L2TP远程拨号配置实验

一、实验目的及拓扑

首先在客户端云与NAS（FW2）之间建立PPPoE连接，其次NAS（FW2）与服务端FW1之间通过L2TP方式建立隧道，最后客户端云与服务端FW1之间通过PPP方式建立连接

二、基本配置

（一）根据拓扑设置各接口地址

（二）将两个防火墙外网接口加入untrue，将两个内容接口加入trust，将两个虚拟模板接口加入dmz区域

[FW2]dis zone 
local
 priority is 100
 interface of the zone is (0):
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet0/0/0
    GigabitEthernet1/0/1
#
untrust
 priority is 5
 interface of the zone is (1):
    GigabitEthernet1/0/0
#
dmz
 priority is 50
 interface of the zone is (1):
    Virtual-Template1
#

[FW1]dis zone 
local
 priority is 100
 interface of the zone is (0):
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet0/0/0
    GigabitEthernet1/0/1
#
untrust
 priority is 5
 interface of the zone is (1):
    GigabitEthernet1/0/0
#
dmz
 priority is 50
 interface of the zone is (1):
    Virtual-Template1
#

三、详细配置

（一）在FW2（NAS）上配置PPPoE服务器端和L2TP用户端

[R1]l2tp enable

[FW2-l2tp-1]dis th
#
l2tp-group 1
 tunnel password cipher Huawei@123
 tunnel name LAC
 start l2tp ip 155.1.131.13 domain default
#

[FW2-Virtual-Template1]dis th
#
interface Virtual-Template1
 ppp authentication-mode chap
 remote address 10.1.1.128    //客户端云电脑地址
 ip address 10.1.1.254 255.255.255.0      //指定本端地址
#

[FW2-GigabitEthernet1/0/1]dis th
#
interface GigabitEthernet1/0/1
 pppoe-server bind Virtual-Template 1
#

[FW2]user-manage user USER

  password Huawei@123

（二）在FW1(LNS)上配置

1、配置ppp拨号用户地址池

[FW1-ip-pool-L2TP_POOL]dis th
#
ip pool L2TP_POOL
 section 0 192.168.0.1 192.168.0.10
#

2、设置业务方案

[FW1-aaa]DIS TH
aaa
 service-scheme LOCAL
  ip-pool L2TP_POOL

 domain default
  service-type internetaccess ssl-vpn l2tp ike
  internet-access mode password
  reference user current-domain

3、配置虚拟接口

[FW1-Virtual-Template1]dis th
#
interface Virtual-Template1
 ppp authentication-mode chap
 remote service-scheme LOCAL
 ip address 192.168.0.12 255.255.255.0
#

4、配置L2TP

[FW1]l2tp enable 

[FW1-l2tp-1]DIS TH
#
l2tp-group 1
 tunnel password cipher Huawei@123
 tunnel name LNS
 allow l2tp virtual-template 1 remote LAC domain default
#

5、将虚接口加入dmz区域

[FW1-zone-dmz]dis th
#
firewall zone dmz
 set priority 50
 add interface Virtual-Template1
#

6、配置安全策略

[FW1-policy-security]dis th
2024-07-17 08:23:24.810 
#
security-policy
 rule name LOCAL_TO_ANY
  source-zone local
  action permit
 rule name OUT_TO_LOCAL
  source-zone untrust
  destination-zone local
  service protocol udp destination-port 1701
  action permit
 rule name DMZ_TO_IN
  source-zone dmz
  destination-zone trust
  source-address 192.168.0.0 mask 255.255.255.0
  destination-address 10.1.12.0 mask 255.255.255.0
  action permit
#

四、结果验证

在云终端上拨号用户名：USER，密码：Huawei@123

NAS端FW2上验证结果

[FW2]dis l2tp tunnel 
L2TP::Total Tunnel: 1

 LocalTID RemoteTID RemoteAddress    Port   Sessions RemoteName  VpnInstance
 ------------------------------------------------------------------------------
 1        1         155.1.131.13     1701   1        LNS                     
 ------------------------------------------------------------------------------
  Total 1, 1 printed

LNS服务端FW1上验证结果

[FW1]dis l2tp tunnel 
L2TP::Total Tunnel: 1

 LocalTID RemoteTID RemoteAddress    Port   Sessions RemoteName  VpnInstance
 ------------------------------------------------------------------------------
 1        1         155.1.121.12     65335  1        LAC                     
 ------------------------------------------------------------------------------
  Total 1, 1 printed