SR66系列路由器（V7平台）作为LNS时移动终端L2TPoIPSec接入的典型配置

总部V7平台SR6602-X 配置

#

version 7.1.051, T7103

#

 sysname SR66-1

#

 ip pool 1 100.0.0.2 100.0.0.222  //分给终端的IP地址池

#

interface Virtual-Template1

 ppp authentication-mode chap

 remote address pool 1

 ip address 100.0.0.1 255.255.255.0     //终端获取IP地址后的网关

#

interface LoopBack0       //模拟内网业务地址

 ip address 192.168.0.100 255.255.255.255

#

interface GigabitEthernet0/0/0

 port link-mode route

 combo enable copper

 ip address 200.0.0.1 255.255.255.0

 nat outbound 2000      //总部对外的NAT

 ipsec apply policy l2tp      //接口应用IPSec策略L2TP

#

#

interface M-GigabitEthernet0/0/0

#

line vty 0 4

 authentication-mode none

 user-role level-15

 user-role network-operator

#

acl number 2000     //需做NAT转换的总部内网地址

 rule 0 permit

#

domain system

 authorization-attribute ip-pool 1

 authentication ppp local     //PPP本地认证

 authorization ppp local      //PPP本地授权

#

 domain default enable system

#

local-user 1 class network     //拨号用户名/密码

 password cipher simple 1

 service-type ppp

 authorization-attribute user-role level-15

 authorization-attribute user-role network-operator

#

ipsec transform-set l2tp   //Android4.X和iOS系统使用

 encapsulation-mode transport      //传输模式

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha1

#

ipsec transform-set l2tp1  //Android2.X以及PC自带客户端使用

 encapsulation-mode transport      //传输模式

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec policy-template temp 1

 transform-set l2tp l2tp1  //需引用l2tp和l2tp1两个transform-set

 ike-profile l2tp

#

ipsec policy l2tp 1 isakmp template temp

#

l2tp-group 1 mode lns

 allow l2tp virtual-template 1

 undo tunnel authentication

 tunnel name LNS

#

 l2tp enable

#

ike profile l2tp

 keychain 1

 exchange-mode aggressive

 match remote identity address 0.0.0.0 0.0.0.0   //表示所有的ip都是匹配的

 proposal 1 2

#

ike proposal 1

 encryption-algorithm aes-cbc-128

 dh group2

#

ike proposal 2

 encryption-algorithm 3des-cbc

 dh group2

#

ike keychain 1

 pre-shared-key address 0.0.0.0 0.0.0.0 key simple h3c

#

return

#

运营商V5平台SR6602-X配置

#

 version 5.20, Release 3303

#

 sysname SR66-2

#

 domain default enable system

#

acl number 3000

 rule 5 permit ip source 192.168.10.0 0.0.0.255

#

interface GigabitEthernet0/0/0

 nat outbound 3000

 ip address 200.0.0.2 255.255.255.0

#

 ip route-static 192.168.10.0 255.255.255.0 10.0.0.2

#

AP配置

#

 version 5.20, Release 1308P04

#

 sysname WA2620i-AGN

#

 domain default enable system

#

vlan 1

#

vlan 10

#

dhcp server ip-pool client   //给终端分配地址的地址池

 network 192.168.10.0 mask 255.255.255.0

 gateway-list 192.168.10.254

 dns-list 9.9.9.9

#

wlan rrm

 dot11a mandatory-rate 6 12 24

 dot11a supported-rate 9 18 36 48 54

 dot11b mandatory-rate 1 2

 dot11b supported-rate 5.5 11

 dot11g mandatory-rate 1 2 5.5 11

 dot11g supported-rate 6 9 12 18 24 36 48 54

#

wlan service-template 10 clear

 ssid H3C

 service-template enable

#

interface Vlan-interface1

 ip address 10.0.0.2 255.255.255.0

#

interface Vlan-interface10

 ip address 192.168.10.254 255.255.255.0

#

interface WLAN-BSS10

 port access vlan 10

#

interface WLAN-BSS32

 port link-type hybrid

 port hybrid vlan 1 untagged

#

interface WLAN-BSS33

 port link-type hybrid

 port hybrid vlan 1 untagged

#

interface WLAN-Radio1/0/1

#

interface WLAN-Radio1/0/2

 service-template 10 interface wlan-bss 10

#

 ip route-static 0.0.0.0 0.0.0.0 10.0.0.1

#

 dhcp enable

#

 arp-snooping enable

#