H3C Routers

L2TP Multidomain Access Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring L2TP multidomain access· 1

Network configuration· 1

Analysis· 1

Software versions used· 2

Procedures· 2

Configuring the LNS· 2

Configuring hosts· 3

Verifying the configuration· 15

Configuration files· 15

Related documentation· 17

 

Introduction

The following information provides L2TP multidomain access configuration examples for the router.

Prerequisites

The following information applies to Comware 9-based router. Procedures and information in the examples might be slightly different depending on the software or hardware version of the routers.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of L2TP.

Example: Configuring L2TP multidomain access

Network configuration

As shown in Figure 1, Host A and Host B in different areas transmit data through L2TP tunnels. Configure the network to meet the following requirements:

·     Create two domains on the LNS to provide access services for users in different areas.

·     Users in different domains obtain IP addresses from different subnets for communication with the LNS.

Figure 1 Network diagram

 

Analysis

For valid users to access normally and establish an L2TP tunnel in client-Initiated mode, perform the following tasks:

1.     Configure L2TP user-side authentication on the LNS.

2.     Create PPP users and their domains.

3.     On the host side, initiate the tunnel setup requests on hosts by using the username configured on the device.

Software versions used

This configuration example was created and verified on R9141P16 of the MSR2630E-X1 device.

Procedures

Configuring the LNS

# Enable L2TP.

<LNS> system-view

[LNS] l2tp enable

# Configure two address pools, which are used to allocate IP addresses on different subnets to users in different domains.

[LNS] ip pool 1 10.0.1.2 10.0.1.10

[LNS] ip pool 2 10.0.2.2 10.0.2.10

# Configure domain abc.com to authorize address pool 1, and configure the domain to perform local authentication for PPP users.

[LNS] domain abc.com

[LNS-isp-abc.com] authorization-attribute ip-pool 1

[LNS-isp-abc.com] authentication ppp local

[LNS-isp-abc.com] quit

# Configure domain abc2.com to authorize address pool 2, and configure the domain to perform local authentication for PPP users.

[LNS] domain abc2.com

[LNS-isp-abc2.com] authorization-attribute ip-pool 2

[LNS-isp-abc2.com] authentication ppp local

[LNS-isp-abc2.com] quit

# Create VT interface 1, and assign IP address 10.0.1.1/24 to the VT interface. Configure the PPP authentication method as CHAP on the VT interface, and specify the VT interface to allocate IP addresses from address pool 1 to PPP users.

[LNS] interface virtual-template1

[LNS-Virtual-Template1] ppp authentication-mode chap domain abc.com

[LNS-Virtual-Template1] remote address pool 1

[LNS-Virtual-Template1] ip address 10.0.1.1 255.255.255.0

[LNS-Virtual-Template1] quit

# Create VT interface 2, and assign IP address 10.0.2.1/24 to the VT interface. Configure the PPP authentication method as CHAP on the VT interface, and specify the VT interface to allocate IP addresses from address pool 2 to PPP users.

[LNS] interface virtual-template2

[LNS-Virtual-Template2] ppp authentication-mode chap domain abc2.com

[LNS-Virtual-Template2] remote address pool 2

[LNS-Virtual-Template2] ip address 10.0.2.1 255.255.255.0

[LNS-Virtual-Template2] quit

# Configure interface GigabitEthernet 1/0/1.

[LNS] interface gigabitethernet 0/0/1

[LNS-GigabitEthernet1/0/1] port link-mode route

[LNS-GigabitEthernet1/0/1] ip address 172.31.123.101 255.255.255.0

[LNS-GigabitEthernet1/0/1] quit

# Create user user1. Set the password to hello and service type to PPP.

[LNS] local-user user1 class network

[LNS-luser-network-user1] password simple hello

[LNS-luser-network-user1] service-type ppp

[LNS-luser-network-user1] quit

# Create user user2. Set the password to hello and service type to PPP.

[LNS] local-user user2 class network

[LNS-luser-network-user2] password simple hello

[LNS-luser-network-user2] service-type ppp

[LNS-luser-network-user2] quit

# Create an L2TP group in LNS mode, and disable tunnel authentication.

[LNS] l2tp-group 1 mode lns

[LNS-l2tp1] allow l2tp virtual-template 1 remote user1.abc.com

[LNS-l2tp1] undo tunnel authentication

[LNS-l2tp1] quit

# Create an L2TP group in LNS mode, and disable tunnel authentication.

[LNS] l2tp-group 2 mode lns

[LNS-l2tp2] allow l2tp virtual-template 2 remote user2.abc2.com

[LNS-l2tp2] undo tunnel authentication

[LNS-l2tp2] quit

Configuring hosts

# Assign IP addresses 192.168.1.4 and 192.168.2.7 to the two hosts separately, and configure the gateways of the two hosts as their respective gateway addresses.

# Use Windows 7 as an example. Access Network and Sharing Center and click Set up a new connection or network.

Figure 2 Creating a network connection

 

# Select Connect to a workspace and click Next.

Figure 3 Selecting a connection option

 

# Select Use my Internet connection(VPN).

Figure 4 Selecting a connection method

 

# Set the Internet address, which is the address of the host-side interface on the LNS. Select the Don't connect now; just set it up so I can connect later option, and click Next.

Figure 5 Setting the LNS address

 

# In the diaglog box that opens, enter the username and password that have been configured on the device, and select Create.

Figure 6 Entering the username and password

 

# At this point, the connection is available. Click Close.

Figure 7 Connection established successfully

 

# Access the network connection page again, and you can see a new network connection named VPN Connection. Double-click it. The login window opens.

Figure 8 Newly generated connection

 

Figure 9 Login window

 

# Right-click the connection, and select Properties. The Properties dialog box opens.

Figure 10 VPN connection properties

 

# Click the Security tab. Select Optional encryption (connect even if no encryption) for data encryption and click OK.

Figure 11 Configuring security properties

 

# On the login window, enter username [email protected] and password hello configured on the router, and click Connect.

Figure 12 Connecting an L2TP tunnel

 

# Verify that the connection succeeded.

Figure 13 Connection succeeded

 

Verifying the configuration

# On the LNS, execute the display l2tp tunnel command to view the established L2TP tunnels.

[LNS] display l2tp tunnel

LocalTID RemoteTID State        Sessions RemoteAddress   RemotePort RemoteName

23287    1         Established  1        192.168.1.4     1701       user1.abc.com

36956    35        Established  1        192.168.2.7     1701       user2.abc2.com

# On the LNS, execute the display l2tp session command to display the established L2TP sessions.

[LNS] display l2tp session

LocalSID    RemoteSID    LocalTID    State

30933       1            23287       Established

21828       1            36956       Established

Configuration files

#

 ip pool 1 10.0.1.2 10.0.1.10

 ip pool 2 10.0.2.2 10.0.2.10

#

interface Virtual-Template1

 ppp authentication-mode chap domain abc.com

 remote address pool 1

 ip address 10.0.1.1 255.255.255.0

#

interface Virtual-Template2

 ppp authentication-mode chap domain abc2.com

 remote address pool 2

 ip address 10.0.2.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 172.31.123.101 255.255.255.0

#

domain abc.com

 authorization-attribute ip-pool 1

 authentication ppp local

#

domain abc2.com

 authorization-attribute ip-pool 2

 authentication ppp local

#

user-group system

#

local-user user1 class network

 password cipher $c$3$UkOKC65RHN4wUaJ6sWyzHKC7a+N59kEJ

 service-type ppp

 authorization-attribute user-role network-operator

#

local-user user2 class network

 password cipher $c$3$JUujxfCIpEGTGw9HbO26xfm55GLo2g==

 service-type ppp

 authorization-attribute user-role network-operator

#

l2tp-group 1 mode lns

 allow l2tp virtual-template 1 remote user1.abc.com

 undo tunnel authentication

#

l2tp-group 2 mode lns

 allow l2tp virtual-template 2 remote user2.abc2.com

 undo tunnel authentication

#

l2tp enable

#

Related documentation

·     Layer 2—WAN Access Configuration Guide in H3C MSR1000[2600][3600] Routers Configuration Guides (V9)

·     Layer 2—WAN Access Command Reference in H3C MSR1000[2600][3600] Routers Command References (V9)