H3C MSR係列路由器

L2TP over IPsec配置舉例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

目  錄

1 簡介

2 配置前提

3 配置舉例

3.1 組網需求

3.2 使用版本

3.3 配置步驟

3.3.1 LNS的配置

3.3.2 LAC的配置

3.4 驗證配置

3.5 配置文件

4 相關資料

 

1  簡介

本文檔介紹MSR係列路由器L2TP over IPsec典型配置舉例。

2  配置前提

本文檔適用於使用Comware V7軟件版本的MSR係列路由器，如果使用過程中與產品實際情況有差異，請參考相關產品手冊，或以設備實際情況為準。

本文檔中的配置均是在實驗室環境下進行的配置和驗證，配置前設備的所有參數均采用出廠時的缺省配置。如果您已經對設備進行了配置，為了保證配置效果，請確認現有配置和以下舉例中的配置不衝突。

本文檔假設您已了解L2TP和IPsec特性。

3  配置舉例

3.1  組網需求

如圖1所示，Host通過L2TP隧道訪問LNS一側的網絡。具體應用需求如下：

·     LAC與LNS自動建立L2TP隧道

·     LAC與LNS之間采用IKE方式建立IPsec安全隧道來對L2TP流量進行加密。

圖1 MSR係列路由器L2TP over IPsec典型配置組網圖

 

3.2  使用版本

本配置舉例是在MSR3610-X1路由器Release 6749版本上進行配置和驗證的。

3.3  配置步驟

3.3.1  LNS的配置

# 配置本地用戶1，設置密碼為1234。

<LNS> system-view

[LNS] local-user 1 class network

[LNS-luser-network-1] password simple 1234

[LNS-luser-network-1] service-type ppp

[LNS-luser-network-1] quit

# 配置ISP域system對PPP用戶采用本地驗證。

[LNS] domain system

[LNS-isp-system] authentication ppp local

[LNS-isp-system] quit

# 使能L2TP。

[LNS] l2tp enable

# 配置虛模板Virtual-Template1配置接口的IP地址為192.168.0.1/24，PPP認證方式為PAP，並指定為PPP用戶分配的IP地址為192.168.0.2。

[LNS] interface virtual-template 1

[LNS-Virtual-Template1] ip address 192.168.0.1 24

[LNS-Virtual-Template1] ppp authentication-mode pap domain system

[LNS-Virtual-Template1] remote address 192.168.0.2

[LNS-Virtual-Template1] quit

# 創建LNS模式的L2TP組1，配置隧道本端名稱為lns，指定接收呼叫的虛擬模板接口為VT1，並配置L2TP隧道對端名為lac。

[LNS] l2tp-group 1 mode lns

[LNS-l2tp1] tunnel name lns

[LNS-l2tp1] undo tunnel authentication

[LNS-l2tp1] allow l2tp virtual-template 1 remote lac

[LNS-l2tp1] quit

# 配置訪問控製列表。

[LNS] acl number 3000

[LNS-acl-adv-3000] rule permit ip source 10.0.0.2 0 destination 10.0.0.1 0

[LNS-acl-adv-3000] quit

# 配置IKE keychain。

[LNS] ike keychain l2tp

# 配置與地址為10.0.0.1的對端使用的預共享密鑰為明文的abcd。

[LNS-ike-keychain-l2tp] pre-shared-key address 10.0.0.1 key simple abcd

[LNS-ike-keychain-l2tp] quit

#在IKE profile l2tp中指定名稱為l2tp的配置的IKE keychain。

[LNS] ike profile l2tp

[LNS-ike-profile-l2tp] keychain l2tp

# 指定使用IP地址10.0.0.2標識本端身份。

[LNS-ike-profile-l2tp] local-identity address 10.0.0.2

# 指定需要匹配對端身份類型為IP地址，取值為10.0.0.1。

[LNS-ike-profile-l2tp] match remote identity address 10.0.0.1

[LNS-ike-profile-l2tp] quit

# 配置IPsec安全協議。

[LNS] ipsec transform-set l2tp

# 配置IPsec安全提議采用的ESP加密算法為CBC模式的3DES算法。

[LNS-ipsec-transform-set-l2tp] esp encryption-algorithm 3des-cbc

# 配置IPsec安全提議采用的ESP認證算法為MD5。

[LNS-ipsec-transform-set-l2tp] esp authentication-algorithm md5

[LNS-ipsec-transform-set-l2tp] quit

# 配置IPsec安全策略引用ACL 3000和名字為l2tp的IPsec安全提議，並指定IPsec隧道的對端IPv4地址為10.0.0.1。

[LNS] ipsec policy l2tp 1 isakmp

[LNS-ipsec-policy-isakmp-l2tp-1] security acl 3000

[LNS-ipsec-policy-isakmp-l2tp-1] transform-set l2tp

[LNS-ipsec-policy-isakmp-l2tp-1] ike-profile l2tp

[LNS-ipsec-policy-isakmp-l2tp-1] remote-address 10.0.0.1

[LNS-ipsec-policy-isakmp-l2tp-1] quit

# 配置連接LAC的接口GigabitEthernet1/0/1的IP地址並使能IPsec安全策略。

# 配置接口IP地址並使能IPsec安全策略。

[LNS] interface gigabitethernet 1/0/1

[LNS-GigabitEthernet1/0/1] ip address 10.0.0.2 24

[LNS-GigabitEthernet1/0/1] ipsec apply policy l2tp

[LNS-GigabitEthernet1/0/1] quit

# 配置接口GigabitEthernet1/0/2的IP地址。

[LNS] interface gigabitethernet 1/0/2

[LNS-GigabitEthernet1/0/2] ip address 15.0.0.1 24

[LNS-GigabitEthernet1/0/2] quit

3.3.2  LAC的配置

# 開啟L2TP功能。

<LAC> system-view

[LAC] l2tp enable

# 創建LAC模式的L2TP組1。

[LAC] l2tp-group 1 mode lac

# 配置LAC側本端名稱為LAC，並指定LNS的IP地址為10.0.0.2。

[LAC-l2tp1] tunnel name lac

[LAC-l2tp1] lns-ip 10.0.0.2

[LAC-l2tp1] undo tunnel authentication

[LAC-l2tp1] quit

# 配置訪問控製列表。

[LAC] acl number 3000

# 配置ACL的規則。

[LAC-acl-adv-3000] rule permit ip source 10.0.0.1 0 destination 10.0.0.2 0

[LAC-acl-adv-3000] quit

# 配置Virtual-ppp口，配置PPP用戶的用戶名為1，密碼為1234，並配置PPP驗證方式為PAP。

[LAC] interface virtual-PPP 1

[LAC-Virtual-PPP1] ip address ppp-negotiate

[LAC-Virtual-PPP1] ppp pap local-user 1 password simple 1234

[LAC-Virtual-PPP1] quit

# 配置私網路由，訪問公司總部的報文將通過L2TP隧道轉發。

[LAC] ip route-static 15.0.0.1 24 Virtual-PPP 1

# 配置IKE keychain。

[LAC] ike keychain l2tp

# 配置與地址為10.0.0.2的對端使用的預共享密鑰為明文的abcd。

[LAC-ike-keychain-l2tp] pre-shared-key address 10.0.0.2 key simple abcd

[LAC-ike-keychain-l2tp] quit

# 在IKE profile l2tp中指定名稱為l2tp的配置的IKE keychain。

[LAC] ike profile l2tp

[LAC-ike-profile-l2tp] keychain l2tp

 # 指定使用IP地址10.0.0.1標識本端身份。

[LAC-ike-profile-l2tp] local-identity address 10.0.0.1

# 指定需要匹配對端身份類型為IP地址，取值為10.0.0.2。

[LAC-ike-profile-l2tp] match remote identity address 10.0.0.2

[LAC-ike-profile-l2tp] quit

# 配置Ipsec安全協議。

[LAC] ipsec transform-set l2tp

# 配置IPsec安全提議采用的ESP加密算法為CBC模式的3DES算法。

[LAC-ipsec-transform-set-l2tp] esp encryption-algorithm 3des-cbc

# 配置IPsec安全提議采用的ESP認證算法為MD5。

[LAC-ipsec-transform-set-l2tp] esp authentication-algorithm md5

[LAC-ipsec-transform-set-l2tp] quit

# 配置IPsec安全策略引用ACL 3000和名字為l2tp的IPsec安全提議，並指定IPsec隧道的對端IPv4地址為10.0.0.2。

[LAC] ipsec policy l2tp 1 isakmp

[LAC-ipsec-policy-isakmp-l2tp-1] security acl 3000

[LAC-ipsec-policy-isakmp-l2tp-1] transform-set l2tp

[LAC-ipsec-policy-isakmp-l2tp-1] ike-profile l2tp

[LAC-ipsec-policy-isakmp-l2tp-1] remote-address 10.0.0.2

[LAC-ipsec-policy-isakmp-l2tp-1] quit

# 配置接口GigabitEthernet1/0/2的IP地址。

[LAC] interface gigabitethernet 1/0/2

[LAC-GigabitEthernet1/0/2] ip address 14.0.0.1 24

[LAC-GigabitEthernet1/0/2] quit

# 配置連接LNS的接口GigabitEthernet1/0/1的IP地址並使能IPsec安全策略。

[LAC] interface gigabitethernet 1/0/1

[LAC-GigabitEthernet1/0/1] ip address 10.0.0.1 24

[LAC-GigabitEthernet1/0/1] ipsec apply policy l2tp

[LAC-GigabitEthernet1/0/1] quit

# 執行l2tp-auto-client命令觸發LAC建立L2TP隧道。

[LAC] interface virtual-PPP 1

[LAC-Virtual-PPP1] l2tp-auto-client l2tp-group 1

3.4  驗證配置

# LAC上可以看到L2TP隧道和L2TP會話的建立情況。

[LAC] display l2tp tunnel

LocalTID RemoteTID State        Sessions RemoteAddress   RemotePort RemoteName

23561    63423     Established  1        10.0.0.2        1701       lns

 

[LAC] display l2tp session

LocalSID    RemoteSID    LocalTID    State

1538        2562         23561       Established

# LNS上可以看到L2TP隧道和L2TP會話的建立情況。

[LNS] display l2tp tunnel

LocalTID RemoteTID State        Sessions RemoteAddress   RemotePort RemoteName

63423    23561     Established  1        10.0.0.1        1701       lac

 

[LNS] display l2tp session

LocalSID    RemoteSID    LocalTID    State

2562        1538         63423       Established

# LAC上可以看到IKE SA和IPSec SA的建立情況。

[LAC] display ike sa

    Connection-ID   Remote                Flag         DOI

------------------------------------------------------------------

    5               10.0.0.2              RD           IPSEC

Flags:

RD--READY RL--REPLACED FD-FADING

 

[LAC]display ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/1

-------------------------------

 

  -----------------------------

  IPsec policy: l2tp

  Sequence number: 1

  Mode: isakmp

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect forward secrecy:

    Path MTU: 1443

    Tunnel:

        local  address: 10.0.0.1

        remote address: 10.0.0.2

    Flow:

    sour addr: 10.0.0.1/255.255.255.255  port: 0  protocol: ip

    dest addr: 10.0.0.2/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 987342280 (0x3ad9a5c8)

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843181/2339

      Max received sequence-number: 319

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for nat traversal: N

      Status: active

 

    [Outbound ESP SAs]

      SPI: 2705574035 (0xa143c893)

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843182/2339

      Max sent sequence-number: 301

      UDP encapsulation used for nat traversal: N

      Status: active

 

# LNS上可以看到IKE SA和IPSec SA的建立情況。

[LNS] display ike sa

    Connection-ID   Remote                Flag         DOI

------------------------------------------------------------------

    1               10.0.0.1              RD           IPSEC

Flags:

RD--READY RL--REPLACED FD-FADING

 

[LNS] display ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/1

-------------------------------

 

  -----------------------------

  IPsec policy: l2tp

  Sequence number: 1

  Mode: isakmp

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect forward secrecy:

    Path MTU: 1443

    Tunnel:

        local  address: 10.0.0.2

        remote address: 10.0.0.1

    Flow:

    sour addr: 10.0.0.2/255.255.255.255  port: 0  protocol: ip

    dest addr: 10.0.0.1/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 2705574035 (0xa143c893)

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843181/2300

      Max received sequence-number: 310

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for nat traversal: N

      Status: active

 

    [Outbound ESP SAs]

      SPI: 987342280 (0x3ad9a5c8)

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843180/2300

      Max sent sequence-number: 329

      UDP encapsulation used for nat traversal: N

      Status: active

# Host A所屬網段可以通過L2TP隧道訪問外網。

[LAC] ping -a 14.0.0.1 15.0.0.1

Ping 15.0.0.1 (15.0.0.1) from 14.0.0.1: 56 data bytes, press escape sequence to break

56 bytes from 15.0.0.1: icmp_seq=0 ttl=255 time=0.462 ms

56 bytes from 15.0.0.1: icmp_seq=1 ttl=255 time=0.280 ms

56 bytes from 15.0.0.1: icmp_seq=2 ttl=255 time=0.276 ms

56 bytes from 15.0.0.1: icmp_seq=3 ttl=255 time=0.280 ms

56 bytes from 15.0.0.1: icmp_seq=4 ttl=255 time=0.280 ms

 

--- Ping statistics for 15.0.0.1 ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 0.276/0.316/0.462/0.073 ms

[LAC]%Jul  3 14:01:16:689 2013 LAC PING/6/PING_STATIS_INFO: Ping statistics for 15.0.0.1: 5 packet(s) transmitted, 5 packet(

s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 0.276/0.316/0.462/0.073 ms.

3.5  配置文件

·     LNS：

#

interface Virtual-Template1

 remote address 192.168.0.2

 ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip address 10.0.0.2 255.255.255.0

 ipsec apply policy l2tp

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 15.0.0.1 255.255.255.0

#

ip route-static 14.0.0.0 24 192.168.0.2

#

acl number 3000

 rule 0 permit ip source 10.0.0.2 0 destination 10.0.0.1 0

#

domain system

 authentication ppp local

#

local-user 1 class network

 password cipher $c$3$1dZEFYrvdICeeFOnqOoFpzXF8G0dZ+4=

 service-type ppp

 authorization-attribute user-role network-operator

#

ipsec transform-set l2tp

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy l2tp 1 isakmp

 transform-set l2tp

 security acl 3000

 remote-address 10.0.0.1

 ike-profile l2tp

#

l2tp-group 1 mode lns

 allow l2tp virtual-template 1 remote lac

 undo tunnel authentication

 tunnel name lns

#

l2tp enable

#

ike profile l2tp

 keychain l2tp

 local-identity address 10.0.0.2

 match remote identity address 10.0.0.1 255.255.255.255

#

ike keychain l2tp

 pre-shared-key address 10.0.0.1 255.255.255.255 key cipher $c$3$7tvgEkFh6On3KIybUaywz5NDiHtwJqU=

#

·     LAC：

#

interface Virtual-PPP1

 ppp pap local-user 1 password cipher $c$3$i132FpC8DcHeIet4NXtmz6ot44xY8ts=

 ip address ppp-negotiate

 l2tp-auto-client l2tp-group 1

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 10.0.0.1 255.255.255.0

 ipsec apply policy l2tp

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 14.0.0.1 255.255.255.0

#

acl number 3000

 rule 0 permit ip source 10.0.0.1 0 destination 10.0.0.2 0

#

domain system

 authentication ppp local

#

ipsec transform-set l2tp

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy l2tp 1 isakmp

 transform-set l2tp

 security acl 3000

 remote-address 10.0.0.2

 ike-profile l2tp

#

l2tp-group 1 mode lac

 lns-ip 10.0.0.2

 undo tunnel authentication

 tunnel name lac

#

l2tp enable

#

ike profile l2tp

 keychain l2tp

 local-identity address 10.0.0.1

 match remote identity address 10.0.0.2 255.255.255.255

#

ike keychain l2tp

 pre-shared-key address 10.0.0.2 255.255.255.255 key cipher $c$3$3ErJJ2M1lhES32CdsR3ofs5CdLvPJGk=

#

4  相關資料

·     《H3C MSR係列路由器 配置指導（V7）》中的“二層技術-廣域網接入配置指導”

·     《H3C MSR係列路由器 命令參考（V7）》中的“二層技術-廣域網接入命令參考”

·     《H3C MSR係列路由器 配置指導（V7）》中的“安全配置指導”

·     《H3C MSR係列路由器 命令參考（V7）》中的“安全命令參考”