Web: Example for Configuring Local Authentication on Remote Access Users Using L2TP VPN in Automatic LAC Dial-up Mode

This section provides an example for configuring local authentication on remote access users using L2TP VPN in automatic LAC dial-up mode when a FW works as a VPN access gateway.

Networking Requirements

As shown in Figure 1, FWs are deployed at the network borders of the headquarters and branch office of an enterprise. FW_A at the headquarters works as an LNS, and FW_B at the branch office works as a LAC. An L2TP tunnel is established between the LAC and the LNS in automatic LAC dial-up mode. Branch office users can access intranet resources at the headquarters based on IP addresses.

Figure 1 Local authentication on remote access users using L2TP VPN in automatic LAC dial-up mode

In automatic LAC dial-up mode, the LNS authenticates the LAC only, but not employees in branch offices. Therefore, security is not ensured. The user management and authentication mechanisms of FW_A must allow branch office users to connect to the headquarters and identify users based on their IP addresses to implement user-specific behavior control and permission assignment. Requirements are as follows:

Information about users and departments is saved on the FW_A (the LNS) and can be referenced by policies and L2TP VPNs.
The R&D and marketing employees at the branch office must be authenticated by the LNS. If multiple services exist on the network, configure user-initiated authentication. In this case, a user employs a browser to access http://10.3.0.1:8887 and enters the user name and password for authentication.

Configuration Roadmap

This example describes only how to configure user management and authentication.

If source NAT is configured to translate the IP addresses of all users into one address on the LAC when L2TP in automatic dialup mode is configured, the FW authenticates users based on the NATed address and consider the users as one user. In this case, user-based policy control in this example cannot be implemented.

On FW_A (the LNS), create an authentication domain to implement authentication on FW_B (the LAC) during L2TP tunnel establishment. Then configure a default authentication domain to implement authentication on the R&D and marketing employees at the branch office.
Create user group objects and user objects and set passwords for the user objects on FW_A (the LNS). User object lac is used only in identity authentication on the LAC during L2TP tunnel establishment.
On FW_A, configure an authentication policy to authenticate the R&D and marketing employees at the branch office before they access the Internet.
On the FW, configure a security policy to allow Internet access users to access authentication web pages to trigger user-initiated authentication.

Data Planning

Item	Data	Description
Automatic LAC dial-up	Login Name: lac Parent Group: /auth_domain_01 Password/Confirm Password: Admin@123 Prohibit Users from Sharing This Account	The user name used by a LAC to establish an L2TP tunnel to an LNS applies only in identity authentication on the LAC.
R&D employee at the branch office	Group Name: research Parent Group: /default User Login Name: user_0002 Display Name: Tom Parent Group: /default/research Password/Confirm Password: Admin@123 Prohibit Users from Sharing This Account	Add the R&D employee at the branch office to group research. You can repeat the operations in this example to configure multiple user accounts.
Marketing employee at the branch office	Group Name: marketing Parent Group: /default User Login Name: user_0003 Display Name: Jack Parent Group: /default/marketing Password/Confirm Password: Admin@123 Prohibit Users from Sharing This Account	Add the marketing employee at the branch office to group marketing. You can repeat the operations in this example to configure multiple user accounts.
Authentication domain	Authentication domain for automatic LAC dial-up Name: auth_domain_01 Access Control: Allow L2TP Access	FW_A identifies the authentication domain in the user name used by a LAC for establishing an L2TP tunnel and implements authentication on the LAC based on the authentication domain.
Authentication domain	Authentication domain for the R&D and marketing employees Name: default Access Control: Online behavior management	The default authentication domain is used during authentication. No authentication domain is required in the entered user names of the R&D and marketing employees at the branch office.
Authentication policy	Name: policy_auth_service Source Address/Region: 10.4.0.0/16 Action: auth	Authentication is implemented on the R&D employee, marketing employee at the branch office who meets matching conditions. The R&D employee, marketing employee can access network resources only after being authenticated by a FW_A.

Procedure

Choose Network > Interface, set IP addresses for interfaces and assign the interfaces to security zones.
The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

Zone

trust

IP Address

10.3.0.1/24
Choose Object > User > Authentication Domain, click Add to create an authentication domain for LAC.
Choose Object > User > auth_domain_01, configure local authentication for LAC.
Choose Object > User > default, configure local authentication for employees in branch offices.

Click Add and create user groups and users.
1. Choose Add Group, create a user group object for an R&D employee.
2. Choose Add a User, create a user object for an R&D employee.
3. Repeat the previous steps to create the user group/user account (marketing/user_0003) of the marketing department.
4. Click Apply.
Choose Object > User > Authentication Policy, click Add to create an authentication policy.

Name

auth_policy_service

Source Address/Region

10.4.0.0/16

Action

Portal authentication

Portal Authentication Template

disable
Choose Policy > Security Policy > Security Policy, click Add to configure a security policy to allow users to access the authentication page.

Name

policy_sec_01

Destination Zone

local

Source Address

10.4.0.0/16

Service

Create user-defined service (TCP/8887)

Action

Permit
After the configuration is complete, you can configure security policies, PBR policies, bandwidth policies, quota control policies, proxy policies, and audit policies that reference the user and user group objects.

Zone	trust
IP Address	10.3.0.1/24

Name	auth_policy_service
Source Address/Region	10.4.0.0/16
Action	Portal authentication
Portal Authentication Template	disable

Name	policy_sec_01
Destination Zone	local
Source Address	10.4.0.0/16
Service	Create user-defined service (TCP/8887)
Action	Permit

Verification

An R&D employee at the branch office accesses http://10.3.0.1:8887 and enters user name user_0002 and password Admin@123 for authentication. The employee can access intranet resources at the headquarters after being authenticated.
A marketing employee at the branch office accesses http://10.3.0.1:8887 and enters user name user_0003 and password Admin@123 for authentication. The employee can access intranet resources at the headquarters after being authenticated.
On the FW, choose Object > User > Online User to see information about online users.

Configuration Scripts

#
 sysname FW_A
#
interface GigabitEthernet0/0/1
 ip address 1.1.1.1 255.255.255.0 
#
interface GigabitEthernet0/0/2
 ip address 10.2.0.1 255.255.255.0
#
interface GigabitEthernet0/0/3
 ip address 10.3.0.1 255.255.255.0
#
firewall zone trust
 add interface GigabitEthernet0/0/3
#
firewall zone untrust
  add interface GigabitEthernet0/0/1
#
firewall zone dmz
 add interface GigabitEthernet0/0/2
#
aaa 
 #
 domain auth_domain_01
  service-type l2tp
 domain default
  service-type internetaccess
 #
#
auth-policy
 rule name auth_policy_service
  source-address 10.4.0.0 16
  action auth
#
security-policy
  rule name policy_sec_01 
    destination-zone local
    source-address 10.4.0.0 16
    service protocol tcp destination-port 8887
    action permit

# The following user/group creation configuration is stored in the database, but not in the configuration profile.
user-manage group /default/research
user-manage group /default/marketing
user-manage user user_0002
 alias Tom
 parent-group /default/research
 password *********
 undo multi-ip online enable
user-manage user user_0003
 alias Jack
 parent-group /default/marketing
 password *********
 undo multi-ip online enable
user-manage user lac
 parent-group /auth_domain_01
 password *********