1.防火墙访问互联网功能sysname FW#acl advanced 3000description NATFW-Policyrule 0 permit ip#interface GigabitEthernet1/0/3port link-mode routedescription ISPip address X.X.51.91 255.255.255.248nat outbound 3000undo dhcp select server#security-zone name Untrustimport interface GigabitEthernet1/0/3#ip route-static 0.0.0.0 0 X.X.51.89#security-zone intra-zone default permit#zone-pair security source bangong destination Localpacket-filter 3000#zone-pair security source bangong destination Untrustpacket-filter 3000#zone-pair security source Local destination bangongpacket-filter 3000#zone-pair security source Local destination Untrustpacket-filter 3000#zone-pair security source Untrust destination Localpacket-filter 3000#2.L2TP配置#l2tp enable#ip pool 1 X.X.13.1 X.X.13.253ip pool 1 gateway X.X.13.254#interface Virtual-Template1ppp authentication-mode chap domain systemppp ipcp dns X.X.143.69 X.X.135.1remote address pool 1ip address X.X.13.254 255.255.255.0#l2tp-group 1 mode lnsallow l2tp virtual-template 1undo tunnel authenticationtunnel name lns#security-zone name bangongimport interface Virtual-Template1#local-user user class network //防火墙创建本地用户和密码password simple 111service-type pppauthorization-attribute user-role network-operator#3.PC自带客户端设置1、点击任务栏“开始”→“控制面板”→“网络和Internet”→ “网络和共享中心”点击更改网络设置中的“设置新的连接或网络”图标。2、“选择一个连接选项”选择“连接到工作区”。3、“您想如何连接”选择“使用我的Internet连接VPN”。4、“连接之前…”选择“我稍后决定”。5、“键入要连接的Internet地址”中输入服务器的IP地址或者域名。6、 “键入您的用户名和密码“中可以选择不填或者填入VPN拨号所使用的用户名和密码。7、点击创建一个新的VPN连接就建立成功了。8、返回网络和共享中心选择更改适配器设置找到刚建立的VPN连接拨号客户端输入用户名和密码点击“连接”按钮就额可以进行VPN拨号。4.测试验证FWdis l2tp tunnelLocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName11191 4 Established 1 X.X.219.226 1701 UJ956GBV8M4FWFWdis ppp access-user user-type lnsInterface Username MAC address IP address IPv6 address IPv6 PDPrefixVA0 user - X.X.13.4 - -FWFWdis ip in b*down: administratively down(s): spoofing (l): loopbackInterface Physical Protocol IP Address DescriptionGE1/0/3 up up X.X.51.91 ISPGE1/0/23 down down -- --VT1 up up X.X.13.254 --FW 
长河君 · 2026/10/24 6:42:53 · 阅读 1.2k 防火墙作为L2TP LNS配置与成功拨号总结
1.防火墙访问互联网功能sysname FW#acl advanced 3000description NATFW-Policyrule 0 permit ip#interface GigabitEthernet1/0/3port link-mode routedescription ISPip address X.X.51.91 255.255.255.248nat outbound 3000undo dhcp select server#security-zone name Untrustimport interface GigabitEthernet1/0/3#ip route-static 0.0.0.0 0 X.X.51.89#security-zone intra-zone default permit#zone-pair security source bangong destination Localpacket-filter 3000#zone-pair security source bangong destination Untrustpacket-filter 3000#zone-pair security source Local destination bangongpacket-filter 3000#zone-pair security source Local destination Untrustpacket-filter 3000#zone-pair security source Untrust destination Localpacket-filter 3000#2.L2TP配置#l2tp enable#ip pool 1 X.X.13.1 X.X.13.253ip pool 1 gateway X.X.13.254#interface Virtual-Template1ppp authentication-mode chap domain systemppp ipcp dns X.X.143.69 X.X.135.1remote address pool 1ip address X.X.13.254 255.255.255.0#l2tp-group 1 mode lnsallow l2tp virtual-template 1undo tunnel authenticationtunnel name lns#security-zone name bangongimport interface Virtual-Template1#local-user user class network //防火墙创建本地用户和密码password simple 111service-type pppauthorization-attribute user-role network-operator#3.PC自带客户端设置1、点击任务栏“开始”→“控制面板”→“网络和Internet”→ “网络和共享中心”点击更改网络设置中的“设置新的连接或网络”图标。2、“选择一个连接选项”选择“连接到工作区”。3、“您想如何连接”选择“使用我的Internet连接VPN”。4、“连接之前…”选择“我稍后决定”。5、“键入要连接的Internet地址”中输入服务器的IP地址或者域名。6、 “键入您的用户名和密码“中可以选择不填或者填入VPN拨号所使用的用户名和密码。7、点击创建一个新的VPN连接就建立成功了。8、返回网络和共享中心选择更改适配器设置找到刚建立的VPN连接拨号客户端输入用户名和密码点击“连接”按钮就额可以进行VPN拨号。4.测试验证FWdis l2tp tunnelLocalTID RemoteTID State Sessions RemoteAddress RemotePort RemoteName11191 4 Established 1 X.X.219.226 1701 UJ956GBV8M4FWFWdis ppp access-user user-type lnsInterface Username MAC address IP address IPv6 address IPv6 PDPrefixVA0 user - X.X.13.4 - -FWFWdis ip in b*down: administratively down(s): spoofing (l): loopbackInterface Physical Protocol IP Address DescriptionGE1/0/3 up up X.X.51.91 ISPGE1/0/23 down down -- --VT1 up up X.X.13.254 --FW