L2TP OVER IPSEC

本人现有一台2018年购买的H3C MSR 830-winet路由器，固件版本是Version 5.20, Release 2516P19，目前在做vpn，L2TP搞成功了，但无耐苹果手机只支持l2tp over ipsec，遂在 MSR 830-winet上琢磨起了l2tp over ipsec服务，在电脑上安装华为的SecoClient做客户端进行测试，无数次尝试都未能成功，甚至MSR 830-winet的WAN口和电脑位于同一网段的交换机下，也未能成功，我完全复制下面这个方法操作的，***.***/p-1792682420.html。

1、为什么不通呢？

2、我这个路由器是否支持 l2tp over ipsec ?是不是路由器只要支持l2tp vpn和ipsec vpn，就会支持l2tp over ipsec？

3、V5可以升级成V7吗？可以的话，给个方法吧。我有UPS，不担心突然断电变砖。

[H3C]display current-configuration

#

 version 5.20, Release 2516P19

#

 sysname H3C

#

 clock timezone Beijing add 08:00:00

#

 password-control enable

 undo password-control aging enable

 undo password-control history enable

 password-control length 6

 password-control login-attempt 3 exceed lock-time 10

 password-control password update interval 0

 password-control login idle-time 0

 password-control complexity user-name check

#

 l2tp enable

#

 firewall enable

#

 ip pool 0 192.168.132.101 192.168.132.200

#

 domain default enable system

#              

 dns resolve

 dns proxy enable

#

 telnet server enable

#

 dar p2p signature-file flash:/p2p_default.mtd

#

 ndp enable

#

 ntdp enable

#

 cluster enable

#

 port-security enable

#

 password-recovery enable

#

acl number 3000

 rule 1 deny tcp destination-port eq telnet

 rule 11 deny tcp destination-port eq www

 rule 12 deny tcp destination-port eq 443

 rule 21 deny udp destination-port eq netbios-ns

 rule 22 deny udp destination-port eq netbios-dgm

 rule 23 deny tcp destination-port eq 139

 rule 24 deny tcp destination-port eq 445

#

vlan 1

#

vlan 2 to 3

#

vlan 4049

#

domain system

 authentication ppp local

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

 ip pool 0 192.168.132.101 192.168.132.200

#

ike proposal 1

#

ike proposal 2

#

ike peer tofenzhi

 exchange-mode aggressive

 proposal 2

 pre-shared-key cipher $c$3$vrAlThzJKGNCVfIDDGVbrr7wu3eSdzcGXQ==

 id-type name

#

ike peer topc

 exchange-mode aggressive

 proposal 1

 pre-shared-key cipher $c$3$NFeVS5vQVouvaYfBAAutWuPPh1mfCn/s7g==

 id-type name

 remote-name pc

 local-name local

 nat traversal

#

ipsec transform-set tofenzhi

 encapsulation-mode tunnel

 transform esp

 esp encryption-algorithm 3des

#

ipsec transform-set topc

 encapsulation-mode tunnel

 transform esp

 esp encryption-algorithm 3des

#              

ipsec policy-template fenzhi 1

 ike-peer tofenzhi

 transform-set tofenzhi

#

ipsec policy-template pc 1

 connection-name topoc

 ike-peer topc

 transform-set topc

 reverse-route

#

ipsec policy ipsec 1 isakmp template pc

#

ipsec policy ipsec 2 isakmp template fenzhi

#

dhcp server ip-pool vlan1 extended

 network ip range 192.168.128.101 192.168.128.200

 network mask 255.255.255.0

 gateway-list 192.168.128.1

 dns-list 192.168.128.1 8.8.8.8

#

dhcp server ip-pool vlan1.31

 static-bind ip-address 192.168.128.31 mask 255.255.255.0

 static-bind mac-address e839-3546-1420

 gateway-list 192.168.128.1

 dns-list 192.168.128.1 8.8.8.8

#

dhcp server ip-pool vlan2 extended

 network ip range 192.168.129.101 192.168.129.200

 network mask 255.255.255.0

 gateway-list 192.168.129.1

 dns-list 192.168.129.1 8.8.8.8

#

dhcp server ip-pool vlan2.12

 static-bind ip-address 192.168.129.12 mask 255.255.255.0

 static-bind mac-address f80d-60e3-8c54

 gateway-list 192.168.129.1

#

user-group system

 group-attribute allow-guest

#

local-user admin

 authorization-attribute level 3

 service-type ssh telnet

 service-type web

local-user hzc513722

 service-type ppp

#

l2tp-group 1

 undo tunnel authentication

 allow l2tp virtual-template 0

 tunnel name LNS

#

interface Cellular0/0

 async mode protocol

 link-protocol ppp

 tcp mss 1024

#

interface Dialer10

 nat outbound

 link-protocol ppp

 ppp chap user YB5416017

 ppp chap password cipher $c$3$xFynsIgf08iU9gjAeCeMF8ZL3LQxCUbI2K0=

 ppp pap local-user YB5416017 password cipher $c$3$LBHVveTQ9Jk2X/KajkMOcr5z0W10guoup1w=

 ppp ipcp dns admit-any

 ppp ipcp dns request

 mtu 1492

 ip address ppp-negotiate

 tcp mss 1024

 dialer user username

 dialer-group 10

 dialer bundle 10

#

interface Dialer11

 nat outbound

 firewall packet-filter 3000 inbound

 link-protocol ppp

 ppp chap user yb39964697

 ppp chap password cipher $c$3$cTtvhjttmhu9h1fJNutq1AiHQR20UF28HQ==

 ppp pap local-user yb39964697 password cipher $c$3$50kcN0PASdFOO/IaKDYGFmn7PsFKqKjYbQ==

 ppp ipcp dns admit-any

 ppp ipcp dns request

 mtu 1492

 shutdown

 ip address ppp-negotiate

 tcp mss 1024

 dialer user username

 dialer-group 11

 dialer bundle 11

#

interface Virtual-Template0

 firewall packet-filter 3000 inbound

 ppp authentication-mode chap

 ppp ipcp remote-address forced

 ppp ipcp dns 192.168.132.1 8.8.8.8

 remote address pool

 ip address 192.168.132.1 255.255.255.0

#

interface NULL0

#

interface Vlan-interface1

 ip address 192.168.128.1 255.255.255.0

 tcp mss 1024

 dhcp server apply ip-pool vlan1

#

interface Vlan-interface2

 ip address 192.168.129.1 255.255.255.0

 tcp mss 1024

 dhcp server apply ip-pool vlan2

#

interface Vlan-interface3

 ip address 192.168.130.1 255.255.255.0

#

interface Vlan-interface4049

 ip address 192.168.131.1 255.255.255.0

#

interface GigabitEthernet0/0

 port link-mode route

 firewall packet-filter 3000 inbound

 nat outbound

 pppoe-client dial-bundle-number 10

#

interface GigabitEthernet0/3

 port link-mode route

 firewall packet-filter 3000 inbound

 nat outbound

 ip address dhcp-alloc

#

interface GigabitEthernet0/4

 port link-mode route

 nat outbound

 ip address 172.27.222.22 255.255.255.0

 tcp mss 1024

 ipsec policy ipsec

#

interface GigabitEthernet0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 3 4049

#

interface GigabitEthernet0/2

 port link-mode bridge

#

 ip route-static 0.0.0.0 0.0.0.0 Dialer10

 ip route-static 0.0.0.0 0.0.0.0 Dialer11

 ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/3 172.16.152.129 preference 70

 ip route-static 172.16.0.0 255.240.0.0 GigabitEthernet0/4 172.27.222.1

#

 dhcp enable

#

 ntp-service unicast-server 120.25.115.20 version 1

 ntp-service refclock-master 11

#

 arp static 192.168.128.11 0011-326d-d183 1 GigabitEthernet0/1

 arp static 192.168.128.31 e839-3546-1420 1 GigabitEthernet0/1

#

 dialer-rule 11 ip permit

 dialer-rule 10 ip permit

#

 nms primary monitor-interface Dialer10

#

 load xml-configuration

#

 load tr069-configuration

#              

user-interface con 0

user-interface tty 13

user-interface vty 0 4

 authentication-mode scheme

#

return