H3C L2TP over IPSec一定要使用inode吗？

您好，请知：

可以使用windows自带的客户端。

以下是配置举例，请参考：

3.1  组网需求

如图1所示，L2TP Client使用PPPoE接入到LAC，LAC与LNS之间配置IPsec，加密L2TP数据流。Client的拨号接口配置出方向NAT，对内网访问外网的数据进行地址转换。LNS配置Radius方案，使用IMC服务器对PPP用户进行认证。

图1 L2TP over IPsec配置组网图

3.2  使用版本

本举例是在Release 2317版本上进行配置和验证的。

3.3  配置步骤

3.3.1  Router A的配置

# 配置拨号访问规则。

<RouterA> system-view

[RouterA] dialer-rule 1 ip permit

# 配置拨号接口Dialer0。

[RouterA] interface dialer 0

[RouterA-Dialer0] ppp chap user l2tp@l2tp

[RouterA-Dialer0] ppp chap password simple l2tp

[RouterA-Dialer0] ip address ppp-negotiate

[RouterA-Dialer0] dialer user PPPoE

[RouterA-Dialer0] dialer-group 1

[RouterA-Dialer0] dialer bundle 1

[RouterA-Dialer0] quit

# 配置PPPoE Client。

[RouterA] interface ethernet 0/0

[RouterA-Ethernet0/0] pppoe-client dial-bundle-number 1 idle-timeout 300

[RouterA-Ethernet0/0] quit

# 配置默认路由

[RouterA] ip route-static 0.0.0.0 0 Dialer0

# 配置NAT转换规则。

[RouterA] acl number 3000

[RouterA-acl-adv-3000] rule 0 permit ip

[RouterA-acl-adv-3000] quit

# 在拨号接口下绑定出方向NAT。

[RouterA] interface dialer 0

[RouterA-Dialer0] nat outbound 3000

[RouterA-Dialer0] quit

3.3.2  Router B的配置

# 使能L2TP。

<RouterB> system-view

[RouterB] l2tp enable

# 创建domain和本地用户。

[RouterB] domain l2tp

[RouterB-isp-l2tp] quit

[RouterB] local-user l2tp

[RouterB-luser-l2tp] service-type ppp

[RouterB-luser-l2tp] quit

# 配置l2tp-group。

[RouterB] l2tp-group 1

[RouterB-l2tp1] tunnel password simple msr_l2tp

[RouterB-l2tp1] tunnel name msr_lac

[RouterB-l2tp1] start l2tp ip 202.115.11.1 fullusername l2tp@l2tp

[RouterB-l2tp1] quit

# 创建ACL3000,定义需要IPsec保护的数据流。

 [RouterB] acl number 3000

[RouterB-acl-adv-3000] rule 0 permit udp source 202.115.11.2 0 destination 202.115.11.1 0 destination-port eq 1701

[RouterB-acl-adv-3000] quit

# 配置ike对等体。

[RouterB] ike peer l2tp

[RouterB-ike-peer-l2tp] pre-shared-key l2tp

[RouterB-ike-peer-l2tp] remote-address 202.115.11.1

[RouterB-ike-peer-l2tp] quit

# 配置IPsec proposal。

[RouterB] ipsec proposal l2tp

[RouterB-ipsec-proposal-l2tp] transform ah-esp

[RouterB-ipsec-proposal-l2tp] quit

# 配置IPsec policy。

[RouterB] ipsec policy l2tp 1 isakmp

[RouterB-ipsec-policy-isakmp-l2tp-1] security acl 3000

[RouterB-ipsec-policy-isakmp-l2tp-1] ike-peer l2tp

[RouterB-ipsec-policy-isakmp-l2tp-1] proposal l2tp

[RouterB-ipsec-policy-isakmp-l2tp-1] quit

# 在接口GigabitEthernet 0/0下应用IPsec安全策略。

[RouterB] interface gigabitethernet 0/0

[RouterB-GigabitEthernet0/0] ip address 202.115.11.2 24

[RouterB-GigabitEthernet0/0] ipsec policy l2tp

[RouterB-GigabitEthernet0/0] quit

3.3.3  Router C的配置

# 配置接口GigabitEthernet0/1的IP地址。

<RouterC> system-view

[RouterC] interface gigabitethernet 0/1

[RouterC-GigabitEthernet0/1] ip address 172.32.15.10 24

[RouterC-GigabitEthernet0/1] quit

# 使能L2TP。

[RouterC] l2tp enable

# 配置虚模板Virtual-Template的相关信息。

[RouterC] interface virtual-template0

[RouterC-virtual-template0] ip address 10.1.1.1 255.255.255.0

[RouterC-virtual-template0] ppp authentication-mode chap

[RouterC-virtual-template0] remote address pool 1

[RouterC-virtual-template0] quit

# 配置l2tp-group。

[RouterC] l2tp-group 1

[RouterC-l2tp1] allow l2tp virtual-template 0 remote msr_lac domain l2tp

[RouterC-l2tp1] tunnel password simple msr_l2tp

[RouterC-l2tp1] tunnel name msr_lns

[RouterC-l2tp1] quit

# 配置radius方案。

[RouterC] radius scheme l2tp

[RouterC-radius-l2tp] primary authentication 172.32.0.16

[RouterC-radius-l2tp] primary accounting 172.32.0.16

[RouterC-radius-l2tp] key authentication msr

[RouterC-radius-l2tp] key accounting msr

[RouterC-radius-l2tp] quit

# 配置域。

[RouterC] domain l2tp

[RouterC-isp-l2tp] authentication ppp radius-scheme l2tp

[RouterC-isp-l2tp] authorization ppp radius-scheme l2tp

[RouterC-isp-l2tp] accounting ppp radius-scheme l2tp

[RouterC-isp-l2tp] ip pool 1 10.1.1.2 10.1.1.100

[RouterC-isp-l2tp] quit

# 创建ACL3000,定义需要IPsec保护的数据流。

[RouterC] acl number 3000

[RouterC-acl-adv-3000] rule 0 permit udp source 202.115.11.1 0 source-port eq 1701 destination 202.115.11.2 0 

[RouterC-acl-adv-3000] quit

# 配置ike对等体。

[RouterC] ike peer l2tp

[RouterC-ike-peer-l2tp] pre-shared-key l2tp

[RouterC-ike-peer-l2tp] remote-address 202.115.11.2

[RouterC-ike-peer-l2tp] quit

# 配置IPsec proposal。

[RouterC] ipsec proposal l2tp

[RouterC-ipsec-proposal-l2tp] transform ah-esp

[RouterC-ipsec-proposal-l2tp] quit

# 配置IPsec policy。

[RouterC] ipsec policy l2tp 1 isakmp

[RouterC-ipsec-policy-isakmp-l2tp-1] security acl 3000

[RouterC-ipsec-policy-isakmp-l2tp-1] ike-peer l2tp

[RouterC-ipsec-policy-isakmp-l2tp-1] proposal l2tp

[RouterC] quit

# 在接口GigabitEthernet0/0下应用IPsec安全策略。

[RouterC] interface gigabitethernet 0/0

[RouterC-GigabitEthernet0/0] ip address 202.115.11.2 24

[RouterC-GigabitEthernet0/0] ipsec policy l2tp

[RouterC-GigabitEthernet0/0] quit