L2TP实验(ensp)

一、实验拓扑

二、基础配置

FW1：

安全区域

[FW1]firewall zone trust   
[FW1-zone-trust]add int GigabitEthernet 1/0/0

安全策略：

[FW1]security-policy 
[FW1-policy-security]default action permit

FW2：

安全区域：

[FW2]firewall zone trust 
[FW2-zone-trust]add int GigabitEthernet 1/0/0
[FW2]firewall zone untrust 
[FW2-zone-untrust]add int GigabitEthernet 1/0/1

IP：

[FW2]interface  GigabitEthernet 1/0/1
[FW2-GigabitEthernet1/0/1]ip add 20.1.1.1 24

FW3：

安全区域：

[FW3]firewall zone trust  
[FW3-zone-trust]add interface GigabitEthernet 1/0/1
[FW3]firewall zone untrust 
[FW3-zone-untrust]add interface GigabitEthernet 1/0/0

IP：

[FW3]interface GigabitEthernet 1/0/0
[FW3-GigabitEthernet1/0/0]ip add 20.1.1.2 24
[FW3]interface g 1/0/1
[FW3-GigabitEthernet1/0/1]ip address 192.168.1.254 24

建立PPPoE连接，设定拨号接口VT接口：

FW1：

[FW1]interface Dialer 1
[FW1-Dialer1]dialer user user1
[FW1-Dialer1]dialer-group 1
[FW1-Dialer1]dialer bundle 1
[FW1-Dialer1]ip address ppp-negotiate
[FW1-Dialer1]ppp chap user user1
[FW1-Dialer1]ppp chap password cipher Password123
[FW1-Dialer1]dialer-rule 1 ip permit
[FW1]int g1/0/0    
[FW1-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1

FW2:

[FW2]interface Virtual-Template 1
[FW2-Virtual-Template1]
Mar 21 2025 09:05:41 FW2 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3
.1 configurations have been changed. The current change number is 6, the change 
loop count is 0, and the maximum number of records is 4095.
[FW2-Virtual-Template1]ppp authentication-mode chap
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[FW2-Virtual-Template1]ip address 2.2.2.2 24
[FW2]firewall zone dmz     
[FW2-zone-dmz]add interface Virtual-Template 1
[FW2]interface g 1/0/0
[FW2-GigabitEthernet1/0/0]pppoe-server bind virtual-template 1
[FW2]aaa
[FW2-aaa]domain default 
[FW2-aaa-domain-default]user-manage user user1 domain default 
[FW2-localuser-user1]password Password123

FW3：

[FW3]ip pool l2tp
[FW3-ip-pool-l2tp]section 0 172.16.0.2 172.16.0.100
[FW3]aaa
[FW3-aaa]service-scheme l2tp
Info: Create a new service scheme.
[FW3-aaa-service-l2tp]ip-pool l2tp
[FW3-aaa]domain default 
[FW3-aaa-domain-default]service-type l2tp
[FW3]user-manage user user1 domain default 
[FW3-localuser-user1]password Password123
[FW3]interface Virtual-Template1
[FW3-Virtual-Template1]
Mar 21 2025 09:13:14 FW3 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3
.1 configurations have been changed. The current change number is 16, the change
 loop count is 0, and the maximum number of records is 4095.
[FW3-Virtual-Template1]ppp authentication-mode chap 
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[FW3-Virtual-Template1]ip add 172.16.0.1 24
[FW3-Virtual-Template1]remote service-scheme l2tp
[FW3]firewall zone dmz
[FW3-zone-dmz]add int Virtual-Template 1
[FW3]l2tp enable 
[FW3]l2tp-group 1
[FW3-l2tp-1]allow l2tp virtual-template 1 remote lac domain default    
[FW3-l2tp-1]tunnel authentication
[FW3-l2tp-1]tunnel password cipher Hello123

强制chap认证：

[FW3]l2tp-group 1   
[FW3-l2tp-1]mandatory-chap 
[FW3-l2tp-1]mandatory-lcp

FW1：

[FW1]IP route-static 0.0.0.0 0.0.0.0 Dialer1

安全策略：

[FW2]security-policy
[FW2-policy-security]default action deny 
 Warning: Setting the default interzone packet filtering to deny may affect actu
al data traffic. You are advised to configure the security policy based on the a
ctual services. Are you sure you want to continue? [Y/N]y
[FW2-policy-security]rule name l_un
[FW2-policy-security-rule-l_un]source-zone local
[FW2-policy-security-rule-l_un]destination-zone untrust 
[FW2-policy-security-rule-l_un]source-address 20.1.1.1 32
[FW2-policy-security-rule-l_un]source-address 20.1.1.1 32
[FW2-policy-security-rule-l_un]destination-address 20.1.1.2 32
[FW2-policy-security-rule-l_un]service l2tp 
[FW2-policy-security-rule-l_un]service protocol udp source-port 0 to 65535 desti
nation-port 1701
 

FW3

[FW3]security-policy
[FW3-policy-security]rule name l2tp
[FW3-policy-security-rule-l2tp]source-zone untrust 
[FW3-policy-security-rule-l2tp]destination-zone local 
[FW3-policy-security-rule-l2tp]source-address 20.1.1.1 32
[FW3-policy-security-rule-l2tp]destination-address 20.1.1.2 32
[FW3-policy-security-rule-l2tp]service l2tp
[FW3-policy-security-rule-l2tp]service protocol udp destination-port 1701
[FW3-policy-security-rule-l2tp]action permit 
[FW3-policy-security-rule-l2tp]rule name icmp
[FW3-policy-security-rule-icmp]source-zone dmz 
[FW3-policy-security-rule-icmp]destination-zone trust 
[FW3-policy-security-rule-icmp]source-address 172.16.0.0 24
[FW3-policy-security-rule-icmp]destination-address 192.168.1.0 24
[FW3-policy-security-rule-icmp]action permit 
 

测试：