当前位置：首页 > news >正文

L2TP-域名配置步骤

news 2026/5/11 6:59:03

案例场景

先通过添加云让物理机与主机联通。因为在仿真环境中secoclient客户端软件是安装在物理机上，所以需要保障物理机和防火墙的连通性。

配置过程：

（1）环回网卡配置如图所示，IP地址以及掩码是20.1.1.2/24，是为了跟GE1/0/2口保持在同一个网段。

（2）LNS配置。GE 1/0/2接口配置如下，保证公网的连通性，注意开启访问权限，如图所示

LNS（也就是防火墙设备USG6000V1）的配置命令：

配置防火墙基本网络参数

interface GigabitEthernet1/0/0
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/2
ip address 20.1.1.1 255.255.255.0
service-manage all permit

安全区域配置，配置命令如下

firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/2
ip pool pooll
section 1 192.168.1.2 192.168.1.100
#

配置server1网络基本参数

配置L2TP

(1)

开启L2TP功能，配置命令如下：

[LNS] l2tp enable (这里不是数字1，而是小写的字母L，后面的所有类似命令同理)

[LNS] interface Virtual-Template0
[LNS -Virtual-Template0] ip address 192.168.1.1 255.255.255.0

[LNS -Virtual-Template0]ppp authentication-mode chap

[LNS -Virtual-Template0]remote service-scheme l2tp

[LNS -Virtual-Template0]quit

[LNS] firewall zone dmz
[LNS-zone-dmz] add interface Virtual-Template0

[LNS-zone-dmz] quit

[LNS] l2tp-group 1
[LNS-l2tp-2] allow l2tp virtual-template 0 remote lac

[LNS-l2tp-2] tunnel authentication

[LNS-l2tp-2] tunnel password cipher Password123

[LNS-l2tp-2] quit

[LNS] ip pool poll

[LNS-ip-pool-pooll] section 1 192.1681.2 192.168.1.100

[LNS-ip-pool-pooll] q

[LNS] aaa

[LNS-aaa]service-scheme l2tp

[LNS-aaa-service-scheme -l2tp]ip-pool pooll

[LNS-aaa-service-scheme -l2tp]quit

[LNS-aaa]domain netl

[LNS-aaa-domain netl]service-type l2tp

[LNS-aaa-domain netl]service-scheme l2tp

[LNS] user-manage user vpdnuser domain netl

[LNS-localuser-vpnduser@netl ]password Admin@123

[LNS-localuser-vpnduser@netl ]quit

[LNS-policy-sercurity] rule name untru-local

[LNS-policy-sercurity- rule-untru-local] source-zone untrust
[LNS-policy-sercurity- rule-untru-local] destination-zone local
[LNS-policy-sercurity- rule-untru-local] destination-address 20.1.1.1 mask 255.255.255.255
[LNS-policy-sercurity- rule-untru-local] action permit

[LNS-policy-sercurity] rule name dmz-trust
[LNS-policy-sercurity- rule-dmz-trust] source-zone dmz
[LNS-policy-sercurity- rule-dmz-trust] destination-zone trust
[LNS-policy-sercurity- rule-dmz->trust] source-address 192.168.1.0 mask 255.255.255.0
[LNS-policy-sercurity- rule-dmz-?trust] destination-address 10.1.1.10 mask 255.255.255.255
[LNS-policy-sercurity- rule-dmz->trust] action permit