L2TP configuration examples

 

·     Introduction

·     Prerequisites

·     Example: Configuring L2TP

 

The following information provides L2TP configuration examples.

 

This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of L2TP.

 

Network configuration

As shown in Figure 1, a PPP user directly establishes an L2TP tunnel to an LNS, and accesses the HQ of the company through the L2TP tunnel.

Configure the network to meet the following requirements:

·     An enterprise branch can access the intranet resources of the company through an L2TP VPN.

·     Traveling employees can access the intranet to work remotely through an L2TP VPN.

Figure 1 Network diagram

 

Software version used

This configuration example was created and verified on R8860 of the F1000-AI-55 device.

Procedure

Configuring Device

1.     Assign IP addresses to interfaces and add the interfaces to security zones.

# On the top navigation bar, click Network.

# From the navigation pane, select Interface Configuration > Interfaces.

# Click the Edit icon for GE 1/0/1. In the dialog box that opens, configure the interface:

¡     Select the Untrust security zone.

¡     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 1.1.2.2/24.

¡     Use the default settings for other parameters.

# Click OK.

# Click the Edit icon for GE 1/0/2. In the dialog box that opens, configure the interface:

¡     Select the Trust security zone.

¡     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.0.1/24.

¡     Use the default settings for other parameters.

# Click OK.

# On the top navigation bar, click Network.

# From the navigation pane, select VPN > L2TP.

# Click Create. In the dialog box that opens, configure parameters as shown in the following figure:

Figure 2 Configuring L2TP

 

# On the top navigation bar, click Network.

# From the navigation pane, select Security Zones.

# Click the Edit icon for security zone Untrust to enter the page for editing the security zone.

# On this page, configure parameters as shown in the following figure:

Figure 3 Editing a security zone

 

2.     Configure routing.

This section takes static routing as an example. If you need dynamic routing in your network, configure the corresponding dynamic routing protocol as needed.

# On the top navigation bar, click Network.

# From the navigation pane, select Routing > Static Routing.

# On the IPv4 Static Routing tab, click Create.

# In the dialog box that opens, configure an IPv4 static route as follows:

¡     Enter destination address 2.1.1.1.

¡     Enter mask length 24.

¡     Enter next hop address 1.1.2.3.

¡     Use the default settings for other parameters.

# Click OK.

3.     Configure security policies.

# On the top navigation bar, click Policies.

# From the navigation pane, select Security Policies > Security Policies. Click Create.

# In the dialog box that opens, create a security policy and configure it as follows:

¡     Enter security policy name untrust-local.

¡     Select source security zone Untrust.

¡     Select destination security zone Local.

¡     Set the type to IPv4.

¡     Set the action to Permit.

¡     Select service l2tp.

¡     Use the default settings for other parameters.

# Repeat the steps above to create a new security policy with the fowling parameter settings:

¡     Enter security policy name untrust-trust.

¡     Select source security zone Untrust.

¡     Select destination security zone Trust.

¡     Set the type to IPv4.

¡     Set the action to Permit.

¡     Enter source IPv4 addresses 192.168.0.10-192.168.0.20.

¡     Enter destination IPv4 address 10.1.0.200.

¡     Use the default settings for other parameters.

# Click OK.

4.     Create an L2TP user.

# On the top navigation bar, click Objects.

# From the navigation pane, select User > User Management > Local Users.

# Click Create. Create an L2TP user. Set the username to l2tpuser, set the password to hello, and select service type PPP, as shown in the following figure:

Figure 4 Creating an L2TP user

 

5.     Enable L2TP.

# On the top navigation bar, click Network.

# From the navigation pane, select VPN > L2TP.

# Click the L2TP tab. On this tab, enable L2TP.

Figure 5 Enabling L2TP

 

Configuring a VPN client

# Click the Network icon in the lower right corner of your PC, and click Open Network and Sharing Center page.

# Access the Change your networking settings area.

Figure 6 Changing your networking settings

 

# Click Connect to a workplace, and select Use my Internet connection (VPN), as shown in the following figures.

Figure 7 Setting VPN

 

 

# Click Don’t connect now; just set it up so I can connect later. In the Internet address field, enter the IP address of the interface connecting the device to the Internet.

Figure 8 Setting the IP address

 

# Set the username and password for VPN dialup, as shown in the following figure:

Figure 9 Setting the username and password

 

# Set the Network icon in the lower right corner of your PC.

# Right-click the new VPN connection, and select Properties from the shortcut menu.

Figure 10 Setting a VPN connection

 

# On the Security tab, configure the VPN connection as follows:

·     Select Layer 2 Tunneling Protocol with IPsec (L2TP/IPsec) from the Type of VPN list.

·     Select Optional encryption (connect even if no encryption) from the Data encryption list.

·     Select Challenge Handshake Authentication Protocol (CHAP) in the Allow these protocols area.

Figure 11 Setting the VPN properties

 

Verifying the configuration

# After a user successfully dials up, you can see the L2TP tunnel information, as shown in the following figure:

Figure 12 L2TP tunnel information