L2TP实验

一、拓朴图

二、实验配置
1.基础配置
1.1接口IP及服务配置
[PPPoE Client]interface GigabitEthernet 0/0/0
[PPPoE Client-GigabitEthernet0/0/0]service-manage all permit

[NAS]interface GigabitEthernet 0/0/0
[NAS-GigabitEthernet0/0/0]ip add 192.168.0.2 24
[NAS-GigabitEthernet0/0/0]service-manage all permit
[NAS]int g 1/0/1
[NAS-GigabitEthernet1/0/1]ip add 20.1.1.1 24

[LNS]interface GigabitEthernet 0/0/0
[LNS-GigabitEthernet0/0/0]ip add 192.168.0.3 24
[LNS-GigabitEthernet0/0/0]service-manage all permit
[LNS]int g 1/0/0
[LNS-GigabitEthernet1/0/0]ip add 20.1.1.2 24
[LNS]int g 1/0/1
[LNS-GigabitEthernet1/0/1]ip add 192.168.1.254 24

1.2安全区域划分
[PPPoE Client]firewall zone trust
[PPPoE Client-zone-trust]add int g 1/0/0

[NAS]firewall zone untrust
[NAS-zone-untrust]add int g 1/0/1
[NAS]firewall zone trust
[NAS-zone-trust]add int g 1/0/0

[LNS]firewall zone untrust
[LNS-zone-untrust]add int g 1/0/0
[LNS]firewall zone trust
[LNS-zone-trust]add int g 1/0/1

2L2TP配置
2.1建立PPPoE连接，设定拨号接口VT接口
Client（PPPoE Client）

[PPPoE Client]interface Dialer 1
[PPPoE Client-Dialer1]dialer user user1 ----- 设定拨号用户名
[PPPoE Client-Dialer1]dialer-group 1
[PPPoE Client-Dialer1]dialer bundle 1
[PPPoE Client-Dialer1]ip address ppp-negotiate ------ PPP的NCP协商过程所用协议
[PPPoE Client-Dialer1]ppp chap user user1
[PPPoE Client-Dialer1]ppp chap password cipher Password123

[PPPoE Client]dialer-rule 1 ip permit ------ 配置拨号访问控制列表，允许所有IPv4报文通过拨号口，数字1必须与拨号组编号相同。

[PPPoE Client]int g 1/0/0
[PPPoE Client-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1 ---物理接口启动PPPoE Client程序，绑定拨号程序包，编号为1

Server（NAS）

[NAS]interface Virtual-Template 1
[NAS-Virtual-Template1]ppp authentication-mode chap ----- 修改认证模式
[NAS-Virtual-Template1]ip address 2.2.2.2 24 ---- （配置的IP地址仅是为了激活该接口）

[NAS]firewall zone dmz
[NAS-zone-dmz]add interface Virtual-Template 1

[NAS]interface GigabitEthernet 1/0/0
[NAS-GigabitEthernet1/0/0]pppoe-server bind virtual-template 1 ----- 将VT接口绑定在物理接口

[NAS]aaa
[NAS-aaa]domain default
[NAS-aaa-domain-default]service-type l2tp ----- 设定认证域的服务类型为L2TP

设用户名和密码信息：
[NAS]user-manage user user1 domain default
[NAS-localuser-user1]password Password123

2.2建立L2TP隧道
NAS(LAC)配置
[NAS]l2tp enable ----- 启动L2TP协议
[NAS]l2tp-group 1
[NAS-l2tp-1]tunnel authentication -----隧道认证
[NAS-l2tp-1]tunnel password cipher Hello123 ---- 配置隧道密码
[NAS-l2tp-1]tunnel name lac
[NAS-l2tp-1]start l2tp ip 20.1.1.2 fullusername user1 ---- 设定LAC模式和LNS地址

LNS配置
[LNS]ip pool l2tp --- 创建地址池
[LNS-ip-pool-l2tp]section 0 172.16.1.2 172.16.1.100

[LNS]aaa
[LNS-aaa]service-scheme l2tp
[LNS-aaa-service-l2tp]ip-pool l2tp
[LNS-aaa]domain default
[LNS-aaa-domain-default]service-type l2tp

[LNS]user-manage user user1 domain default
[LNS-localuser-user1]password Password123

[LNS]interface Virtual-Template 1
[LNS-Virtual-Template1]ppp authentication-mode chap
[LNS-Virtual-Template1]ip address 172.16.0.1 24
[LNS-Virtual-Template1]remote service-scheme l2tp

[LNS]firewall zone dmz
[LNS-zone-dmz]add interface Virtual-Template 1

[LNS]l2tp enable
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp virtual-template 1 remote lac domain default
[LNS-l2tp-1]tunnel authentication
[LNS-l2tp-1]tunnel password cipher Hello123

地址池如图所示

2.3路由补充
[PPPoE Client]ip route-static 0.0.0.0 0 Dialer 1
[PPPoE Client]firewall zone dmz
[PPPoE Client-zone-dmz]add interface Dialer 1

[PPPoE Client]security-policy
[PPPoE Client-policy-security]default action permit

[NAS]security-policy
[NAS-policy-security]default action permit

[LNS]security-policy
[LNS-policy-security]default action permit

[PPPoE Client]ping 192.168.1.1
PING 192.168.1.1: 56 data bytes, press CTRL_C to break
Request time out
Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=254 time=11 ms
Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=254 time=3 ms
Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=254 time=3 ms
Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=254 time=4 ms

安全策略配置
NAS
[NAS]security-policy
[NAS-policy-security]default action deny #先恢复拒绝状态
[NAS-policy-security]rule name local_to_untrust
source-zone local
destination-zone untrust
source-address 20.1.1.1 mask 255.255.255.255
destination-address 20.1.1.2 mask 255.255.255.255
service l2tp
service protocol udp source-port 0 to 65535 destination-port 1701
action permit

LNS

[LNS]security-policy
[LNS-policy-security]default action deny
[LNS-policy-security]dis this
security-policy
rule name untrust_to_local
source-zone untrust
destination-zone local
source-address 20.1.1.1 mask 255.255.255.255
destination-address 20.1.1.2 mask 255.255.255.255
service l2tp
service protocol udp destination-port 1701
action permit
rule name dmz_to_trust
source-zone dmz
destination-zone trust
source-address 172.16.1.0 mask 255.255.255.0
destination-address 192.168.1.0 mask 255.255.255.0
action permit