link Optimization
Configure App Categories
Case 1: AutoGO Smart Path Selection
Case 2: Optimal-Quality Path Selection
Case 3: Packet Loss Optimization for Bandwidth-Intensive Apps using SOFAST Optimization
Notes
Troubleshooting Typical Issues
Issue 1: BEST Path Selection Does Not Take Effect
Issue 2: SOFAST Optimization Does Not Take Effect
Issue 3: Frequent Link Switching
User Authentication
Introduction
User Authentication Overview
Authentication Method
Features
Authentication Configuration Process
Determine the User Source Type
Configure an Authentication Policy
View User Online Status
User and Group Management
Authentication Status
Group/User Management
User Import
Case: Organizational Structure Synchronization by Using LDAP User Sync
Case: Security Group Synchronization by Using LDAP User Sync
Authentication Options
SSO Options
Auth Page Redirection
Authentication Conflict
Obtain MAC by SNMP
Others
No Authentication
Introduction
Scenarios
Principle
Case: Dedicated Personnel and Device Control for Internet Access in Sensitive Positions
Case: Obtain Real MAC Addresses Through SNMP for Internet Access Authentication
Local Password Authentication
Introduction
Scenarios
Case: Shared Account Authentication for Office Internet Access
Case: Internet Access Using SSL Custom Certificate Authentication
External Password Authentication
Introduction
Scenarios
Configure an LDAP Server
Configure a RADIUS server
Configure a POP3 Server
Case: Unified LDAP Authentication for Internet Access by Engineering Department Employees
RADIUS SSO
Introduction
Scenarios
Configuration Steps
Notes
AD SSO
Introduction
AD SSO Types
Case: Authentication for Internet Access in the Domain Script Distribution Mode
Case: SSO Authentication for Internet Access in the Domain Monitoring Mode
Case: SSO Authentication for Internet Access in the Listening Mode
Other SSO Options
Proxy SSO
POP3 SSO
Web SSO
Security Group
Introduction
Scenarios
Quick Configuration Guide
Security Group Creation and Configuration
Online Users and Security Groups
Case: Reference Security Groups in Application Control Policies
Case: Reference Security Groups in Bandwidth Management Policies
Case: Reference Security Groups in Security Policies
Troubleshooting Common Issues
Troubleshooting Typical Issues
Authentication Page Cannot Be Displayed
Password Authentication Failed
SSO Does Not Take Effect
System
Web UI
SSL Certificate Import for HTTPS Access to the Web Console
System Time, Daylight Saving Time, and NTP Keys
Configure the System Time
Configure DST Rules
NTP Key
General Settings
Network
Email & SMS Server
Hosts
Privacy Options
Licensing
OOBM
Security Capability Update
Example of Offline Database Update
Troubleshooting
Precise Traffic Analysis
Detection
Passthrough
Analysis of Traffic to NGFW
Packet Capture, Technical Support, and Packet Replay
Logs
Web Console
SNMP
Administrators
Account Creation, Password Security Policy, and External Authentication Server
Email-Based MFA
TOTP-Based MFA
Virtual Systems
Basic Concepts
System Management
Resource Pools
Virtual System Configuration Example
Backup/Restore & Automatic Configuration Synchronization to a Third-Party Server
System Upgrade, Rollback, Upgrade History, and Upgrade Logs
Restart
Service Packs
High Availability
Device Management
Central Management
Routine O&M
Device Health Check
Device Status Indicator Check
Interface Indicator Check
Device Operating Status Check
Account Permissions and Operation Audit
Console Account Security Check
Database Update
Check Procedure
Service Packs
Scenarios and Configurations
Backup/Restore
Manual Backup
Automatic Backup
Device Configuration Restoration and Password Recovery
USB-Based Password Recovery
Restore to Factory Defaults via the Console
System Log Check
Emergency Response
Emergency Response for Network and Service Interruption
Network-Wide or Large-scale Network Interruption
Individual or Partial Business System Access Abnormalities
Log Analysis and Fault Location
Device Hardware Fault Emergency Response
Security Incident Emergency Response
Data Backup and Configuration Recovery
Password Recovery
Log and Monitoring System Emergency Response
Log Not Found or Data Anomalies
Monitoring Data Reporting Failure
Device Upgrade
Version Values
New Features
Changed Features
Deleted Features
Upgrade Path
Upgrade Impacts
Impacts on Services
Impacts on O&M
Upgrade Schedule
Customer Upgrade Preparations
Recommendations
Notes
Upgrade Guide
Preparations for Upgrade
Pre-Upgrade Check
Upgrade Procedures
Post-Upgrade Check
Upgrade Methods
Upgrade from the GUI
Upgrade via Central Manager
Troubleshooting Upgrade Failures
Rollback Instructions
Project Implementation Guide
Specs
Required Domains and Ports List for Network Connectivity
Syslog Field Description and Log Examples
NGFW Open Ports
SNMP OID List
SDKs, APIs
API Document
CLI Document
Emergency Response Plan
Emergency Information Collection
Core Business Scenarios
Emergency Information Collection
Emergency Plan
Emergency Scenarios and Recovery Time
Abnormal Access to Specific Business
Possible Causes
Rapid Troubleshooting
Emergency Recovery Methods
Overall Slowness in Network Access
Possible Causes
Rapid Troubleshooting
Emergency Recovery Methods
Emergency Recovery for an Overall Business Interruption Scenario (Virtual Wire/Transparent Deployment)
Possible Causes
Rapid Troubleshooting
Emergency Recovery Methods (HA Scenario)
Emergency Recovery Methods (Standalone Scenario)
Emergency Recovery for an Overall Business Interruption Scenario (Routing Deployment)
Possible Causes
Rapid Troubleshooting
Emergency Recovery Methods (HA Scenario)
Emergency Recovery Methods (Standalone Scenario)
Emergency Response for Network and Service Interruption
Network-Wide or Large-scale Network Interruption
Individual or Partial Business System Access Abnormalities
Log Analysis and Fault Location
Device Hardware Fault Emergency Response
Security Incident Emergency Response
Data Backup and Configuration Recovery
Password Recovery
Log and Monitoring System Emergency Response
Log Not Found or Data Anomalies
Monitoring Data Reporting Failure
Security Hardening
Document Overview
Network Secure Security Enhancement
Physical Security
Mandatory Requirements
Configuration Guide
Firmware Version and Patches
Mandatory Requirements
Configuration Guide
System Time
Mandatory Requirements
Configuration Guide
Administrator Account
Mandatory Requirements
Configuration Guide
Remote Access Control
Mandatory Requirements
Configuration Guide
Log Storage
Mandatory Requirements
Configuration Guide
Log Auditing
Mandatory Requirements
Configuration Guide
SNMP Monitoring
Mandatory Requirements
Configuration Guide
Configuration Backup
Mandatory Requirements
Configuration Guide
Use Sangfor Checks
Mandatory Requirements
Configuration Guide
Disclaimer and Technical Support
Disclaimer
Technical Support:
Athena NGFW (Next-Generation Firewall)
{{ breadTitle }}
Administrator Guide
IPsec
IPsec VPN Configuration in Hub-and-Spoke Scenarios
{{sendMatomoQuery("Athena NGFW (Next-Generation Firewall)", "IPsec VPN Configuration in Hub-and-Spoke Scenarios")}}
IPsec VPN Configuration in Hub-and-Spoke Scenarios
{{ $t('productDocDetail.updateTime') }}: 2026-11-02
Hub-and-Spoke Architecture Introduction
Scenario and IPsec Type Selection
{{ language }}
{{ $t('index.defaultHeader.chromeBrowserTip') }}