L2TP over IPSec结合iNode客户端与移动终端拨号典型配置

出口为LB，将防火墙地址做了静态映射； L2TP over IPSec做在内网的防火墙上；属于内网地址映射和拨号认证的场景。

FW侧配置：

ipsec policy-template 1 1

transform-set 3 4 5 7 8 9      //  3 4 5 为传输模式，匹配手机端；7 8 9为隧道模式，匹配PC iNODE

local-address XXXX

ike-profile 1

reverse-route dynamic   //添加反向路由引入的命令，向终端发送全0默认路由

#

ike profile 1

keychain 1

local-identity fqdn LNS

match remote identity user-fqdn LAC    //  匹配手机端配置的LAC标识符

match remote identity fqdn LAC          //   匹配PC iNODE 端 的标识符

match remote identity address 0.0.0.0 0.0.0.0    // 匹配手机端不配置ipsec标识符的情形

proposal 1 2 3 4 5 6

#

ipsec transform-set 3

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1 

#

ipsec transform-set 4

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha1 

#

ipsec transform-set 5

 encapsulation-mode transport

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec transform-set 7

 esp encryption-algorithm aes-cbc-192

 esp authentication-algorithm sha1 

#

ipsec transform-set 8

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec transform-set 9

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha1 

#

ike proposal 1

 encryption-algorithm aes-cbc-128

 dh group2

 authentication-algorithm md5

#

ike proposal 2

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

#

ike proposal 3

 encryption-algorithm 3des-cbc

 dh group2

#

ike proposal 4

 encryption-algorithm aes-cbc-256

 dh group2

#

ike proposal 5

 dh group2

#

ike proposal 6

 encryption-algorithm aes-cbc-192

 dh group2

#

ike keychain 1

 pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $c$3$cLvXGmVl9pDX6==

•名称应该写LNS 

•类型选L2TP/IPSEC PSK 

•服务器地址填公网地址XXXX

•ipsec表示符选填，可以填LAC

•预共享秘钥与防火墙上pre-share-key一致 保存后用防火墙上建的local-user用户密码登陆即可。