基于LAC拨号的L2TP VPN场景

一.实验拓扑

路由器模拟终端设备，实验场景比较简单，这里直接上操作；

二.实验步骤

1.PPPoE建立

Client

[PPPoe Client]int Dialer 1
[PPPoe Client-Dialer1]dis this
[V200R003C00]
#
interface Dialer1
 link-protocol ppp
 ppp chap user user1
 ppp chap password cipher %$%$UTgR0G3b`*aXKvWK%KO$,"Rl%$%$
 ip address ppp-negotiate
 dialer user user1
 dialer bundle 1
#
return
[PPPoe Client]int g 0/0/0
[PPPoe Client-GigabitEthernet0/0/0]pppoe-client dial-bundle-number 1

Server 

[LAC]interface Virtual-Template 1
[LAC-Virtual-Template1]ppp authentication-mode chap
[LAC-Virtual-Template1]ip address 2.2.2.2 24
[LAC]firewall zone dmz
[LAC-zone-dmz]add interface Virtual-Template 1
[LAC-GigabitEthernet1/0/0]pppoe-server bind virtual-template 1
[LAC]aaa
[LAC-aaa]domain default
[LAC-aaa-domain-default]service-type l2tp
[LAC]user-manage user user1 domain default
[LAC-localuser-user1]password Password123

2.建立L2TP隧道

[LAC]l2tp enable
[LAC]l2tp-group 1
[LAC-l2tp-1]tunnel authentication
[LAC-l2tp-1]tunnel password cipher Hello123
[LAC-l2tp-1]tunnel name lac
[LAC-l2tp-1]start l2tp ip 20.1.1.2 fullusername user1

 3.安全策略

[LAC]security-policy
[LAC-policy-security]rule name l2tp
[LAC-policy-security-rule-l2tp]source-zone local 
[LAC-policy-security-rule-l2tp]destination-zone untrust 
[LAC-policy-security-rule-l2tp]source-address 20.1.1.1 32
[LAC-policy-security-rule-l2tp]destination-address 20.1.1.2 32
[LAC-policy-security-rule-l2tp]service l2tp 
[LAC-policy-security-rule-l2tp]action permit 

[LNS]security-policy 
[LNS-policy-security]rule name l2tp
[LNS-policy-security-rule-l2tp]destination-zone local 
[LNS-policy-security-rule-l2tp]source-address 20.1.1.1 32
[LNS-policy-security-rule-l2tp]destination-address 20.1.1.2 32
[LNS-policy-security-rule-l2tp]service l2tp 
[LNS-policy-security-rule-l2tp]action permit 
[LNS-policy-security]rule name ping
[LNS-policy-security-rule-ping]source-zone dmz 
[LNS-policy-security-rule-ping]destination-zone trust 
[LNS-policy-security-rule-ping]source-address 172.16.1.0 24
[LNS-policy-security-rule-ping]destination-address 192.168.1.0 24
[LNS-policy-security-rule-ping]action permit 

三.实验结果验证 

 抓包结果可以看出l2tp vpn的封装思路