華爲防火牆L2TP ***的配置

                                           

配置接口並將接口加入相關區域

[FW1-GigabitEthernet1/0/0]ip add 10.1.1.1 24

[FW1-GigabitEthernet1/0/1]ip add 192.168.0.254 24

[FW1]firewall zone untrust

[FW1-zone-untrust]add interface GigabitEthernet 1/0/1

[FW1]firewall zone trust

[FW1-zone-trust]add interface GigabitEthernet 1/0/0

放行相關命令

[FW1-GigabitEthernet1/0/0]service-manage ping permit

[FW1-GigabitEthernet1/0/1]service-manage ping permit

建立L2TP ***模板

[FW1]int Virtual-Template 0

[FW1-Virtual-Template0]ip add 10.1.2.1 24

[FW1-Virtual-Template0]ppp authentication-mode chap //配置身份認證模式爲CHAP

[FW1-Virtual-Template0]remote address 10.1.2.10

[FW1]firewall zone untrust

[FW1-zone-untrust]add interface Virtual-Template 0  //將虛擬接口加入到相關區域

啓用L2TP服務及設置參數

[FW1]l2tp enable  //啓用L2TP

[FW1]l2tp-group 1  //建立L2TP組

[FW1-l2tp-1]tunnel name client  //配置L2TP隧道名

[FW1-l2tp-1]allow l2tp virtual-template 0 remote client //調用L2TP虛擬模板

[FW1-l2tp-1]tunnel authentication //配置隧道認證

[FW1-l2tp-1]tunnel password cipher ABCabc@123  //配置隧道認證密碼

建立撥號用戶

[FW1]user-manage user user001 

[FW1-localuser-user001]password ABCabc@1234

[FW1-localuser-user001]parent-group /default

配置安全策略

[FW1]security-policy

[FW1-policy-security-rule-l2tp1]source-zone trust

[FW1-policy-security-rule-l2tp1]destination-zone untrust

[FW1-policy-security-rule-l2tp1]source-address 10.1.1.0 24

[FW1-policy-security-rule-l2tp1]action permit

[FW1-policy-security]rule name l2tp2

[FW1-policy-security-rule-l2tp2]source-zone untrust

[FW1-policy-security-rule-l2tp2]destination-zone trust

[FW1-policy-security-rule-l2tp2]destination-address 10.1.1.0 24

[FW1-policy-security-rule-l2tp2]action permit

[FW1-policy-security]rule name l2tp3

[FW1-policy-security-rule-l2tp3]source-zone local untrust

[FW1-policy-security-rule-l2tp3]destination-zone local untrust

[FW1-policy-security-rule-l2tp3]service l2tp

[FW1-policy-security-rule-l2tp3]action permit