组网及说明
文章插图
1、FW1为内网的出口设备，提供内网的NAT地址转换服务 。
2、FW1与FW2建立L2TP VPN隧道，采用独立LAC模式、FW1为LNS，FW2为LAC
3、FW1与物理机建立L2TP VPN隧道，采用客户LAC模式、FW1为LNS，物理机为LAC
配置步骤1、按照网络拓扑图正确配置IP地址
2、FW2配置NAT地址转换，并配置默认路由指向ISP
3、FW1配置NAT地址转换，并配置默认路由指向ISP
4、FW2配置为L2TP VPN LAC端点
5、FW1配置为L2TP VPN LNS端点
6、SW1开启WEB功能，并创建相应用户及分配权限
配置关键点SW1：<H3C>sysSystem View: return to User View with Ctrl+Z.[H3C]sysname SW1[SW1]int gi 1/0/1[SW1-GigabitEthernet1/0/1]port link-mode route[SW1-GigabitEthernet1/0/1]des <connect to FW1>[SW1-GigabitEthernet1/0/1]ip address 10.0.0.1 30[SW1-GigabitEthernet1/0/1]quit[SW1]ip route-static 0.0.0.0 0.0.0.0 10.0.0.2[SW1]ip http enable[SW1]ip https enable[SW1]local-user adminNew local user added.[SW1-luser-manage-admin]password simple admin[SW1-luser-manage-admin]service-type http https[SW1-luser-manage-admin]authorization-attribute user-role network-admin[SW1-luser-manage-admin]quitISP：<H3C>sysSystem View: return to User View with Ctrl+Z.[H3C]sysname ISP[ISP]int gi 0/0[ISP-GigabitEthernet0/0]des <connect to FW2>[ISP-GigabitEthernet0/0]ip address 202.1.100.1 30[ISP-GigabitEthernet0/0]quit[ISP]int gi 0/1[ISP-GigabitEthernet0/1]des <connect to FW1>[ISP-GigabitEthernet0/1]ip address 202.2.100.1 30[ISP-GigabitEthernet0/1]quitFW2：<H3C>sysSystem View: return to User View with Ctrl+Z.[H3C]sysname FW2[FW2]acl basic 2000[FW2-acl-ipv4-basic-2000]rule 0 permit source any[FW2-acl-ipv4-basic-2000]quit[FW2]int gi 1/0/2[FW2-GigabitEthernet1/0/2]des <connect to ISP>[FW2-GigabitEthernet1/0/2]ip address 202.1.100.2 30[FW2-GigabitEthernet1/0/2]nat outbound 2000[FW2-GigabitEthernet1/0/2]quit[FW2]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1[FW2]security-zone name Untrust[FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/2[FW2-security-zone-Untrust]quit[FW2]acl basic 2001[FW2-acl-ipv4-basic-2001]rule 0 permit source any[FW2-acl-ipv4-basic-2001]quit[FW2][FW2]zone-pair security source trust destination untrust[FW2-zone-pair-security-Trust-Untrust]packet-filter 2001[FW2-zone-pair-security-Trust-Untrust]quit[FW2][FW2]zone-pair security source untrust destination trust[FW2-zone-pair-security-Untrust-Trust]packet-filter 2001[FW2-zone-pair-security-Untrust-Trust]quit[FW2][FW2]zone-pair security source trust destination local[FW2-zone-pair-security-Trust-Local]packet-filter 2001[FW2-zone-pair-security-Trust-Local]quit[FW2][FW2]zone-pair security source local destination trust[FW2-zone-pair-security-Local-Trust]packet-filter 2001[FW2-zone-pair-security-Local-Trust]quit[FW2][FW2]zone-pair security source untrust destination local[FW2-zone-pair-security-Untrust-Local]packet-filter 2001[FW2-zone-pair-security-Untrust-Local]quit[FW2][FW2]zone-pair security source local destination untrust[FW2-zone-pair-security-Local-Untrust]packet-filter 2001[FW2-zone-pair-security-Local-Untrust]quitFW2 L2TP VPN LAC端点配置关键点：
[FW2]local-user weijianing class networkNew local user added.[FW2-luser-network-weijianing]password simple weijianing[FW2-luser-network-weijianing]service-type ppp[FW2-luser-network-weijianing]quit[FW2]l2tp enable[FW2]l2tp-group 1 mode lac[FW2-l2tp1]tunnel name LAC[FW2-l2tp1]tunnel authentication[FW2-l2tp1]tunnel password simple weijianing[FW2-l2tp1]user fullusername weijianing[FW2-l2tp1]source 202.1.100.2[FW2-l2tp1]lns-ip 202.2.100.2[FW2-l2tp1]quit[FW2]int Virtual-PPP 1[FW2-Virtual-PPP1]ip address ppp-negotiate[FW2-Virtual-PPP1]ppp chap user weijianing[FW2-Virtual-PPP1]ppp chap password simple weijianing[FW2-Virtual-PPP1]l2tp-auto-client l2tp-group 1[FW2-Virtual-PPP1]quit[FW2]ip route-static 172.16.1.0 255.255.255.0 Virtual-PPP 1[FW2]ip route-static 10.0.0.0 255.255.255.0 Virtual-PPP 1[FW2]security-zone name Untrust[FW2-security-zone-Untrust]import interface Virtual-PPP 1[FW2-security-zone-Untrust]quit
推荐阅读
- 如何与圆通快递合作,圆通快递市场前景如何
- 3星4s多少钱,利之星4S店与第三方公司协作
- 数字电路和模拟电路的区别,请说明数字电路与模拟电路的区别
- 苹果11与苹果x的区别
- 苹果11与苹果11pro的区别
- 方与圆的人生智慧课 人生哲学
- O2与多普达的区别？
- 苹果醋的功效与作用是什么？
- Delta 有可能不是手机？
- 东华大学科技园,闵行这个特色小镇与上海交大科技园签约