AR1220实现L2TP-VPN+Portal认证接入内网部网络.docVIP

AR1220实现L2TP-VPN+Portal认证接入内网部网络

?remoteaddresspooll2tp

?ipaddress?

#l2tp-group1???????????????

?undotunnelauthentication

?allowl2tpvirtual-template0

2.L2TP用户配置

local-userhuaweipasswordcipher%$%$FN:2X(Z[p2ypv4+Wu+[9=$_+%$%$

local-userhuaweiservice-type?ppp?

二、本地portal配置

1.ssl证书配置

#pkirealmdefault

?enrollmentself-signed

#sslpolicyhuaweitypeserver

?pki-realmdefault

2.portal配置

portallocal-serverip

portallocal-serverhttpsssl-policyhuaweiport4433

3.应用portal到接口

interfaceVirtual-Template0

?pppauthentication-modechap?

?remoteaddresspooll2tp

?ipaddress?

?portallocal-serverenable

4.查看portal情况

[Huawei]displayportallocal-server?

?Portallocal-serverconfig:

?serverstatus??????:enable

?serverip????????:

?authenticationmethod??:chap

?protocol????????:https

?httpsssl-policy????:huawei

5.设置对DNS服务器免认证规则

portalfree-rule1destinationip9mask55

6.创建PORTAL认证用户

local-useruser01passwordcipher%$%$FN:2X(Z[p2ypv4+Wu+[9=$_+%$%$

local-useruser01?service-type?web?

三、测试

1.L2TP拨号连接

连接成功

获取到了内网IP地址

ping内网的ip不通，打开网页被重地向到这个认证页面

通过认证后，可以正常访问内部的资源,如果配置了DNS可以正常通过L2TPVPN上网