第1页 / 共8页
第2页 / 共8页
第3页 / 共8页
第4页 / 共8页
第5页 / 共8页
第6页 / 共8页
第7页 / 共8页
第8页 / 共8页
H3C SecPathF10X0_L2TP over IPSec配置.IOS、Android、Win7、Win10免客户端接入.docx
#
version 7.1.064, Release 9333P20
#
sysname H3C
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#拨入用户的地址池
ip pool l2tp1 172.16.252.2 172.16.252.100
#
password-recovery enable
#
vlan 1
#虚拟隧道的接口配置
interface Virtual-Template1
ppp authentication-mode chap pap
remote address pool l2tp1
ip address 172.16.252.1 255.255.255.0
#
interface NULL0
#内网 IP，并配置访问内网的 nat 转换
interface GigabitEthernet1/0/0
port link-mode route
ip address 192.168.31.100 255.255.255.0
nat outbound
#
interface GigabitEthernet1/0/1
port link-mode route
#
interface GigabitEthernet1/0/2
port link-mode route
#
interface GigabitEthernet1/0/3
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/12
port link-mode route
#
interface GigabitEthernet1/0/13
port link-mode route
#
interface GigabitEthernet1/0/14
port link-mode route
ip address 192.168.22.1 255.255.255.0
#外网接口配置
interface GigabitEthernet1/0/15
port link-mode route
ip address 117.40.0.123 255.255.255.0
ipsec apply policy VPN
gateway 117.40.0.1
#
interface GigabitEthernet1/0/16
port link-mode route
#
interface GigabitEthernet1/0/17
port link-mode route
#
interface GigabitEthernet1/0/18
port link-mode route
#
interface GigabitEthernet1/0/19
port link-mode route
#
interface GigabitEthernet1/0/20
port link-mode route
#
interface GigabitEthernet1/0/21
port link-mode route
#
interface GigabitEthernet1/0/22
port link-mode route
#
interface GigabitEthernet1/0/23
port link-mode route
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/14
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/15
#
security-zone name Management
#拨入用户专属安全域
security-zone name VPN
import interface Virtual-Template1
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-operator
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 192.168.0.0 16 GigabitEthernet1/0/0 192.168.31.1
#
ssh server enable
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password
hash
$h$6$qqSdfAPHxkQkqMYb$O2oQxz/RKohHdUaVB8uWeTdE+IwWOuHpWHPOnZ2phNnqv6d
9jMVgdtYEVvhmaOAPNeuqK7Z6h/Gi6jAyY+oWZg==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#拨入用户密码、权限
local-user 1 class network
password cipher $c$3$w8j1rIWa4o/xuV10LmkTOF+w68s46+dnkDxG7FfU
service-type ike
service-type ppp
authorization-attribute user-role network-operator
#
session statistics enable
#
ipsec logging negotiation enable
#IPSec 六种认证协议
ipsec transform-set VPN_IPv4_1
encapsulation-mode transport
esp encryption-algorithm aes-cbc-192
esp authentication-algorithm sha1
#
ipsec transform-set VPN_IPv4_2
encapsulation-mode transport
esp encryption-algorithm aes-cbc-128
esp authentication-algorithm sha1
#
ipsec transform-set VPN_IPv4_3
encapsulation-mode transport
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha1
#
ipsec transform-set VPN_IPv4_4
encapsulation-mode transport
esp encryption-algorithm des-cbc
esp authentication-algorithm sha1
#
ipsec transform-set VPN_IPv4_5
encapsulation-mode transport
esp encryption-algorithm 3des-cbc
esp authentication-algorithm sha1
#
ipsec transform-set VPN_IPv4_6
encapsulation-mode transport
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5
#
ipsec policy-template VPN 1
transform-set VPN_IPv4_1 VPN_IPv4_2 VPN_IPv4_3 VPN_IPv4_4 VPN_IPv4_5 VPN_IPv4_6
local-address 117.40.139.57
ike-profile VPN_IPv4_1
#
ipsec policy VPN 1 isakmp template VPN
#
l2tp-group 1 mode lns
allow l2tp virtual-template 1
undo tunnel authentication
#
l2tp enable
#
ike logging negotiation enable
#IKE 六种认证协议
ike profile VPN_IPv4_1
keychain VPN_IPv4_1
match remote identity address 0.0.0.0 0.0.0.0
match local address GigabitEthernet1/0/15
proposal 1 2 3 4 5 6
#
ike proposal 1
encryption-algorithm aes-cbc-128
dh group2
authentication-algorithm md5
#
ike proposal 2
encryption-algorithm 3des-cbc
dh group2
authentication-algorithm md5
#
ike proposal 3
encryption-algorithm 3des-cbc
dh group2
#
ike proposal 4
encryption-algorithm aes-cbc-256
dh group2
#
ike proposal 5
dh group2
#
ike proposal 6
encryption-algorithm aes-cbc-192
dh group2
#
ike keychain VPN_IPv4_1
match local address GigabitEthernet1/0/15
pre-shared-key
$c$3$SUTx6fn21a5Osb5X0SEKQ9kaj6Us/9QR
#
ip https enable
webui log enable
#
packet-capture max-bytes 4096
packet-capture max-file-packets 1000
packet-capture storage local limit 10240
#
security-policy ip
rule 0 name Ping
address
0.0.0.0
0.0.0.0
key
cipher
action pass
service ping
rule 1 name fff
action pass
rule 2 name loacl
action pass
source-zone Local
source-zone Trust
source-zone Untrust
destination-zone Untrust
destination-zone Trust
destination-zone Local
#
return
相关推荐
2023年江西萍乡中考道德与法治真题及答案.doc
2012年重庆南川中考生物真题及答案.doc
2013年江西师范大学地理学综合及文艺理论基础考研真题.doc
2020年四川甘孜小升初语文真题及答案I卷.doc
2020年注册岩土工程师专业基础考试真题及答案.doc
2023-2024学年福建省厦门市九年级上学期数学月考试题及答案.doc
2021-2022学年辽宁省沈阳市大东区九年级上学期语文期末试题及答案.doc
2022-2023学年北京东城区初三第一学期物理期末试卷及答案.doc
2018上半年江西教师资格初中地理学科知识与教学能力真题及答案.doc
2012年河北国家公务员申论考试真题及答案-省级.doc
2020-2021学年江苏省扬州市江都区邵樊片九年级上学期数学第一次质量检测试题及答案.doc
2022下半年黑龙江教师资格证中学综合素质真题及答案.doc
