防火墙是总部出口,MSR路由器是分部出口拨号上网,两台设备跨越公网建立L2TP over IPSec隧道实现总部分部私网互通。
路由器作为LAC,重要配置如下:
#
<MSR>dis ike sa
Connection-ID Local Remote Flag DOI
-------------------------------------------------------------------------
23 10.164.118.x x.x.x.x RD IPsec
Flags:
RD--READY
RL--REPLACED FD-FADING RK-REKEY
<MSR>dis ipsec sa
-------------------------------
Interface: Eth-channel1/0:0
-------------------------------
-----------------------------
IPsec policy: l2tp
Sequence number: 1
Mode: ISAKMP
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect Forward Secrecy:
Inside VPN:
Extended Sequence Numbers enable: N
Traffic Flow Confidentiality enable: N
Transmitting entity: Initiator
Path MTU: 1436
Tunnel:
local address: 10.164.118.x
remote address: x.x.x.x
Flow:
sour addr: 10.0.0.1/255.255.255.255 port: 0 protocol: ip
dest addr: 10.0.0.2/255.255.255.255 port: 0 protocol: ip
[Inbound ESP SAs]
SPI: 883318680 (0x34a65f98)
[MSR]dis l2tp tunnel
LocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName
53451 12731 Established 1 x.x.x.x 1701 lns
l2tp隧道建议起loopback口,用loopback口地址建立。
ipsec野蛮模式两端都用地址或者fqdn建立隧道。
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作