华为AR201-S实现l2tp over ipsec加密的案例.doc

华为AR201-S实现l2tp over ipsec加密的案例各位： 您好，和大家分享下，AR201-S实现l2tp over ipsec加密的案例一、路由器配置1.l2tp地址池#ip pool l2tpgateway-list 192.168.222.1network 192.168.222.0 mask 255.255.255.02.l2tp vpn配置#interface Virtual-Template0ppp authentication-mode chapremote address pool l2tpip address 192.168.222.1 255.255.255.0#l2tp-group 1undo tunnel authenticationallow l2tp virtual-template 03.创建l2tp用户#local-user test password cipher %$%$iR,%phm-RuA8JW5m3dt%$%$local-usertest privilege level 15local-user test service-type ppp4.创建acl用户对流量进行IPSEC加密acl number 3001 rule 5 permit udp source-port eq 17015.ipsec 配置#ipsec proposal 1#ike proposal 1#注：ike对等体，最好是使用v1版本的野蛮模式，开始使用的v2版本的，发现ike sa协议的第一阶段都不能建立，而且最好是把nat 穿越功能打开，因为一般的实际环境，电脑都是nat上网的ike peer xdhg2 v1exchange-mode aggressivepre-shared-key simple huaweilocal-id-type namenat traversal（nat 穿越功能开启）#ipsec policy-template xdhg_t 1security acl 3001ike-peer xdhg2proposal 1 #ipsec policy xdhg 1 isakmp template xdhg_t#6.应用ipsec policyinterface Ethernet0/0/8tcp adjust-mss 1200ip address X.X.X.X 255.255.255.0ipsec policy xdhg nat outbound 2999二、客服端配置客服端是用的华为HUAWEI VPN Client_V100R001C02SPC701.exe这个软件填写LNS的ip地址和L2TP vpn的帐户密码这个了的认证模式要和#interface Virtual-Template0 #ppp authentication-mode chap这里对应起来，勾选启用IPSEC这里的配置要和使用的ipsec 提议一致，可以先查看配置在填写display ipsec proposal name 1 IPSec proposal name: 1 Encapsulation mode: Tunnel Transform : esp-newESP protocol : Authentication MD5-HMAC-96 Encryption DES这里的配置要和使用IKE提议以及ike对等体配置一致，可以先查看配置在填写display ike proposal number 1-IKE Proposal: 1 Authentication method : pre-shared Authentication algorithm : SHA1 Encryption algorithm : DES-CBC DH group : MODP-768 SA duration : 86400 PRF : PRF-HMAC-SHA- Peer name : xdhg2 Exchange mode : aggressive on phase 1 Pre-shared-key : huawei Local ID type : Name DPD : Disable DPD mode : Periodic DPD idle time : 30 DPD retransmit interval: 15 DPD retry limit : 3 Host name : Peer IP address : VPN name : Local IP address : Local name : Remote name : NAT-traversal : Enable Configured IKE version : Version one PKI realm : NULL Inband OCSP : Disable-设置完了，开始拨号路由器上deb