SecPath系列防火墙强制移动客户端使用L2TP+IPSec的典型配置

SecPath系列防火墙强制移动客户端使用L2TP+IPSec的

典型配置

 

一、 组网需求：

要求所有移动客户端访问中心时必须使用L2TP＋IPSec方式。

二、 组网图

   

   SecPath1000F：适合所有版本。                  

三、 配置信息

SecPath1000F防火墙的主要配置

#                                                                               

 sysname SecPath1000F                                                          

#                                                                              

 l2tp enable                                                                    

#                                                                              

 ike local-name zhongxin                                                       

#                                                                              

 firewall packet-filter enable                                                 

 firewall packet-filter default permit                                         

domain system                                                                  

 ip pool 1 172.16.1.10 172.16.1.100                                            

#                                                                              

local-user test                                                                

 password simple test                                                           

 service-type ppp                                                              

#                                                                              

ike peer 1                                                                      

 exchange-mode aggressive                                                      

 pre-shared-key 123                                                            

 id-type name                                                                   

 remote-name fenzhi                                                            

 local-address 202.38.1.1                                                      

 nat traversal                                                                  

#                                                                              

ipsec proposal 1                                                               

#                                                                              

ipsec policy-template temp 1                                                   

 security acl 3000                                   //在策略模版下应用acl    

 ike-peer 1                                                                    

 proposal 1                                                                     

#                                                                              

ipsec policy pol1 1 isakmp template temp                                       

#                                                                               

acl number 3000                                                                

 rule 0 permit udp source 202.38.1.1 0               //定义UDP回应的源地址    

 rule 1 deny ip                                                                

#                                                                              

interface Virtual-Template1                                                     

 ppp authentication-mode pap                                                   

 ip address 172.16.1.1 255.255.255.0                                           

 remote address pool 1                                                         

#                                                                               

interface Gigabit0/0                                                           

 ip address 192.168.1.1 255.255.255.0                                          

#                                                                               

interface GigabitEthernet0/1                                                   

 ip address 202.38.1.1 255.255.255.0                                           

 ipsec policy pol1                                                              

#                                                                              

firewall zone trust                                                            

 add interface GigabitEthernet0/0                                               

 set priority 85                                                               

#                                                                              

firewall zone untrust                                                           

 add interface GigabitEthernet0/1                                              

 add interface Virtual-Template1                                               

 set priority 5                                                                

#                                                                              

l2tp-group 1                                                                   

 undo tunnel authentication                                                    

 allow l2tp virtual-template 1                                                 

#                                                                              

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.2 preference 60                      

#

    

四、 配置关键点

Nat转换的地址不能为202.38.1.1，即不是Easy IP方式。