Web UI: Example for Configuring L2TP VPN (RADIUS Authentication) in the Client-Initiated Scenario

Procedure

1. Configure the LNS.
   1. Set IP addresses for interfaces and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set required parameters.

         Zone	untrust
         IPv4
         IP Address	1.1.1.1/24

      3. Click OK.

      4. Repeat the preceding steps to configure GE0/0/2 and GE0/0/3.

         Zone	trust
         IPv4
         IP Address	10.1.1.1/24

         Zone	dmz
         IPv4
         IP Address	10.1.3.1/24

   2. Set parameters for interconnecting with the RADIUS server.
      1. Choose Object > Authentication Server > RADIUS. Click Add to set parameters for interconnecting with the RADIUS server.
         
         

         Click Test and then OK in the dialog box that is displayed. Then enter the account name and password obtained from the RADIUS server. Click Start to check the connectivity to the RADIUS server.

      2. Click OK.

   3. Configure the authentication domain.

      Authentication domain default is used as an example. You can define an authentication domain.

      1. Choose Object > User > default and configure RADIUS server authentication.
         
         
      2. Click Apply.

   4. Configure L2TP VPN.
      1. Choose Network > L2TP > L2TP.

      2. In Configure L2TP, select Enable and click Apply.

      3. In L2TP Group List, click Add and set L2TP parameters.

         Set Password to Hello123 and the address range of Address/Address Pool to 172.16.1.2 to 172.16.1.100. Associated Zone indicates the security zone where the VT interface resides. Server Address/Subnet Mask is the address of the VT interface on the LNS side. It is recommended that the IP address be in the same network as the address pool.
         
         

      4. Click OK.

   5. Configure a route to the Internet. It is assumed that the next-hop address of the route from the LNS to the Internet is 1.1.1.2.
      1. Choose Network > Route > Static Route.

      2. Click Add and set required parameters.

         Destination Address/Mask	0.0.0.0/0.0.0.0
         Next Hop	1.1.1.2

      3. Click OK.

   6. Configure a security policy.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add. Configure interzone security policies between the Trust zone and DMZ to permit the traffic sent by mobile users to access the intranet of the headquarters and the traffic sent by devices on the intranet of the headquarters to mobile users. After the configuration is complete, click OK.

         Name	service_td
         Source Zone	trust
         Destination Zone	dmz
         Source Address/Region	10.1.2.0/24
         Destination Address/Region	172.16.1.0/24
         Action	Permit

         Name	service_dt
         Source Zone	dmz
         Destination Zone	trust
         Source Address/Region	172.16.1.0/24
         Destination Address/Region	10.1.2.0/24
         Action	Permit

      3. Click Add. Configure an interzone security policy from the Untrust zone to the Local zone to permit L2TP packets. After the configuration is complete, click OK.

         In this scenario, the LNS only receives L2TP negotiation packets and does not proactively send L2TP negotiation packets to mobile users. Therefore, only the interzone security policy from the Untrust zone to the Local zone needs to be configured.

         Name	l2tp_ul
         Source Zone	untrust
         Destination Zone	local
         Destination Address/Region	1.1.1.0/24
         Action	Permit

      4. Configure an interzone security policy from the DMZ to the Local zone to permit packets exchanged between the LNS and LDAP server.

         Name	radius_ld
         Source Zone	local
         Destination Zone	dmz
         Source Address/Region	10.1.3.0/24
         Action	Permit

2. Configure a RADIUS server. For how to configure a RADIUS server, see the documents of the RADIUS server.
3. Configure the SecoClient at the mobile user side.
   1. Open the SecoClient and access the home page.

      Select New Connection from the Connect drop-down list.
      
      

   2. Set L2TP VPN connection parameters.

      In the New Connection navigation tree, select L2TP/IPSec. Set connection parameters and click OK.

      The tunnel authentication password is Hello123.
      
      

   3. Log in to the L2TP VPN gateway.
      1. Select the created L2TP VPN connection from the Connect drop-down list and click Connect.
         
         
      2. On the login page, enter the user name and password.
         
         
      3. Click Login to initiate a VPN connection request.

         A message on a VPN access success will be displayed on the web UI. After the connection is established, mobile users can access intranet resources as intranet users.