MSR830-WiNet（V7）系列路由器L2TP VPN（命令行）配置方法

1 配置需求或说明

1.1  适用产品系列

本案例适用于Comware V7平台的MSR830-WiNet系列路由器，如MSR830-10BEI-WiNet 、MSR830-6EI-WiNet 、MSR830-5BEI-WiNet 、MSR830-6BHI-WiNet 、MSR830-10BHI-WiNet等

1.2  配置需求及实现的效果

路由器采用固定IP地址的方式部署在公司互联网出口，运营商提供的IP地址为198.76.28.30/30，内网地址为192.168.1.1/24。公司外部办公人员需要通过拨号VPN连入公司内网

2 组网图

3 配置步骤

3.1  配置路由器基本上网

路由器基本上网配置省略，具体设置步骤请参考“2.2.2 路由器外网使用固定IP地址上网配置方法”章节中“MSR830-WiNet系列路由器基本上网（静态IP）WEB配置（V7）”案例

3.2  配置路由器L2TP 服务器端

#开启L2TP功能      

<H3C>system-view

[H3C]l2tp enable

#创建地址池

[H3C]ip pool 1 192.168.10.2 192.168.10.200

#创建一个虚模板

[H3C]interface Virtual-Template1

[H3C-Virtual-Template1] ppp authentication-mode chap domain system

[H3C-Virtual-Template1]remote address pool 1

[H3C-Virtual-Template1]ip address 192.168.10.1 24

[H3C-Virtual-Template1]quit

#创建l2tp组

[H3C]l2tp-group 1 mode lns

[H3C-l2tp1] allow l2tp virtual-template 1

[H3C-l2tp1]undo tunnel authentication

[H3C-l2tp1]quit

#创建本地用户

[H3C]local-user 123 class network

[H3C-luser-network-123]password simple 123456

[H3C-luser-network-123]service-type ppp

[H3C-luser-network-123]quit

#保存配置

[H3C]save force

SW1：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname SW1

[SW1]int gi 1/0/1

[SW1-GigabitEthernet1/0/1]port link-mode route

[SW1-GigabitEthernet1/0/1]des <connect to FW1>

[SW1-GigabitEthernet1/0/1]ip address 10.0.0.1 30

[SW1-GigabitEthernet1/0/1]quit

[SW1]ip route-static 0.0.0.0 0.0.0.0 10.0.0.2

[SW1]ip http enable

[SW1]ip https enable

[SW1]local-user admin

New local user added.

[SW1-luser-manage-admin]password simple admin

[SW1-luser-manage-admin]service-type http https

[SW1-luser-manage-admin]authorization-attribute user-role network-admin

[SW1-luser-manage-admin]quit

R1：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname R1

[R1]int gi 0/0

[R1-GigabitEthernet0/0]ip address 202.103.224.254 24

[R1-GigabitEthernet0/0]quit

[R1]int gi 0/2

[R1-GigabitEthernet0/2]des <connect to FW1>

[R1-GigabitEthernet0/2]ip address 202.1.100.1 30

[R1-GigabitEthernet0/2]quit

FW1：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW1

[FW1]int gi 1/0/3

[FW1-GigabitEthernet1/0/3]ip address 10.0.0.2 30

[FW1-GigabitEthernet1/0/3]des <connect to SW1>

[FW1-GigabitEthernet1/0/3]quit

[FW1]acl basic 2000

[FW1-acl-ipv4-basic-2000]rule 0 permit source any

[FW1-acl-ipv4-basic-2000]quit

[FW1]int gi 1/0/2

[FW1-GigabitEthernet1/0/2]des <connect to R1>

[FW1-GigabitEthernet1/0/2]ip address 202.1.100.2 30

[FW1-GigabitEthernet1/0/2]nat outbound 2000

[FW1-GigabitEthernet1/0/2]quit

[FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1

[FW1]security-zone name trust

[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW1-security-zone-Trust]quit

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW1-security-zone-Untrust]quit

[FW1]acl basic 2001

[FW1-acl-ipv4-basic-2001]rule 0 permit source any

[FW1-acl-ipv4-basic-2001]quit

[FW1]

[FW1]zone-pair security source trust destination untrust

[FW1-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW1-zone-pair-security-Trust-Untrust]quit

[FW1]

[FW1]zone-pair security source untrust destination trust

[FW1-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW1-zone-pair-security-Untrust-Trust]quit

[FW1]

[FW1]zone-pair security source trust destination local

[FW1-zone-pair-security-Trust-Local]packet-filter 2001

[FW1-zone-pair-security-Trust-Local]quit

[FW1]

[FW1]zone-pair security source local destination trust

[FW1-zone-pair-security-Local-Trust]packet-filter 2001

[FW1-zone-pair-security-Local-Trust]quit

[FW1]

[FW1]zone-pair security source untrust destination local

[FW1-zone-pair-security-Untrust-Local]packet-filter 2001

[FW1-zone-pair-security-Untrust-Local]quit

[FW1]

[FW1]zone-pair security source local destination untrust

[FW1-zone-pair-security-Local-Untrust]packet-filter 2001

[FW1-zone-pair-security-Local-Untrust]quit

FW1 L2TP VPN LNS关键配置点：

[FW1]local-user weijianing class network

New local user added.

[FW1-luser-network-weijianing]password simple weijianing

[FW1-luser-network-weijianing]service-type ppp

[FW1-luser-network-weijianing]quit

[FW1]domain system

[FW1-isp-system]authentication ppp local

[FW1-isp-system]quit

[FW1]ip pool weijianing 172.16.1.2 172.16.1.254

[FW1]ip pool weijianing gateway 172.16.1.1

[FW1]int Virtual-Template 1

[FW1-Virtual-Template1]ip address 172.16.1.1 24

[FW1-Virtual-Template1]ppp authentication-mode chap domain system

[FW1-Virtual-Template1]remote address pool weijianing

[FW1-Virtual-Template1]quit

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface Virtual-Template 1

[FW1-security-zone-Untrust]quit

[FW1]l2tp enable

[FW1]l2tp-group 1 mode lns

[FW1-l2tp1]undo tunnel authentication

[FW1-l2tp1]tunnel name LNS

[FW1-l2tp1]allow l2tp virtual-template 1

[FW1-l2tp1]quit

测试：

物理机填写IP地址：

物理机能PING通FW1的外网地址，PING不通私网地址：

打开iNode智能客户端，点击连接右边的小三角，设置LNS服务器的IP地址：

输入用户名、密码，点击连接：

连接成功：

查看获取到的IP地址：

此时物理机已经可以PING通FW1的私网地址：

同时也可以打开SW1的WEB服务：

查看FW1的L2TP显示信息：

查看已分配的IP：

至此，F1060 L2TP VPN 客户LAC模式典型组网配置案例已完成！