f100 v7 搭建l2tp over ipsec vpn问题请教

感谢，可，以连接上了，但是访问不了内网资源，ping不同内网IP。

加个网关试试，ip pool 10 gateway 172.16.1.1。

不行，还有哪儿有问题呢，请赐教。

Virtual-Template加一下安全域，比如加到Untrust里。

[H3C]dis cu # version 7.1.064, Ess 9508 # sysname H3C # context Admin id 1 # ip vpn-instance management route-distinguisher 1000000000:1 vpn-target 1000000000:1 import-extcommunity vpn-target 1000000000:1 export-extcommunity # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # ip pool 10 172.16.1.10 172.16.1.50 # password-recovery enable # vlan 1 # interface Virtual-Template1 ppp authentication-mode chap pap remote address pool 10 ip address 172.16.1.1 255.255.255.0 # interface NULL0 # interface GigabitEthernet1/0/0 port link-mode route ip binding vpn-instance management ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route # interface GigabitEthernet1/0/2 port link-mode route ip binding vpn-instance management ip address 192.168.1.1 255.255.255.0 # interface GigabitEthernet1/0/3 port link-mode route description 联通 bandwidth 102400 ip address 59.227.141.2 255.255.255.248 ipsec apply policy l2tp # interface GigabitEthernet1/0/4 port link-mode route description 专网 ip address 10.83.66.93 255.255.255.224 # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # object-policy ip Any-Any rule 0 pass # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/4 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/3 # security-zone name Management import interface GigabitEthernet1/0/0 import interface GigabitEthernet1/0/2 # zone-pair security source Any destination Any object-policy apply ip Any-Any # scheduler logfile size 16 # line class aux user-role network-operator # line class console user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 authentication-mode scheme user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 GigabitEthernet1/0/3 59.227.141.1 # ssh server enable # domain system # aaa session-limit ftp 16 aaa session-limit telnet 16 aaa session-limit ssh 16 domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$UbIhNnPevyKUwfpm$LqR3+yg1IjNct39MkOR0H0iQXLkYB3jMqM4vbAeoXOhbabIIFnjJPEGR00YiYA1Sz4LiY3FmEdru2fOLMb1shQ== service-type ssh terminal https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user mcybjroot class network password cipher $c$3$gc5Uz+Cxhn11nJP4BzS6XNZi/X6d2PMpIqhITTs= service-type ppp authorization-attribute user-role network-operator # ipsec transform-set 1 esp encryption-algorithm des-cbc esp authentication-algorithm sha1 # ipsec policy-template l2tp 10 transform-set 1 ike-profile 1 reverse-route dynamic # ipsec policy l2tp 10 isakmp template l2tp # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication # l2tp enable # ike profile 1 keychain 10 local-identity fqdn fw match remote identity address 0.0.0.0 0.0.0.0 match remote identity fqdn client1 match local address GigabitEthernet1/0/3 proposal 1 # ike proposal 1 encryption-algorithm 3des-cbc dh group2 authentication-algorithm md5 # ike keychain 10 match local address GigabitEthernet1/0/3 pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $c$3$BQpo4eC3T8XiA7kuF9582OhqpLbKidD52A== # ip https enable # return [H3C]dis l2tp tunnel LocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName 60595 1 Established 1 192.168.0.100 56575 vpn

你VT口还是没加安全域啊。

pc端不需要添加路由吧？

pc不加路由默认所有流量都通过vpn转发。你要只想一部分流量走vpn可以加路由。那个interface Virtual-Template1先加到Untrust里去。

从pc到fw内侧的地址10.83.66.93可以平通，但到内网的其他（如10.83.66.90）不通

vt1加过了

dis cu # version 7.1.064, Ess 9508 # sysname H3C # context Admin id 1 # ip vpn-instance management route-distinguisher 1000000000:1 vpn-target 1000000000:1 import-extcommunity vpn-target 1000000000:1 export-extcommunity # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # ip pool 10 172.16.1.10 172.16.1.50 ip pool 10 gateway 172.16.1.1 # password-recovery enable # vlan 1 # interface Virtual-Template1 ppp authentication-mode chap pap remote address pool 10 ip address 172.16.1.1 255.255.255.0 # interface NULL0 # interface GigabitEthernet1/0/0 port link-mode route ip binding vpn-instance management ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route # interface GigabitEthernet1/0/2 port link-mode route ip binding vpn-instance management ip address 192.168.1.1 255.255.255.0 # interface GigabitEthernet1/0/3 port link-mode route description 联通 bandwidth 102400 ip address 59.227.141.2 255.255.255.248 ipsec apply policy l2tp # interface GigabitEthernet1/0/4 port link-mode route description 专网 ip address 10.83.66.93 255.255.255.224 # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # object-policy ip Any-Any rule 0 pass # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/4 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/3 import interface Virtual-Template1 # security-zone name Management import interface GigabitEthernet1/0/0 import interface GigabitEthernet1/0/2 # zone-pair security source Any destination Any object-policy apply ip Any-Any # scheduler logfile size 16 # line class aux user-role network-operator # line class console user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 authentication-mode scheme user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 GigabitEthernet1/0/3 59.227.141.1 # ssh server enable # domain system # aaa session-limit ftp 16 aaa session-limit telnet 16 aaa session-limit ssh 16 domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$UbIhNnPevyKUwfpm$LqR3+yg1IjNct39MkOR0H0iQXLkYB3jMqM4vbAeoXOhbabIIFnjJPEGR00YiYA1Sz4LiY3FmEdru2fOLMb1shQ== service-type ssh terminal https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user mcybjroot class network password cipher $c$3$gc5Uz+Cxhn11nJP4BzS6XNZi/X6d2PMpIqhITTs= service-type ppp authorization-attribute user-role network-operator # ipsec transform-set 1 esp encryption-algorithm des-cbc esp authentication-algorithm sha1 # ipsec policy-template l2tp 10 transform-set 1 ike-profile 1 reverse-route dynamic # ipsec policy l2tp 10 isakmp template l2tp # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication # l2tp enable # ike profile 1 keychain 10 local-identity fqdn fw match remote identity address 0.0.0.0 0.0.0.0 match remote identity fqdn client1 match local address GigabitEthernet1/0/3 proposal 1 # ike proposal 1 encryption-algorithm 3des-cbc dh group2 authentication-algorithm md5 # ike keychain 10 match local address GigabitEthernet1/0/3 pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $c$3$BQpo4eC3T8XiA7kuF9582OhqpLbKidD52A== # ip https enable # return

security-zone name Untrust import interface GigabitEthernet1/0/3 import interface Virtual-Template1

从防火墙上能ping通10.83.66.90吗？带源ping（用VT的地址做源）呢？

fw可以ping通10.83.66.90

带源还没试

带源ping也可以？ping -a 172.16.1.1 10.83.66.90。客户端是哪个版本的？

带源的ping试了一下，只有fw端10.83.66.93通，90不通，客户端是win7 64。从fw上发起带源ping和pc上发起的一样。

试试带fw上的其他ip做为源是不是也ping不通，那我有点怀疑10.83.66.90的网关或者默认路由是不是不太对，所以二层能通三层不行。

请再分析一下，感谢！

请再帮助分析一下，感谢！

您分析的对，使用fw对外端口的IP也ping不通。不过是直连网络啊！

直接ping的通，带源ping不通10.83.66.90 ，求教了，问题究竟出在哪里？fw内口直接两层连的统一网段。

现在把90的地址配到电脑上，然后93（fw的内接口）作为网关，依然不行。只是直连的网络啊。求教了！