王子腾,V7 MSR路由器对接V7 F1000防火墙 L2TP over IPSec典型配置
组网及说明
防火墙是总部出口，MSR路由器是分部出口拨号上网，两台设备跨越公网建立L2TP over IPSec隧道实现总部分部私网互通。
配置步骤
路由器作为LAC，重要配置如下：
#
防火墙作为LNS，重要配置如下： # interface Virtual-Template1 ppp authentication-mode pap domain system remote address 10.0.0.5 ip address 10.0.0.6 255.255.255.252 # interface LoopBack0 ip address 10.0.0.2 255.255.255.255 # interface GigabitEthernet1/0/0 description Wan Interface ip address x.x.x.x 255.255.255.248 nat outbound 3001 ipsec apply policy l2tp # security-zone name Untrust import interface GigabitEthernet1/0/0 import interface Virtual-Template1 # ip route-static 0.0.0.0 0 58.221.232.193 ip route-static 191.167.0.0 23 10.0.0.5 //////到分部的路由 # acl advanced 3001 rule 0 deny ip source 10.0.0.2 0 destination 10.0.0.1 0 rule 1 permit ip # acl advanced 3100 rule 0 permit ip source 10.0.0.2 0 destination 10.0.0.1 0 # domain system authentication ppp local # domain default enable system # local-user 1 class network password cipher $c$3$PqnMSMl/vI4ZQk+HvRfYcSiOv+u226I= service-type ppp authorization-attribute user-role network-operator # ipsec transform-set l2tp esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 # ipsec policy-template l2tp 1 transform-set l2tp local-address x.x.x.x //////(x.x.x.x为总部防火墙出口地址) ike-profile l2tp # ipsec policy l2tp 1 isakmp template l2tp # l2tp-group 1 mode lns allow l2tp virtual-template 1 remote lac undo tunnel authentication tunnel name lns # l2tp enable # ike identity fqdn FW # ike profile l2tp keychain l2tp exchange-mode aggressive local-identity fqdn fw match remote identity fqdn admin # ike keychain l2tp pre-shared-key address 0.0.0.0 0.0.0.0 key simple 123456 # security-policy ip rule 1 name Any_Any_1_IPv4 action pass
查看ike sa、ipsec sa建立情况、l2tp建立情况
<MSR>dis ike sa
Connection-ID Local Remote Flag DOI
-------------------------------------------------------------------------
23 10.164.118.x x.x.x.x RD IPsec
Flags:
RD--READY RL--REPLACED FD-FADING RK-REKEY
<MSR>dis ipsec sa
-------------------------------
Interface: Eth-channel1/0:0
-------------------------------
-----------------------------
IPsec policy: l2tp
Sequence number: 1
Mode: ISAKMP
-----------------------------
Tunnel id: 0
Encapsulation mode: tunnel
Perfect Forward Secrecy:
Inside VPN:
Extended Sequence Numbers enable: N
Traffic Flow Confidentiality enable: N
Transmitting entity: Initiator
Path MTU: 1436
Tunnel:
local address: 10.164.118.x
remote address: x.x.x.x
Flow:
sour addr: 10.0.0.1/255.255.255.255 port: 0 protocol: ip
dest addr: 10.0.0.2/255.255.255.255 port: 0 protocol: ip
[Inbound ESP SAs]
SPI: 883318680 (0x34a65f98)
[MSR]dis l2tp tunnel
LocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName
53451 12731 Established 1 x.x.x.x 1701 lns
配置关键点
l2tp隧道建议起loopback口，用loopback口地址建立。
ipsec野蛮模式两端都用地址或者fqdn建立隧道。
