目录
实验拓扑：
一、需求配置LAC设置：
界面设置：
编辑LNS设置：
建立静态路由：编辑
策略配置：
二、测试
通讯测试：
实验拓扑：
一、需求配置
LAC设置：
[LAC]l2tp enable
[LAC]interface Virtual-Template 1
[LAC-Virtual-Template1]ppp authentication-mode chap The command is used to configure the PPP authentication mode on the local end.
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[LAC-Virtual-Template1]ppp chap user user0001
[LAC-Virtual-Template1]ppp chap password cipher password123
[LAC-Virtual-Template1]ip address ppp-negotiate
[LAC-Virtual-Template1]call-lns local-user user0001 binding l2tp-group l2tp
[LAC]ip route-static 0.0.0.0 0 20.1.1.2
界面设置：
LNS设置：
[LNS-ip-pool-l2tp]section 0 172.16.0.2 172.16.0.100
[LNS]aaa
[LNS-aaa]service-scheme l2tp
Info: Create a new service scheme.
[LNS-aaa-service-l2tp]ip-pool l2tp
[LNS-aaa]domain default
Info: The domain default is for common users.
[LNS-aaa-domain-default]service-type l2tp
[LNS-aaa]q
[LNS]user-manage user user1 domain default
[LNS-localuser-user1]password Password123
[LNS]interface Virtual-Template1
[LNS-Virtual-Template1]ppp authentication-mode chap
[LNS-Virtual-Template1]ip add 172.16.0.1 24
[LNS-Virtual-Template1]remote service-scheme l2tp
[LNS-Virtual-Template1]q
[LNS]firewall zone dmz
[LNS-zone-dmz]add int Virtual-Template 1
[LNS]l2tp enable
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp virtual-template 1 remote lac domain default
[LNS-l2tp-1]tunnel authentication
[LNS-l2tp-1]tunnel password cipher Hello123
建立静态路由：
策略配置：
[NAS]security-policy
[NAS-policy-security]default action deny Warning: Setting the default interzone packet filtering to deny may affect actu
al data traffic. You are advised to configure the security policy based on the a
ctual services. Are you sure you want to continue? [Y/N]y
[NAS-policy-security]rule name local_untrust
[NAS-policy-security-rule-local_untrust]source-zone local
[NAS-policy-security-rule-local_untrust]destination-zone untrust
[NAS-policy-security-rule-local_untrust]source-address 20.1.1.1 32
[NAS-policy-security-rule-local_untrust]destination-address 20.1.1.2 32
[NAS-policy-security-rule-local_untrust]service l2tp
[NAS-policy-security-rule-local_untrust]service protocol udp source-port 0 to 65535 desti
nation-port 1701
[LNS-policy-security]rule name l2tp
[LNS-policy-security-rule-l2tp]source-zone untrust
[LNS-policy-security-rule-l2tp]destination-zone local
[LNS-policy-security-rule-l2tp]source-address 20.1.1.1 32
[LNS-policy-security-rule-l2tp]destination-address 20.1.1.2 32
[LNS-policy-security-rule-l2tp]service l2tp
[LNS-policy-security-rule-l2tp]service protocol udp destination-port 1701
[LNS-policy-security-rule-l2tp]action permit
[LNS-policy-security]rule name icmp
[LNS-policy-security-rule-icmp]source-zone dmz
[LNS-policy-security-rule-icmp]destination-zone trust
[LNS-policy-security-rule-icmp]source-address 172.16.0.0 24
[LNS-policy-security-rule-icmp]destination-address 192.168.1.0 24
[LNS-policy-security-rule-icmp]action permit
二、测试
通讯测试：
)
)
