一 组网说明

如上图，防火墙作为出口安全设备，对外配置NAT实现内网用户访问互联网，对内提供l2tp服务器拨入，允许外部用户拨入l2tp后再访问内网服务器资源

二 防火墙L2TP配置

sysname FW1000

#

acl advanced 3000 //配置nat acl

rule 0 permit ip

#

interface GigabitEthernet1/0/4 //防火墙连接互联网接口配置NAT

port link-mode route

ip address x.142.88.98 255.255.255.240

nat outbound 3000

manage https inbound

manage ping inbound

gateway x.142.88.97

#

ip pool aaa x.153.207.2 x.153.207.10  //配置l2tp vpn地址池

ip pool aaa gateway x.153.207.1 

#

l2tp enable //使能l2tp

#

l2tp-group 1 mode lns //配置l2tp group

allow l2tp virtual-template 1

undo tunnel authentication

tunnel name lns

#

domain l2tp//配置l2tp domain

authentication portal local

#

interface Virtual-Template1 //配置l2tp VT接口

ppp authentication-mode chap domain l2tp 

ppp ipcp dns 114.114.114.114 

remote address pool aaa 

ip address x.153.207.1 255.255.255.0

#

security-zone name VPN //配置l2tp接口加入到安全域

import interface Virtual-Template1

#

local-user renyq class network //配置l2tp本地用户

password simple 123

service-type ppp

authorization-attribute user-role network-operator

#

nat global-policy //配置nat策略

rule name GlobalPolicyRule_3

source-zone Trust

destination-zone Untrust

source-ip subnet x.153.151.248 29

action snat easy-ip

#

security-policy ip//配置访问控制策略

rule 7 name l2tp

  action pass

  logging enable

  counting enable

  profile 7_IPv4

  source-zone Untrust

  destination-zone Local

  service l2tp

#

三 L2TP状态查看

<FW1000>

Domain: l2tp

 State: Active

 Portal authentication scheme:  Local

 Default authentication scheme:  Local

 Default authorization  scheme: Local

 Default accounting     scheme: Local

 Accounting start failure action: Online

 Accounting update failure action: Online

 Accounting quota out action: Offline

Service type: HSI

Session time: Exclude idle time

NAS-ID: N/A

DHCPv6-follow-IPv6CP timeout: 60 seconds

Authorization attributes:

Idle cut: Disabled

Session timeout: Disabled

IGMP access limit: 4

MLD access limit: 4