20 |
您所在的位置:网站首页 › lac官网 › 20 |
1 简介
本文档介绍MSR系列路由器L2TP over IPsec典型配置举例。 2 配置前提本文档适用于使用Comware V7软件版本的MSR系列路由器,如果使用过程中与产品实际情况有差异,请参考相关产品手册,或以设备实际情况为准。 本文档中的配置均是在实验室环境下进行的配置和验证,配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置,为了保证配置效果,请确认现有配置和以下举例中的配置不冲突。 本文档假设您已了解L2TP和IPsec特性。 3 配置举例 3.1 组网需求如图1所示,Host通过L2TP隧道访问LNS一侧的网络。具体应用需求如下: · LAC与LNS自动建立L2TP隧道 · LAC与LNS之间采用IKE方式建立IPsec安全隧道来对L2TP流量进行加密。 图1 MSR系列路由器L2TP over IPsec典型配置组网图 3.2 使用版本 本举例是在R6728版本上进行配置和验证的。 3.3 配置步骤 3.3.1 LNS的配置# 配置本地用户1,设置密码为1234。 system-view [LNS] local-user 1 class network [LNS-luser-network-1] password simple 1234 [LNS-luser-network-1] service-type ppp [LNS-luser-network-1] quit # 配置ISP域system对PPP用户采用本地验证。 [LNS] domain system [LNS-isp-system] authentication ppp local [LNS-isp-system] quit # 使能L2TP。 [LNS] l2tp enable # 配置虚模板Virtual-Template1配置接口的IP地址为192.168.0.1/24,PPP认证方式为PAP,并指定为PPP用户分配的IP地址为192.168.0.2。 [LNS] interface virtual-template 1 [LNS-Virtual-Template1] ip address 192.168.0.1 24 [LNS-Virtual-Template1] ppp authentication-mode pap domain system [LNS-Virtual-Template1] remote address 192.168.0.2 [LNS-Virtual-Template1] quit # 创建LNS模式的L2TP组1,配置隧道本端名称为lns,指定接收呼叫的虚拟模板接口为VT1,并配置L2TP隧道对端名为lac。 [LNS] l2tp-group 1 mode lns [LNS-l2tp1] tunnel name lns [LNS-l2tp1] undo tunnel authentication [LNS-l2tp1] allow l2tp virtual-template 1 remote lac [LNS-l2tp1] quit # 配置访问控制列表。 [LNS] acl number 3000 [LNS-acl-adv-3000] rule permit ip source 10.0.0.2 0 destination 10.0.0.1 0 [LNS-acl-adv-3000] quit # 配置IKE keychain。 [LNS] ike keychain l2tp # 配置与地址为10.0.0.1的对端使用的预共享密钥为明文的abcd。 [LNS-ike-keychain-l2tp] pre-shared-key address 10.0.0.1 key simple abcd [LNS-ike-keychain-l2tp] quit #在IKE profile l2tp中指定名称为l2tp的配置的IKE keychain。 [LNS] ike profile l2tp [LNS-ike-profile-l2tp] keychain l2tp # 指定使用IP地址10.0.0.2标识本端身份。 [LNS-ike-profile-l2tp] local-identity address 10.0.0.2 # 指定需要匹配对端身份类型为IP地址,取值为10.0.0.1。 [LNS-ike-profile-l2tp] match remote identity address 10.0.0.1 [LNS-ike-profile-l2tp] quit # 配置IPsec安全协议。 [LNS] ipsec transform-set l2tp # 配置IPsec安全提议采用的ESP加密算法为CBC模式的3DES算法。 [LNS-ipsec-transform-set-l2tp] esp encryption-algorithm 3des-cbc # 配置IPsec安全提议采用的ESP认证算法为MD5。 [LNS-ipsec-transform-set-l2tp] esp authentication-algorithm md5 [LNS-ipsec-transform-set-l2tp] quit # 配置IPsec安全策略引用ACL 3000和名字为l2tp的IPsec安全提议,并指定IPsec隧道的对端IPv4地址为10.0.0.1。 [LNS] ipsec policy l2tp 1 isakmp [LNS-ipsec-policy-isakmp-l2tp-1] security acl 3000 [LNS-ipsec-policy-isakmp-l2tp-1] transform-set l2tp [LNS-ipsec-policy-isakmp-l2tp-1] ike-profile l2tp [LNS-ipsec-policy-isakmp-l2tp-1] remote-address 10.0.0.1 [LNS-ipsec-policy-isakmp-l2tp-1] quit # 配置连接LAC的接口GigabitEthernet1/0/1的IP地址并使能IPsec安全策略。 # 配置接口IP地址并使能IPsec安全策略。 [LNS] interface gigabitethernet 1/0/1 [LNS-GigabitEthernet1/0/1] ip address 10.0.0.2 24 [LNS-GigabitEthernet1/0/1] ipsec apply policy l2tp [LNS-GigabitEthernet1/0/1] quit # 配置接口GigabitEthernet1/0/2的IP地址。 [LNS] interface gigabitethernet 1/0/2 [LNS-GigabitEthernet1/0/2] ip address 15.0.0.1 24 [LNS-GigabitEthernet1/0/2] quit 3.3.2 LAC的配置# 开启L2TP功能。 system-view [LAC] l2tp enable # 创建LAC模式的L2TP组1。 [LAC] l2tp-group 1 mode lac # 配置LAC侧本端名称为LAC,并指定LNS的IP地址为10.0.0.2。 [LAC-l2tp1] tunnel name lac [LAC-l2tp1] lns-ip 10.0.0.2 [LAC-l2tp1] undo tunnel authentication [LAC-l2tp1] quit # 配置访问控制列表。 [LAC] acl number 3000 # 配置ACL的规则。 [LAC-acl-adv-3000] rule permit ip source 10.0.0.1 0 destination 10.0.0.2 0 [LAC-acl-adv-3000] quit # 配置Virtual-ppp口,配置PPP用户的用户名为1,密码为1234,并配置PPP验证方式为PAP。 [LAC] interface virtual-PPP 1 [LAC-Virtual-PPP1] ip address ppp-negotiate [LAC-Virtual-PPP1] ppp pap local-user 1 password simple 1234 [LAC-Virtual-PPP1] quit # 配置私网路由,访问公司总部的报文将通过L2TP隧道转发。 [LAC] ip route-static 15.0.0.1 24 Virtual-PPP 1 # 配置IKE keychain。 [LAC] ike keychain l2tp # 配置与地址为10.0.0.2的对端使用的预共享密钥为明文的abcd。 [LAC-ike-keychain-l2tp] pre-shared-key address 10.0.0.2 key simple abcd [LAC-ike-keychain-l2tp] quit # 在IKE profile l2tp中指定名称为l2tp的配置的IKE keychain。 [LAC] ike profile l2tp [LAC-ike-profile-l2tp] keychain l2tp # 指定使用IP地址10.0.0.1标识本端身份。 [LAC-ike-profile-l2tp] local-identity address 10.0.0.1 # 指定需要匹配对端身份类型为IP地址,取值为10.0.0.2。 [LAC-ike-profile-l2tp] match remote identity address 10.0.0.2 [LAC-ike-profile-l2tp] quit # 配置Ipsec安全协议。 [LAC] ipsec transform-set l2tp # 配置IPsec安全提议采用的ESP加密算法为CBC模式的3DES算法。 [LAC-ipsec-transform-set-l2tp] esp encryption-algorithm 3des-cbc # 配置IPsec安全提议采用的ESP认证算法为MD5。 [LAC-ipsec-transform-set-l2tp] esp authentication-algorithm md5 [LAC-ipsec-transform-set-l2tp] quit # 配置IPsec安全策略引用ACL 3000和名字为l2tp的IPsec安全提议,并指定IPsec隧道的对端IPv4地址为10.0.0.2。 [LAC] ipsec policy l2tp 1 isakmp [LAC-ipsec-policy-isakmp-l2tp-1] security acl 3000 [LAC-ipsec-policy-isakmp-l2tp-1] transform-set l2tp [LAC-ipsec-policy-isakmp-l2tp-1] ike-profile l2tp [LAC-ipsec-policy-isakmp-l2tp-1] remote-address 10.0.0.2 [LAC-ipsec-policy-isakmp-l2tp-1] quit # 配置接口GigabitEthernet1/0/2的IP地址。 [LAC] interface gigabitethernet 1/0/2 [LAC-GigabitEthernet1/0/2] ip address 14.0.0.1 24 [LAC-GigabitEthernet1/0/2] quit # 配置连接LNS的接口GigabitEthernet1/0/1的IP地址并使能IPsec安全策略。 [LAC] interface gigabitethernet 1/0/1 [LAC-GigabitEthernet1/0/1] ip address 10.0.0.1 24 [LAC-GigabitEthernet1/0/1] ipsec apply policy l2tp [LAC-GigabitEthernet1/0/1] quit # 执行l2tp-auto-client命令触发LAC建立L2TP隧道。 [LAC] interface virtual-PPP 1 [LAC-Virtual-PPP1] l2tp-auto-client l2tp-group 1 3.4 验证配置# LAC上可以看到L2TP隧道和L2TP会话的建立情况。 [LAC] display l2tp tunnel LocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName 23561 63423 Established 1 10.0.0.2 1701 lns
[LAC] display l2tp session LocalSID RemoteSID LocalTID State 1538 2562 23561 Established # LNS上可以看到L2TP隧道和L2TP会话的建立情况。 [LNS] display l2tp tunnel LocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName 63423 23561 Established 1 10.0.0.1 1701 lac
[LNS] display l2tp session LocalSID RemoteSID LocalTID State 2562 1538 63423 Established # LAC上可以看到IKE SA和IPSec SA的建立情况。 [LAC] display ike sa Connection-ID Remote Flag DOI ------------------------------------------------------------------ 5 10.0.0.2 RD IPSEC Flags: RD--READY RL--REPLACED FD-FADING
[LAC]display ipsec sa ------------------------------- Interface: GigabitEthernet1/0/1 -------------------------------
----------------------------- IPsec policy: l2tp Sequence number: 1 Mode: isakmp ----------------------------- Tunnel id: 0 Encapsulation mode: tunnel Perfect forward secrecy: Path MTU: 1443 Tunnel: local address: 10.0.0.1 remote address: 10.0.0.2 Flow: sour addr: 10.0.0.1/255.255.255.255 port: 0 protocol: ip dest addr: 10.0.0.2/255.255.255.255 port: 0 protocol: ip
[Inbound ESP SAs] SPI: 987342280 (0x3ad9a5c8) Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843181/2339 Max received sequence-number: 319 Anti-replay check enable: Y Anti-replay window size: 64 UDP encapsulation used for nat traversal: N Status: active
[Outbound ESP SAs] SPI: 2705574035 (0xa143c893) Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843182/2339 Max sent sequence-number: 301 UDP encapsulation used for nat traversal: N Status: active
# LNS上可以看到IKE SA和IPSec SA的建立情况。 [LNS] display ike sa Connection-ID Remote Flag DOI ------------------------------------------------------------------ 1 10.0.0.1 RD IPSEC Flags: RD--READY RL--REPLACED FD-FADING
[LNS] display ipsec sa ------------------------------- Interface: GigabitEthernet1/0/1 -------------------------------
----------------------------- IPsec policy: l2tp Sequence number: 1 Mode: isakmp ----------------------------- Tunnel id: 0 Encapsulation mode: tunnel Perfect forward secrecy: Path MTU: 1443 Tunnel: local address: 10.0.0.2 remote address: 10.0.0.1 Flow: sour addr: 10.0.0.2/255.255.255.255 port: 0 protocol: ip dest addr: 10.0.0.1/255.255.255.255 port: 0 protocol: ip
[Inbound ESP SAs] SPI: 2705574035 (0xa143c893) Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843181/2300 Max received sequence-number: 310 Anti-replay check enable: Y Anti-replay window size: 64 UDP encapsulation used for nat traversal: N Status: active
[Outbound ESP SAs] SPI: 987342280 (0x3ad9a5c8) Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5 SA duration (kilobytes/sec): 1843200/3600 SA remaining duration (kilobytes/sec): 1843180/2300 Max sent sequence-number: 329 UDP encapsulation used for nat traversal: N Status: active # Host A所属网段可以通过L2TP隧道访问外网。 [LAC] ping -a 14.0.0.1 15.0.0.1 Ping 15.0.0.1 (15.0.0.1) from 14.0.0.1: 56 data bytes, press escape sequence to break 56 bytes from 15.0.0.1: icmp_seq=0 ttl=255 time=0.462 ms 56 bytes from 15.0.0.1: icmp_seq=1 ttl=255 time=0.280 ms 56 bytes from 15.0.0.1: icmp_seq=2 ttl=255 time=0.276 ms 56 bytes from 15.0.0.1: icmp_seq=3 ttl=255 time=0.280 ms 56 bytes from 15.0.0.1: icmp_seq=4 ttl=255 time=0.280 ms
--- Ping statistics for 15.0.0.1 --- 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.276/0.316/0.462/0.073 ms [LAC]%Jul 3 14:01:16:689 2013 LAC PING/6/PING_STATIS_INFO: Ping statistics for 15.0.0.1: 5 packet(s) transmitted, 5 packet( s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 0.276/0.316/0.462/0.073 ms. 3.5 配置文件· LNS: # interface Virtual-Template1 remote address 192.168.0.2 ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route combo enable copper ip address 10.0.0.2 255.255.255.0 ipsec apply policy l2tp # interface GigabitEthernet1/0/2 port link-mode route ip address 15.0.0.1 255.255.255.0 # ip route-static 14.0.0.0 24 192.168.0.2 # acl number 3000 rule 0 permit ip source 10.0.0.2 0 destination 10.0.0.1 0 # domain system authentication ppp local # local-user 1 class network password cipher $c$3$1dZEFYrvdICeeFOnqOoFpzXF8G0dZ+4= service-type ppp authorization-attribute user-role network-operator # ipsec transform-set l2tp esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 # ipsec policy l2tp 1 isakmp transform-set l2tp security acl 3000 remote-address 10.0.0.1 ike-profile l2tp # l2tp-group 1 mode lns allow l2tp virtual-template 1 remote lac undo tunnel authentication tunnel name lns # l2tp enable # ike profile l2tp keychain l2tp local-identity address 10.0.0.2 match remote identity address 10.0.0.1 255.255.255.255 # ike keychain l2tp pre-shared-key address 10.0.0.1 255.255.255.255 key cipher $c$3$7tvgEkFh6On3KIybUaywz5NDiHtwJqU= # · LAC: # interface Virtual-PPP1 ppp pap local-user 1 password cipher $c$3$i132FpC8DcHeIet4NXtmz6ot44xY8ts= ip address ppp-negotiate l2tp-auto-client l2tp-group 1 # interface GigabitEthernet1/0/1 port link-mode route ip address 10.0.0.1 255.255.255.0 ipsec apply policy l2tp # interface GigabitEthernet1/0/2 port link-mode route ip address 14.0.0.1 255.255.255.0 # acl number 3000 rule 0 permit ip source 10.0.0.1 0 destination 10.0.0.2 0 # domain system authentication ppp local # ipsec transform-set l2tp esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 # ipsec policy l2tp 1 isakmp transform-set l2tp security acl 3000 remote-address 10.0.0.2 ike-profile l2tp # l2tp-group 1 mode lac lns-ip 10.0.0.2 undo tunnel authentication tunnel name lac # l2tp enable # ike profile l2tp keychain l2tp local-identity address 10.0.0.1 match remote identity address 10.0.0.2 255.255.255.255 # ike keychain l2tp pre-shared-key address 10.0.0.2 255.255.255.255 key cipher $c$3$3ErJJ2M1lhES32CdsR3ofs5CdLvPJGk= # 4 相关资料· 《H3C MSR系列路由器 配置指导(V7)》中的“二层技术-广域网接入配置指导” · 《H3C MSR系列路由器 命令参考(V7)》中的“二层技术-广域网接入命令参考” · 《H3C MSR系列路由器 配置指导(V7)》中的“安全配置指导” · 《H3C MSR系列路由器 命令参考(V7)》中的“安全命令参考” |
CopyRight 2018-2019 办公设备维修网 版权所有 豫ICP备15022753号-3 |