L2TP实验

一、实验拓扑图

二、实验需求 

让FW1（PPPoE Client）模拟拨号用户，向内部服务器发送建立拨号连接的请求，并保证连通。

 

三、实验配置

1、基础配置

 配置接口以及安全区域划分

[PPPoE Client]int g 0/0/0	
[PPPoE Client-GigabitEthernet0/0/0]service-manage all permit 
[PPPoE Client-GigabitEthernet0/0/0]q
[PPPoE Client]firewall zone trust 
[PPPoE Client-zone-trust]add interface g 1/0/0
[PPPoE Client-zone-trust]q

[NAS]int g 0/0/0
[NAS-GigabitEthernet0/0/0]ip add 192.168.0.2 24
[NAS-GigabitEthernet0/0/0]service-manage all permit 
[NAS-GigabitEthernet0/0/0]int g 1/0/1
[NAS-GigabitEthernet1/0/1]ip add 20.1.1.1 24
[NAS-GigabitEthernet1/0/1]q
[NAS]firewall zone untrust 	
[NAS-zone-untrust]add int g 1/0/1
[NAS-zone-untrust]q
[NAS]firewall zone trust 	
[NAS-zone-trust]add int g 1/0/0
[NAS-zone-trust]q

[LNS]int g 0/0/0
[LNS-GigabitEthernet0/0/0]ip add 192.168.0.3 24
[LNS-GigabitEthernet0/0/0]service-manage all permit 
[LNS-GigabitEthernet0/0/0]int g 1/0/0
[LNS-GigabitEthernet1/0/0]ip add 20.1.1.2 24
[LNS-GigabitEthernet1/0/0]int g 1/0/1
[LNS-GigabitEthernet1/0/1]ip add 192.168.1.254 24
[LNS-GigabitEthernet1/0/1]q	
[LNS]firewall zone untrust 
[LNS-zone-untrust]add int g 1/0/0
[LNS-zone-untrust]q
[LNS]firewall  zone trust 
[LNS-zone-trust]add int g 1/0/1

 

2、L2TP配置 

1. 建立PPPoE连接，设定拨号接口VT接口

Client

[PPPoE Client]interface Dialer 1
[PPPoE Client-Dialer1]dialer user user1 ---设定拨号用户名
[PPPoE Client-Dialer1]dialer-group 1 ---创建拨号组
[PPPoE Client-Dialer1]dialer bundle 1 ---设定拨号程序捆绑包
[PPPoE Client-Dialer1]ip address ppp-negotiate   ---设定IP地址获取方式为PPP邻居
分配，PPP邻居通过IPCP协议进行分配，即PPP的NCP协商过程所用协议
[PPPoE Client-Dialer1]ppp chap user user1
[PPPoE Client-Dialer1]ppp chap password cipher Password123
[PPPoE Client]dialer-rule 1 ip permit   ---配置拨号访问控制列表，允许所有IPv4报文
通过拨号口，数字1必须与拨号组编号相同。
[PPPoE Client]int g 1/0/0
[PPPoE Client-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1 ---在物
理接口上启动PPPoE Client程序，绑定拨号程序包，编号为1

NAS

[NAS]interface Virtual-Template 1
[NAS-Virtual-Template1]ppp authentication-mode chap
[NAS-Virtual-Template1]ip address 2.2.2.2 24
[NAS]firewall zone dmz 
[NAS-zone-dmz]add interface Virtual-Template 1
[NAS-GigabitEthernet1/0/0]pppoe-server bind virtual-template 1 ---将VT接口绑定在物
理接口
[NAS]aaa
[NAS-aaa]domain default 
[NAS-aaa-domain-default]service-type l2tp
[NAS]user-manage user user1 domain default
[NAS-localuser-user1]password Password123

2.建立L2TP隧道

 NAS配置

[NAS]l2tp enable 
[NAS]l2tp-group 1
[NAS-l2tp-1]tunnel authentication 
[NAS-l2tp-1]tunnel password cipher Hello123
[NAS-l2tp-1]tunnel name lac ---隧道名称
[NAS-l2tp-1]start l2tp ip 20.1.1.2 fullusername user1 ---设定LAC模式，以及LNS地址，
以及认证用户名的方式为“完全用户认证”，并指定用户名

 

LNS配置 

[LNS]ip pool l2tp
[LNS-ip-pool-l2tp]section 0 172.16.1.2 172.16.1.100
[LNS-ip-pool-l2tp]q
[LNS]aaa
[LNS-aaa]service-scheme l2tp
[LNS-aaa-service-l2tp]ip-pool l2tp
[LNS-aaa-service-l2tp]q
[LNS-aaa]domain default 
[LNS-aaa-domain-default]service-type l2tp 
[LNS-aaa-domain-default]q
[LNS-aaa]q	
[LNS]user-manage user user1 domain default 
[LNS-localuser-user1]password Password123
[LNS-localuser-user1]q
[LNS]int Virtual-Template 1
[LNS-Virtual-Template1]ppp authentication-mode chap 
[LNS-Virtual-Template1]ip address 172.16.0.1 24
[LNS-Virtual-Template1]remote service-scheme l2tp
[LNS-Virtual-Template1]q
[LNS]firewall zone dmz 	
[LNS-zone-dmz]add interface Virtual-Template 1
[LNS-zone-dmz]q
[LNS]l2tp enable 
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp virtual-template 1 remote lac domain default
[LNS-l2tp-1]tunnel authentication
[LNS-l2tp-1]tunnel password cipher Hello123

 完成实验配置