L2TPOVERIPSEC(LNS地址在内网,通过公网映射).doc

L2TP OVER IPSEC (LNS地址在内网，通过公网映射) 组网 LAC公网地址为63，LNS在用户内网地址为0，通过映射为公网地址03。 用户需求：PC用户通过PPPOE拨号到LAC出发L2TP隧道建立，同时要求做IPSEC加密。 配置： LAC： lacdis cu # version 5.20, Release 2512P04 # sysname lac # l2tp enable # domain default enable system # ipv6 # telnet server enable # port-security enable # password-recovery enable # acl number 3500 rule 5 permit ip source 63 0 destination 0 0 rule 10 permit ip source 0 0 destination 63 0 # vlan 1 # Ddomain authentication ppp local access-limit disable state active idle-cut disable self-service-url disable domain system access-limit disable state active idle-cut disable self-service-url disable # ike peer lac exchange-mode aggressive pre-shared-key cipher $c$3$1x8s/6RGe2wayz2b/ilLMlHyJ86Kag== id-type name remote-name lns remote-address 03 local-address 63 local-name lac nat traversal # ipsec transform-set lac encapsulation-mode tunnel transform esp esp authentication-algorithm sha1 esp encryption-algorithm 3des # ipsec policy lac 1 isakmp security acl 3500 ike-peer lac transform-set lac # user-group system group-attribute allow-guest # local-user admin password cipher $c$3$EiAlBrd/gVGFvSMRAmLoJwgze3wHlYa1BQ== authorization-attribute level 3 service-type telnet service-type web local-user test password cipher $c$3$SQ3SM2FRQoXeMijjRitI72ToSwbJ9f09xw== service-type ppp # l2tp-group 1 tunnel password cipher $c$3$TVsHV3HQRBs5eubLlDPrKCp8o8kwnA== tunnel name lac start l2tp ip 0 domain # interface Aux0 async mode flow link-protocol ppp # interface Cellular0/0 async mode protocol link-protocol ppp # interface Virtual-Template1 ppp authentication-mode pap chap domain # interface NULL0 # interface Vlan-interface1 pppoe-server bind Virtual-Template 1 ip address # interface GigabitEthernet0/0 port link-mode route ip address 63 48 ipsec policy lac # interface GigabitEthernet0/1 port link-mode bridge # interface GigabitEthernet0/2 port link-mode bridge # interface GigabitEthernet0/3 po