Web UI: Example for Configuring L2TP VPN (Local Authentication) in the Client-Initiated Scenario

Procedure

• Configure the LNS.
  1. Set IP addresses for interfaces and assign the interfaces to security zones.
     1. Choose Network > Interface.

     2. Click of GE0/0/1 and set required parameters.

        Zone	untrust
        IPv4
        IP Address	1.1.1.1/24

     3. Click OK.

     4. Configure GE0/0/2 based on the preceding step.

        Zone	trust
        IPv4
        IP Address	10.1.1.1/24

  2. Create users and user groups.
     1. Choose Object > User > default.
     2. In Scenario, select L2TP/L2TP over IPSec. In User Location, select Local.
        
        
     3. Click Apply.

  3. Configure L2TP VPN.
     1. Choose Network > L2TP > L2TP.

     2. In Configure L2TP, select Enable and click Apply.

     3. In L2TP Group List, click Add and set L2TP parameters.

        Set Password to Hello123 and the address range of Address/Address Pool to 172.16.1.2 to 172.16.1.100. Server Address/Subnet Mask is the address of the VT interface on the LNS side. It is recommended that the IP address be in the same network as the address pool.
        
        

     4. Click OK.

  4. Configure a route to the Internet. It is assumed that the next-hop address of the route is 1.1.1.2.
     1. Choose Network > Route > Static Route.

     2. Click Add and set required parameters.

        Destination Address/Mask	0.0.0.0/0.0.0.0
        Next Hop	1.1.1.2

     3. Click OK.

  5. Configure a security policy.

     1. Choose Policy > Security Policy > Security Policy.

     2. Click Add. Configure interzone security policies between the Trust zone and DMZ to permit the traffic sent by mobile users to access the intranet of the headquarters and the traffic sent by devices on the intranet of the headquarters to mobile users. After the configuration is complete, click OK.

        Name	service_td
        Source Zone	trust
        Destination Zone	dmz
        Source Address/Region	10.1.2.0/24
        Destination Address/Region	172.16.1.0/24
        Action	Permit

        Name	service_dt
        Source Zone	dmz
        Destination Zone	trust
        Source Address/Region	172.16.1.0/24
        Destination Address/Region	10.1.2.0/24
        Action	Permit

     3. Click Add. Configure an interzone security policy from the Untrust zone to the Local zone to permit L2TP packets. After the configuration is complete, click OK.

        Name	l2tp_ul
        Source Zone	untrust
        Destination Zone	local
        Destination Address/Region	1.1.1.0/24
        Action	Permit

• Configure the SecoClient at the mobile user side.
  1. Open the SecoClient and access the home page.

     Select New Connection from the Connect drop-down list.
     
     

  2. Set L2TP VPN connection parameters.

     In the New Connection navigation tree, select L2TP/IPSec. Set connection parameters and click OK.

     The tunnel authentication password is Hello123.
     
     

  3. Log in to the L2TP VPN gateway.
     1. Select the created L2TP VPN connection from the Connect drop-down list and click Connect.
        
        
     2. On the login page, enter the user name and password.
        
        
     3. Click Login to initiate a VPN connection request.

        A message on a VPN access success will be displayed on the web UI. After the connection is established, mobile users can access intranet resources as intranet users.