华为防火墙部署 l2tp over ipsec

一般手机不能很好支持ssl vpn 和EAP认证, 客户需要部署L2TP OVER IPSEC

配置：

interface Virtual-Template1ppp authentication-mode chapip address 172.16.19.1 255.255.255.0firewall zone untrustset priority 5add interface Dialer0add interface Virtual-Template1l2tp enable
l2tp-group 1tunnel password cipher admin@123    //关闭tunnel认证  undo tunnel authenticationtunnel name LNSallow l2tp virtual-template 1 remote client  //l2tp组1可以不指定隧道对端名称吗？user-manage user admin domain default     password admin@123      //创建账号密码ip pool l2tpsection 0 172.16.19.3 172.16.19.254  //给客户端分配地址aaaauthentication-scheme defaultauthentication-mode localservice-scheme l2tpip-pool l2tpdomain default     //domain域下调用authentication-scheme defaultservice-scheme l2tpservice-type l2tpinternet-access mode passwordreference user current-domain

以上部分是普通的L2TP配置

==========================================

acl number 3000rule 5 permit udp source-port eq 1701  //抓感兴趣流，L2TP协议报文端口是1701ike proposal 1encryption-algorithm aes-256dh group2authentication-algorithm sha2-256authentication-method pre-shareintegrity-algorithm hmac-sha2-256prf hmac-sha2-256ike peer 1exchange-mode autopre-shared-key admin@123ike-proposal 1rsa encryption-padding oaeprsa signature-padding pssikev2 authentication sign-hash sha2-256ipsec proposal 1encapsulation-mode auto   //封装方式建议采用传输模式esp authentication-algorithm sha2-256esp encryption-algorithm aes-256ipsec policy-template 1 1    //手机端没有固定ip，采用模板方式security acl 3000ike-peer 1proposal 1scenario point-to-multi-point l2tp-user-accessipsec policy l2tp 10 isakmp template 1
interface Dialer0    //dialer口下调用，客户这边是PPPoE上网获取的是动态的公网ipipsec policy l2tp

本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！