L2TP实验

放开安全策略机制,FW1不配IP

复制代码
[FW1]firewall zone  trust 	
[FW1-zone-trust]add interface GigabitEthernet 1/0/0
[FW1]security-policy 	
[FW1-policy-security]default action permit 

FW2 和FW3

复制代码
[FW2]interface g1/0/1
[FW2-GigabitEthernet1/0/1]ip address 20.1.1.1 24	
[FW2]firewall zone trust 	
[FW2-zone-trust]add interface GigabitEthernet 1/0/0
[FW2]firewall zone untrust 
[FW2-zone-untrust]add interface  GigabitEthernet 1/0/1

[FW3]in g1/0/0
[FW3-GigabitEthernet1/0/0]ip address 20.1.1.2 24
[FW3]interface g1/0/1
[FW3-GigabitEthernet1/0/1]ip address 192.168.1.254 24
[FW3]firewall zone untrust 
[FW3-zone-untrust]add interface GigabitEthernet 1/0/0
[FW3]firewall zone trust 
[FW3-zone-trust]add interface GigabitEthernet 1/0/1

建立pppoe连接,设定拨号接口

client

复制代码
[client]interface Dialer 1
[client-Dialer1]dialer user user1
[client-Dialer1]dialer-group 1	
[client-Dialer1]dialer bundle 1
[client-Dialer1]ip address ppp-negotiate 
[client-Dialer1]ppp chap user user1
[client-Dialer1]ppp chap password  cipher passwd123
[client]dialer-rule 1 ip permit
[client]interface g1/0/0
[client-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1]

server

复制代码
[server]interface Virtual-Template 1
[server-Virtual-Template1]ppp authentication-mode chap 
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[server-Virtual-Template1]ip address  2.2.2.2 24
[server]interface g1/0/0	
[server-GigabitEthernet1/0/0]pppoe-server bind  virtual-template  1
[server]interface g1/0/0	
[server-GigabitEthernet1/0/0]pppoe-server bind  virtual-template  1
[server]aaa
[server-aaa]domain default 
[server-aaa-domain-default]service-type l2tp	
[server]user-manage user user1 domain default 
[server-localuser-user1]password Passwd123

建立L2tp隧道

1.LAC配置

复制代码
[server]l2tp enable 
[server]l2tp-group 1
[server-l2tp-1]tunnel  authentication
[server-l2tp-1]tunnel  password cipher Hello123
[server-l2tp-1]tunnel name lac
[server-l2tp-1]start  l2tp ip 20.1.1.2 fullusername  user1

LNS配置

复制代码
[LNS]ip pool l2tp
[LNS-ip-pool-l2tp]section 0 172.16.0.2 172.16.0.100
[LNS]aaa 	
[LNS-aaa]service-scheme l2tp
[LNS-aaa-service-l2tp]ip-pool l2tp
[LNS-aaa-domain-default]service-type l2tp 
[LNS]user-manage user user1 domain  default 
[LNS-localuser-user1]password Passwd123
[LNS]interface Virtual-Template 1	
[LNS-Virtual-Template1]ppp authentication-mode chap 
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[LNS]interface Virtual-Template 1
[LNS-Virtual-Template1]ip address 172.16.0.1 24
[LNS-Virtual-Template1]remote service-scheme l2tp	
[LNS]firewall zone dmz 
[LNS-zone-dmz]add interface Virtual-Template 1	
[LNS]l2tp enable 	
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp  virtual-template  1 remote lac domain de	
[LNS-l2tp-1]tunnel  authentication
[LNS-l2tp-1]tunnel password cipher Hello123
[LNS]l2tp-group 1	
[LNS-l2tp-1]mandatory-chap
相关推荐
会开花的二叉树22 分钟前
UDP Socket 进阶:从 Echo 到字典服务器,学会 “解耦” 网络与业务
服务器·网络·udp
-SGlow-29 分钟前
Linux相关概念和易错知识点(45)(网络层、网段划分)
linux·运维·服务器·网络
阿部多瑞 ABU1 小时前
《学校机房终端安全全链条攻防分析与防御体系建设报告》
网络·安全
拷贝码农卡卡东10 小时前
pre-commit run --all-files 报错:http.client.RemoteDisconnected
网络·网络协议·http
郝亚军11 小时前
websocket 服务器往客户端发送的数据要加掩码覆盖吗?
服务器·网络·websocket
今天秃头了吗??13 小时前
【JAVA】网络编程
java·网络·网络编程·socket
is081513 小时前
NFS 服务器 使用
服务器·网络
言之。14 小时前
TCP 拥塞控制设计空间课程要点总结
网络·网络协议·tcp/ip
Freed&14 小时前
《没有架构图?用 netstat、ss、tcpdump 还原服务连接与数据流向》
网络·测试工具·tcpdump