企业系统开发去哪家_泰兴中信建设有限责任公司_seo技术中心_如何用手机创建网站

目录

 

一.拓扑信息​

二.需求分析

三.详细配置信息 

1.基础信息配置

服务器：

 2.建立PPPOE

3.建立L2TP隧道

4.安全策略

四.测试

---

 

一.拓扑信息​

 

二.需求分析

一.基础信息配置（IP和安全区域）

二.建立PPPOE连接

  是FW1和FW2之间的配置，跟FW3没有关系。dialer接口跟vt接口不同，它是依附与物理接口

三.建立L2TP隧道

是FW2和FW3之间的配置

  FW1发lcp报文，FW2去认证把结果给FW3，没有问题后FW3给FW1分ip，这个过程叫LAC代理认证。

四.安全策略

三.详细配置信息 

1.基础信息配置

FW1(这里不用配置IP地址，因为LNS会分配地址)：

[Client]firewall zone trust 
[Client-zone-trust]add int g1/0/0
[Client]security-policy
[Client-policy-security]default action permit 

FW2（同样连接FW1的那个接口不用配置IP）：

[LAC]int g1/0/1
[LAC-GigabitEthernet1/0/1]ip add 20.1.1.1 24
[LAC-GigabitEthernet1/0/1]q	
[LAC]firewall zone trust 
[LAC-zone-trust]add int g1/0/0	
[LAC]firewall zone untrust 
[LAC-zone-untrust]add int g1/0/1
[LAC]security-policy	
[LAC-policy-security]default action permit

FW3：

[LNS]int g1/0/0
[LNS-GigabitEthernet1/0/0]ip add 20.1.1.2 24
[LNS-GigabitEthernet1/0/0]q
[LNS]int g1/0/1
[LNS-GigabitEthernet1/0/1]ip add 192.168.1.1 24
[LNS-GigabitEthernet1/0/1]q	
[LNS]firewall zone untrust 
[LNS-zone-untrust]add int g1/0/0
[LNS]firewall zone trust 
[LNS-zone-trust]add int g1/0/1

服务器：

 2.建立PPPOE

 FW1：

[Client]interface Dialer 1
[Client-Dialer1]dialer user user1	
[Client-Dialer1]dialer-group 1
[Client-Dialer1]dialer bundle 1	
[Client-Dialer1]ip address ppp-negotiate 
[Client-Dialer1]ppp chap user user1	
[Client-Dialer1]ppp chap password cipher Password123
[Client]dialer-rule 1 ip permit 
[Client-zone-trust]add int Dialer 1
[Client]firewall zone trust 绑定接口
[Client]int g1/0/0	
[Client-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1

FW2（这里只需要一个合法且不和其他冲突的ip，因为VT接口不参与报文封装和数据转发也不受到安全策略的控制）：

[LAC]interface Virtual-Template 1	
[LAC-Virtual-Template1]ppp authentication-mode chap 
[LAC-Virtual-Template1]ip address 1.1.1.1 24	
[LAC]firewall zone dmz 
[LAC-zone-dmz]add interface Virtual-Template 1[LAC]interface g1/0/0
[LAC-GigabitEthernet1/0/0]pppoe-server bind virtual-template 1
[LAC-GigabitEthernet1/0/0]q
[LAC]aaa	
[LAC-aaa]domain default 
[LAC-aaa-domain-default]service-type l2tp	
[LAC-aaa]q
[LAC]user-manage user user1 domain default 	
[LAC-localuser-user1]password Password123

3.建立L2TP隧道

FW2：

[LAC]l2tp enable 
[LAC]l2tp-group 1	
[LAC-l2tp-1]tunnel authentication 
[LAC-l2tp-1]tunnel password cipher Hello123
[LAC-l2tp-1]tunnel name lac
[LAC-l2tp-1]start l2tp ip 20.1.1.2 fullusername user1

FW3：

[LNS]ip pool l2tp
[LNS-ip-pool-l2tp]section 0 172.16.0.2 172.16.0.100
[LNS-ip-pool-l2tp]q[LNS]aaa
[LNS-aaa]service-scheme l2tp
Info: Create a new service scheme.
[LNS-aaa-service-l2tp]ip	
[LNS-aaa-service-l2tp]ip-pool l2tp	[LNS-aaa]domain default 	
[LNS-aaa-domain-default]service-type l2tp 
[LNS-aaa-domain-default]q
[LNS-aaa]q	[LNS]user-manage user user1 domain default 	
[LNS-localuser-user1]password Password123
[LNS-localuser-user1]q	
[LNS]interface Virtual-Template1	
[LNS-Virtual-Template1]ppp authentication-mode chap 
[LNS-Virtual-Template1]ip add 172.16.0.1 24	
[LNS-Virtual-Template1]remote service-scheme l2tp[LNS]firewall zone dmz 
[LNS-zone-dmz]add interface Virtual-Template 1	[LNS]l2tp enable 
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp virtual-template 1 remote lac domain default
[LNS-l2tp-1]tunnel authentication 	
[LNS-l2tp-1]tunnel password cipher Hello123

4.安全策略

我们原本是放通了FW2和3的默认安全策略，现在可以查看一下防火墙的会话状态

然后我们可以根据会话表来写安全策略

FW2：

我们现在FW1补一下缺省路由：

[Client]ip route-static 0.0.0.0 0 Dialer 1

[LAC]security-policy
[LAC-policy-security]rule name policy_1	
[LAC-policy-security-rule-policy_1]source-zone local 
[LAC-policy-security-rule-policy_1]destination-zone untrust 	
[LAC-policy-security-rule-policy_1]source-address 20.1.1.1 32
[LAC-policy-security-rule-policy_1]destination-address 20.1.1.2 32
[LAC-policy-security-rule-policy_1]service l2tp
[LAC-policy-security-rule-policy_1]service protocol udp destination-port 1701
[LAC-policy-security-rule-policy_1]action permit 

FW2：

[LNS]security-policy
[LNS-policy-security]rule name policy_1
[LNS-policy-security-rule-policy_1]source-zone dmz 
[LNS-policy-security-rule-policy_1]destination-zone turst
[LNS-policy-security-rule-policy_1]source-address 172.16.0.0 24
[LNS-policy-security-rule-policy_1]destination-address 192.168.1.0 24
[LNS-policy-security-rule-policy_1]action permit [LNS-policy-security]rule name policy_2
[LNS-policy-security-rule-policy_2]source-zone untrust 
[LNS-policy-security-rule-policy_2]destination-zone local 
[LNS-policy-security-rule-policy_2]source-address 20.1.1.1 32
[LNS-policy-security-rule-policy_2]destination-address 20.1.1.2 32	
[LNS-policy-security-rule-policy_2]service l2tp 
[LNS-policy-security-rule-policy_2]service protocol udp destination-port 1701
[LNS-policy-security-rule-policy_2]action permit 

四.测试

我们可以查看一下FW1的Dialer的IP有没有被分配到：

ping服务器：

如果ping不同，尝试打开防火墙每个接口的ping服务。