Quidway SecPath1800F防火墙L2TP OVER IPSec的典型配置

Quidway SecPath1800F防火墙L2TP OVER IPSec的

典型配置

 

一、 组网需求：

验证SecPath1800F防火墙L2TP OVER IPSec的功能。

二、 组网图

 

    SecPath1800F：Version 3.40, RELEASE 0354(08)；

   PC：安装有L2TP客户端软件。

三、 配置信息

1、SecPath1800F防火墙的主要配置

#                                                                               

acl number 3000                                              //定义高级ACL

 rule 0 permit udp destination-port eq 1701             //允许UDP 1701端口

 rule 15 permit udp destination-port eq 500              //允许UDP 500端口

#                                                                               

 sysname SecPath1800F                                                          

#                                                                              

 l2tp enable                                                //启用L2TP服务

#                                                                              

 ike local-name zhongxin                                     //配置ike名称

#                                                                              

 firewall packet-filter default permit interzone local untrust direction outbound                                                                            

#                                                                              

 bypass switch-back auto                                                        

#                                                                              

 firewall mode route                                                           

#                                                                               

 firewall statistic system enable                                              

#                                                                              

ike peer 1                                                  //配置ike peer

 exchange-mode aggressive                                                      

 pre-shared-key 123456                                                         

 local-id-type name                                                            

 remote-name fenzhi                                                            

 nat traversal                                                                 

#                                                                              

ipsec proposal 1                                       //配置IPSEC安全提议

#                                                                               

ipsec policy-template temp 1                               //配置IPSEC模板

 security acl 3000                                                             

 ike-peer 1                                                                    

 proposal 1                                                                    

#                                                                              

ipsec policy pol1 1 isakmp template temp                   //配置IPSEC策略

#                                                                              

interface Aux0                                                                 

 async mode flow                                                               

 link-protocol ppp                                                             

#                                                                              

interface Ethernet0/0/0                                                        

#                                                                               

interface Ethernet0/0/1                                                        

#                                                                              

interface Ethernet2/0/0                                                         

 ip address 192.168.1.1 255.255.255.0                                          

#                                                                              

interface Ethernet2/0/1                                                         

 ip address 202.38.1.1 255.255.255.0                                           

 ipsec policy pol1                                      //引用IPSEC POLICY

#                                                                              

interface Ethernet2/0/2                                                        

#                                                                               

interface Ethernet2/0/3                                                        

#                                                                              

interface Ethernet2/0/4                                                        

#                                                                               

interface Ethernet2/0/5                                                        

#                                                                              

interface Ethernet2/0/6                                                         

#                                                                              

interface Ethernet2/0/7                                                        

#                                                                               

interface Virtual-Template1                                    //创建虚模板

 ppp authentication-mode chap pap                                              

 ip address 192.168.253.1 255.255.255.0                                        

 remote address pool 1                                                         

#                                                                               

interface GigabitEthernet1/0/0                                                 

#                                                                              

interface GigabitEthernet1/0/1                                                 

#                                                                              

interface Secp                                                                 

interface NULL0                                                                 

#                                                                              

firewall zone local                                                            

 set priority 100                                                               

#                                                                              

firewall zone trust                                                            

 set priority 85                                                                

 add interface Ethernet2/0/0                                 //接口加入区域

#                                                                              

firewall zone untrust                                                          

 set priority 5                                                                

 add interface Ethernet2/0/1                                 //接口加入区域

 add interface Virtual-Template1                           //虚模板加入区域

#                                                                               

firewall zone dmz                                                              

 set priority 50                                                               

#                                                                               

firewall interzone local trust                                                 

#                                                                              

firewall interzone local untrust                                               

 packet-filter 3000 inbound                                  //域间启用ACL

#                                                                              

firewall interzone local dmz                                                    

#                                                                              

firewall interzone trust untrust                                               

#                                                                               

firewall interzone trust dmz                                                   

#                                                                              

firewall interzone dmz untrust                                                  

#                                                                              

l2tp-group 1                                                 //创建L2TP组

 undo tunnel authentication                                                    

 allow l2tp virtual-template 1                                                 

#                                                                              

aaa                                                                            

 local-user zhaobiao password simple 123                    //创建L2TP账号

 local-user zhaobiao service-type ppp                                          

 ip pool 1 192.168.253.2 192.168.253.254                       //创建地址池

#                                                                              

 authentication-scheme default                                                 

#                                                                              

 authorization-scheme default                                                  

#                                                                               

 accounting-scheme default                                                     

#                                                                              

 domain default                                                                 

#                                                                              

#                                                                              

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.2                  //配置默认路由

#                                                                              

user-interface con 0                                                           

 authentication-mode none                                                      

user-interface aux 0                                                           

 authentication-mode none                                                      

user-interface vty 0 4                                                         

#

2、NAT网关的主要配置

#

 sysname NAT

#

acl number 3000                                               //定义高级ACL

 rule 0 permit ip source 172.16.1.0 0.0.0.255

 rule 1 deny ip

#

interface Ethernet0/0

 ip address 172.16.1.1 255.255.255.0

#

interface Ethernet1/0

 ip address 202.38.1.2 255.255.255.0

 nat outbound 3000                                               //配置NAT

#

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.1

#

 

四、 配置关键点

1.      IPSec使用UDP 500端口；

2.      IPSec策略模板下必须配置ACL。