《VPN 故障情况.docVIP

Juniper SSG 520 作为总公司的接入设备，同时作为VPN server。其IP地址为x.x.x.226。应用服务器的IP地址为x.x.x.227(NAT一对一)。分公司的软件需要通过VPN接入总公司的网络访问应用服务器。H3C AR18-23S-1作为分公司的接入设备，其IP地址为y.y.y.161。现在遇到的问题是分公司的PC用L2TP拨226 不正常，有时能够成功，有时不成功，成功也是经过多次连接重试之后才成功的。但在分公司之外用L2TP拨226 很正常。成功率100%，而且连接非常的迅速。如将分公司的PC拿到分公司以外的网络就很正常。 以下是H3C AR18-23s-1的配置。 H3Csys System View: return to User View with Ctrl+Z. [H3C]disp [H3C]display curr [H3C]display current-configuration # sysname H3C # clock timezone gmt+08:004 add 08:00:00 # cpu-usage cycle 1min # firewall enable # connection-limit enable connection-limit default action deny connection-limit default amount upper-limit 50 lower-limit 20 # nat address-group 1 y.y.y.162 y.y.y.166 # qos carl 1 source-ip-address range 0 to 55 per-address qos carl 2 destination-ip-address range 0 to 55 per-address # DNS resolve DNS server 32 DNS server 8 DNS-proxy enable # web set-package force flash:/http.zip # ip http acl 2000 # radius scheme system # domain system # local-user admin password cipher Y5^4NIIO:MLaN9G%UDAA!! service-type telnet terminal level 3 service-type ftp local-user laso password simple laso24 service-type telnet level 3 # detect-group 1 detect-list 1 ip address y.y.y.161 nexthop y.y.y.161 # detect-group 2 detect-list 1 ip address nexthop # acl number 2000 rule 0 permit source 55 rule 1 deny # acl number 3000 rule 3 permit ip source 0 rule 100 permit ip destination 8 0 rule 100 comment Main DNS Server rule 101 permit ip destination 32 0 rule 101 comment Secendry DNS Server rule 102 permit ip destination 17 0 rule 110 permit ip destination x.x.x.229 0 rule 110 comment OA and E-email server rule 111 permit ip destination 22 0 rule 111 comment E-email rule 112 permit ip destination 55 rule 112 comment MSN Server rule 113 permit ip destination 19 0 rule 113 comment E-email rule 114 permit ip destination 55 rule 114 comment rule 116 permit ip destination 55 rule 116 comment rul