F1080(V7)做L2TP over IPSec不成功，哪位大神能帮忙看一下。

l2tpoveripsec  remote要使用fqdn方式，指名字，原配置：

ike profile l2tp

  match remote identity address 0.0.0.0 0.0.0.0

具体参考如下案例：

功能需求

用户在分支网络中，需要通过电脑安装iNode作为LAC直接L2TP拨号到M9000访问总部网络，数据传输过程需要通过IPsec进行加密保护。

组网信息及描述

说明：

M9000版本：H3C Comware Software, Version 7.1.054, Ess 9114P04

iNode版本：iNode PC 7.0

PC操作系统：Microsoft Windows 7

配置步骤

1.  M9000配置

1)   配置接口的IP地址。

# 配置接口GigabitEthernet1/0/0/19的IP。

<M9000> system-view

[M9000] interface GigabitEthernet1/0/0/19

[M9000-GigabitEthernet2/0/0/19] ip address 169.10.1.1 255.255.255.0

# 配置接口LoopBack0的IP。

[M9000]interface LoopBack0

[M9000-LoopBack0] ip address 100.100.100.100 255.255.255.255

2)   配置ike keychain。

[M9000] ike keychain keychain_lns_9

[M9000-ike-keychain-keychain_lns_9] pre-shared-key address 169.10.1.100 255.255.255.0 key simple aabbcc                                                                  

3)   配置IKE提议。

[M9000]ike proposal 1

[M9000-ike-proposal-1] encryption-algorithm 3des-cbc

[M9000-ike-proposal-1] dh group2

[M9000-ike-proposal-1] authentication-algorithm md5

4)   配置IKE profile。

[M9000]ike profile ike_profile_lns_9

[M9000-ike-profile-ike_profile_lns_9] keychain keychain_lns_9

[M9000-ike-profile-ike_profile_lns_9] exchange-mode aggressive

[M9000-ike-profile-ike_profile_lns_9] local-identity fqdn LNS

[M9000-ike-profile-ike_profile_lns_9] match remote identity fqdn LAC

5)   配置IPsec安全提议和策略模板。

# 配置安全提议transform_for_pc。

[M9000]ipsec transform-set transform_for_pc

[M9000-ipsec-transform-set-transform_for_pc] esp encryption-algorithm 3des-cbc

[M9000-ipsec-transform-set-transform_for_pc] esp authentication-algorithm md5

# 配置安全策略模板ipsec_lns_9。

[M9000]ipsec policy-template 1 1

[M9000-ipsec-policy-template-1-1] transform-set transform_for_pc

[M9000-ipsec-policy-template-1-1] local-address 100.100.100.100

[M9000-ipsec-policy-template-1-1] ike-profile ike_profile_lns_9

6)   在接口GigabitEthernet1/0/0/19上启用IPsec策略。

[M9000] interface GigabitEthernet1/0/0/19                                                                                                                                                                                                                                                                                                                                                                 

[M9000-GigabitEthernet1/0/0/19] ipsec apply policy ipsec_lns_9                                                                      

7)   创建用户并配置ISP域验证类型。

# 创建本地PPP用户h3care，设置密码为Hello。

[M9000]local-user h3care class network

[M9000-luser-network-ppp009] password simple Hello

[M9000-luser-network-ppp009] service-type ppp

# 配置ISP域system对PPP用户采用本地验证。

[M9000]domain system

[M9000-isp-system] authentication ppp local

8)   使能L2tp功能并创建L2TP组。

[M9000] l2tp enable

[M9000]l2tp-group 1 mode lns

[M9000-l2tp1] allow l2tp virtual-template 1

[M9000-l2tp1] undo tunnel authentication

[M9000-l2tp1] tunnel name LNS

9)   配置L2TP地址池。

[M9000] ip pool 1 172.23.1.2 172.23.1.250

10) 配置Virtual-Template接口

[M9000]interface Virtual-Template1

[M9000-Virtual-Template1] ppp authentication-mode chap domain system

[M9000-Virtual-Template1] remote address pool 1

[M9000-Virtual-Template1] ip address 172.23.1.1 255.255.255.0

11)  将接口GigabitEthernet1/0/0/19、Virtual-Template1、LoopBack0加入安全域Trust。

[M9000]security-zone name trust                                                                                                                                                                  [M9000-security-zone-Trust] import interface GigabitEthernet 1/0/0/19 

[M9000-security-zone-Trust] import interface Virtual-Template 1

[M9000-security-zone-Trust] import interface LoopBack0

12)  配置域间策略。

# 配置ACL 2000，此ACL应用在Local域的域间策略。

[M9000] acl number 2000

[M9000-acl-adv-2000] rule 0 permit source 169.10.1.0 0.0.0.255

[M9000-acl-adv-2000] rule 1 permit source 172.23.1.0 0.0.0.255

[M9000-acl-adv-2000] rule 2 permit source 100.100.100.100 0.0.0.0

# 配置Trust到Local的域间策略。

[M9000] zone-pair security source trust destination local                                                                                                                                                                

[M9000-zone-pair-security-Trust-Local] packet-filter 2000                                                              

# 配置Local到Trust的域间策略。

[M9000] zone-pair security source local destination trust                                                                                                                                                                

[M9000-zone-pair-security-UntrustLocal-TTrust] packet-filter 2000

2.  iNode配置

1)   新建L2TP over IPsec连接。

2)   配置L2TP基本配置并启用IPsec安全协议。

3)   点击“高级”进入高级配置，根据M9000上L2TP配置调整相关参数。

4)   根据M9000上IPsec参数配置调整客户端IPsec参数。

5)   根据M9000上IKE参数配置调整客户端IKE参数。