L2TP OVER IPSEC VPN 卓访问传输数据量大的时候自动掉线....

配置：

#

version 7.1.064, Release 0809P34

#

sysname H3C

#

clock timezone Beijing add 08:00:00

clock protocol ntp

#

telnet server enable

telnet server port 2323

#

security-zone intra-zone default permit

#

ip pool l2tp1 192.168.10.11 192.168.10.200

#

dialer-group 1 rule ip permit

dialer-group 89 rule ip permit

#

ip load-sharing mode per-flow src-ip global

#

dhcp enable

dhcp server always-broadcast

#

dns proxy enable

dns server 223.5.5.5

#

password-recovery enable

#

vlan 1

#

dhcp server ip-pool lan1

gateway-list 192.168.1.1

network 192.168.1.0 mask 255.255.255.0

address range 192.168.1.0 192.168.1.255

dns-list 223.5.5.5 192.168.1.1

forbidden-ip-range 192.168.1.1 192.168.1.1

#

ddns policy WAN0(GE0)

url ***.***/dyndns/update?system=dyndns&hostname=<h>&myip=<a>

username cXXX

password cipher $XXXX

#

apn-profile profile69

apn dynamic

#

interface Dialer0

ppp chap password cipher $XXX

ppp chap user 0XXX

ppp ipcp dns admit-any

ppp ipcp dns request

ppp pap local-user 0XXX password cipher $XXX

dialer bundle enable

dialer-group 1

dialer timer idle 0

dialer timer autodial 5

ip address ppp-negotiate

nat outbound

ddns apply policy WAN0(GE0) fqdn ***.***

ipsec apply policy 1

#

interface Dialer1

#

interface Dialer2

#

interface Dialer3

#

interface Dialer4

#

interface Dialer5

#

interface Dialer6

#

interface Dialer7

#

interface Dialer8

#

interface Dialer1023

#

interface Virtual-Template1

ppp authentication-mode chap domain system

ppp ipcp dns 114.114.114.114 223.5.5.5

remote address pool l2tp1

ip address 192.168.10.1 255.255.255.0

#

interface NULL0

#

interface Vlan-interface1

description LAN-interface

ip address 192.168.1.1 255.255.255.0

tcp mss 1280

ip subscriber l2-connected enable

ip subscriber initiator dhcp enable

ip subscriber initiator unclassified-ip enable

ip subscriber dhcp domain ipoeenabledomain

ip subscriber unclassified-ip domain ipoeenabledomain

#

interface GigabitEthernet0/0

port link-mode route

description Single_Line1

pppoe-client dial-bundle-number 0

#

interface GigabitEthernet0/1

port link-mode route

#

interface GigabitEthernet0/2

port link-mode bridge

#

interface GigabitEthernet0/3

port link-mode bridge

#

interface GigabitEthernet0/4

port link-mode bridge

#

interface GigabitEthernet0/5

port link-mode bridge

#

security-zone name Local

#

security-zone name Trust

#

security-zone name DMZ

#

security-zone name Untrust

#

security-zone name Management

#

scheduler logfile size 16

#

line class console

user-role network-admin

#

line class tty

user-role network-operator

#

line class vty

user-role network-operator

#

line con 0

user-role network-admin

#

line vty 0 63

authentication-mode scheme

user-role network-operator

#

ip route-static 0.0.0.0 0 Dialer0

#

ntp-service enable

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

ntp-service unicast-server ***.***

#

password-control enable

undo password-control aging enable

undo password-control history enable

password-control length 6

password-control login-attempt 3 exceed lock-time 10

password-control update-interval 0

password-control login idle-time 0

#

domain ipoeenabledomain

authentication ipoe none

authorization ipoe none

accounting ipoe none

#

domain system

#

domain default enable system

#

role name level-0

description Predefined level-0 role

#

role name level-1

description Predefined level-1 role

#

role name level-2

description Predefined level-2 role

#

role name level-3

description Predefined level-3 role

#

role name level-4

description Predefined level-4 role

#

role name level-5

description Predefined level-5 role

#

role name level-6

description Predefined level-6 role

#

role name level-7

description Predefined level-7 role

#

role name level-8

description Predefined level-8 role

#

role name level-9

description Predefined level-9 role

#

role name level-10

description Predefined level-10 role

#

role name level-11

description Predefined level-11 role

#

role name level-12

description Predefined level-12 role

#

role name level-13

description Predefined level-13 role

#

role name level-14

description Predefined level-14 role

#

user-group system

#

local-user admin class manage

service-type telnet http https

authorization-attribute user-role network-admin

#

local-user cXXX class network

password cipher $XXX

service-type ppp

authorization-attribute user-role network-operator

#

#

session statistics enable

#

ipsec transform-set 1

encapsulation-mode transport

esp encryption-algorithm aes-cbc-128

esp authentication-algorithm sha1

#

ipsec transform-set 2

encapsulation-mode transport

esp encryption-algorithm aes-cbc-256

esp authentication-algorithm sha1

#

ipsec transform-set 3

encapsulation-mode transport

esp encryption-algorithm 3des-cbc

esp authentication-algorithm sha1

#

ipsec transform-set 4

encapsulation-mode transport

esp encryption-algorithm des-cbc

esp authentication-algorithm sha1

#

ipsec transform-set 5

encapsulation-mode transport

esp encryption-algorithm aes-cbc-192

esp authentication-algorithm sha1

#

ipsec transform-set 6

encapsulation-mode transport

#

ipsec policy-template 1 1

transform-set 1 2 3 4 5 6

ike-profile 1

#

ipsec policy 1 1 isakmp template 1

#

l2tp-group 1 mode lns

allow l2tp virtual-template 1

undo tunnel authentication

tunnel name LNS

tunnel password cipher $cXXX

#

l2tp enable

#

ike profile 1

keychain 1

exchange-mode aggressive

local-identity address 0.0.0.0

match remote identity address 0.0.0.0 0.0.0.0

proposal 1 2 3 4 5 6

#

ike proposal 1

encryption-algorithm aes-cbc-128

dh group2

authentication-algorithm md5

#

ike proposal 2

encryption-algorithm 3des-cbc

dh group2

authentication-algorithm md5

#

ike proposal 3

encryption-algorithm 3des-cbc

dh group2

#

ike proposal 4

encryption-algorithm aes-cbc-256

dh group2

#

ike proposal 5

dh group2

#

ike proposal 6

encryption-algorithm aes-cbc-192

dh group2

#

ike keychain 1

pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $XXXX

#

ip https port 20001

ip http enable

ip https enable

web new-style

#

url-filter category custom severity 65535

#

wlan global-configuration

nas-id cm-0-XXXXX

#

wlan ap-group default-group

vlan 1

#

dac storage service traffic limit hold-time 1

#

return