【实验】配置用户通过L2TP实现与总部互通案例

sysname LAC

#

l2tp enable  //启用L2TP功能

#

aaa

authentication-scheme lmt

domain aaa.com

 authentication-scheme lmt

domain bbb.com

 authentication-scheme lmt

local-user user1@aaa.com password cipher %@%@/|S75*sxcH2@FQL=wn#2@I`a%@%@

local-user user1@aaa.com privilege level 15

local-user user1@aaa.com service-type ppp

local-user user2@bbb.com password cipher %@%@qh-<X%_2QB+^!UR+UkxUA/6<%@%@

local-user user2@bbb.com privilege level 15

local-user user2@bbb.com service-type ppp  //配置PPPoE服务器的本地用户名和类型，用于认证接入的用户

#

interface Virtual-Template1  //创建虚拟接口模板VT1，为PPPoE服务器配置参数

ppp authentication-mode chap  //对接入用户的认证方式为CHAP认证

#

interface GigabitEthernet1/0/0

ip address 202.1.1.2 255.255.255.0

#

interface GigabitEthernet2/0/0

pppoe-server bind Virtual-Template 1  //接口上启用PPPoE Server功能，引入VT1的配置参数，认证接入的拨号用户

#

interface GigabitEthernet3/0/0

pppoe-server bind Virtual-Template 1

#

l2tp-group 1  //创建L2TP组，为建立L2TP隧道配置参数

tunnel password cipher %@%@/-#)Lg[S4F:#2~ZNvqa$]\DL%@%@  //缺省使能隧道认证，配置密文密码为huawei，和对端认证一致

tunnel name lac1  //隧道的名称为lac1，用于被对端LNS识别

start l2tp ip 202.1.1.1 domain aaa.com  //如接入用户的域名为aaa.com，则发起到对端的L2TP隧道连接

#

l2tp-group 2

tunnel password cipher %@%@EB~j7Je>;@>uNr''D=J<]\WL%@%@

tunnel name lac2

start l2tp ip 202.1.1.1 domain bbb.com

sysname LNS

#

l2tp enable

#

ip pool 1  //创建IP地址池，名称为1，为接入用户分配IP地址

gateway-list 10.1.1.1  //网关地址

network 10.1.1.0 mask 255.255.255.0  //可分配IP地址范围

#

ip pool 2

gateway-list 10.2.1.1

network 10.2.1.0 mask 255.255.255.0

#

aaa

local-user user1@aaa.com password cipher %@%@/|S75*sxcH2@FQL=wn#2@I`a%@%@

local-user user1@aaa.com privilege level 15

local-user user1@aaa.com service-type ppp

local-user user2@bbb.com password cipher %@%@qh-<X%_2QB+^!UR+UkxUA/6<%@%@

local-user user2@bbb.com privilege level 15

local-user user2@bbb.com service-type ppp

#

interface Virtual-Template1

ppp authentication-mode chap

remote address pool 1  //引入IP地址池，PPP认证通过后，为用户分配IP地址

ip address 10.1.1.1 255.255.255.0  //地址池的网关地址

#

interface Virtual-Template2

ppp authentication-mode chap

remote address pool 2

ip address 10.2.1.1 255.255.255.0

#

interface GigabitEthernet1/0/0

ip address 202.1.1.1 255.255.255.0

#

interface GigabitEthernet2/0/0

ip address 10.3.1.1 255.255.255.0

#

l2tp-group 1

allow l2tp virtual-template 1 remote lac1  //允许和对端隧道lac1建立L2TP隧道连接，引入VT1的配置参数

tunnel password cipher %@%@eS*)0t-0D!,~pa;IPll=3liC%@%@

tunnel name lns

#

l2tp-group 2

allow l2tp virtual-template 2 remote lac2

tunnel password cipher %@%@Cyor,=OAk#tWwA;%2\!W3lwj%@%@

tunnel name lns