Web UI: Example for Configuring L2TP VPN (AD Authentication) in the Client-Initiated Scenario

Procedure

1. Configure the LNS.
   1. Configure IP addresses for interfaces and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE0/0/1 and set required parameters.

         Zone	untrust
         IPv4
         IP Address	1.1.1.1/24

      3. Click OK.

      4. Repeat the preceding steps to configure GE0/0/2 and GE0/0/3.

         Zone	trust
         IPv4
         IP Address	10.1.1.1/24

         Zone	dmz
         IPv4
         IP Address	10.1.3.1/24

   2. Choose Object > Authentication Server > AD and configure parameters for interconnecting the LNS and AD server.

      

      

      For the V600R007C20 version, whether to enable SSL for AD authentication cannot be configured on the web UI. When you configure the AD server on the web UI, SSL (ldap-over-ssl) is enabled by default. In this mode, LDAP over SSL must also be enabled on the AD server. For details, see the operating system guide of the AD server. To disable SSL (no-ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ad-server authentication 10.1.3.2 88 no-ssl command in the corresponding AD server template view. From V600R007C20SPC100, you can configure whether to enable SSL for AD authentication on the Web UI. The following uses no-ssl as an example.

      If you are unfamiliar with the AD server and cannot provide the server name, Base DN, or filter field values, you can use the AD Explorer or LDAP Browser/Editor software to connect to the AD server to query the attribute values. The AD Explorer is used as an example. The AD server attributes and mappings between the server attributes and parameters on the LNS are as follows.

      

      Click Test. In the window that is displayed, click OK and then enter the test account and password. Click Start to check the connectivity to the AD server.

      

      The user name and password used for the test must be the same as those on the AD server.

      

   3. Choose Object > User > default and click Add to create an authentication domain.
      

      When the LNS uses AD server authentication, the authentication domain name configured on the LNS must be the same as that configured on the authentication server. In this example, the domain name on the AS server is cce.com. Therefore, the authentication domain name must be set to cce.com on the LNS.

      

   4. Choose Object > User > cce.com and configure AD server authentication. After completing the preceding configurations, click Apply.

      

   5. Configure L2TP VPN.
      1. Choose Network > L2TP > L2TP.

      2. In Configure L2TP, select Enable and click Apply.

      3. In L2TP Group List, click Add and set L2TP parameters.

         Set Password to Hello123 and the address range of Address/Address Pool to 172.16.1.2 to 172.16.1.100. Associated Zone indicates the security zone where the VT interface resides. Server Address/Subnet Mask is the address of the VT interface on the LNS side. It is recommended that the IP address be in the same network as the address pool.
         
         

      4. Click OK.

   6. Configure a route to the Internet. It is assumed that the next-hop address of the route from the LNS to the Internet is 1.1.1.2.
      1. Choose Network > Route > Static Route.

      2. Click Add and set required parameters.

         Destination Address/Mask	0.0.0.0/0.0.0.0
         Next Hop	1.1.1.2

      3. Click OK.

   7. Configure a security policy.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add. Configure interzone security policies between the Trust zone and DMZ to permit the traffic sent by mobile users to access the intranet of the headquarters and the traffic sent by devices on the intranet of the headquarters to mobile users. After the configuration is complete, click OK.

         Name	service_td
         Source Zone	trust
         Destination Zone	dmz
         Source Address/Region	10.1.2.0/24
         Destination Address/Region	172.16.1.0/24
         Action	Permit

         Name	service_dt
         Source Zone	dmz
         Destination Zone	trust
         Source Address/Region	172.16.1.0/24
         Destination Address/Region	10.1.2.0/24
         Action	Permit

      3. Click Add. Configure an interzone security policy from the Untrust zone to the Local zone to permit L2TP packets. After the configuration is complete, click OK.

         In this scenario, the LNS only receives L2TP negotiation packets and does not proactively send L2TP negotiation packets to mobile users. Therefore, only the interzone security policy from the Untrust zone to the Local zone needs to be configured.

         Name	l2tp_ul
         Source Zone	untrust
         Destination Zone	local
         Destination Address/Region	1.1.1.0/24
         Action	Permit

      4. Configure an interzone security policy from the DMZ to the Local zone to permit packets exchanged between the LNS and AD server.

         Name	ad_ld
         Source Zone	local
         Destination Zone	dmz
         Source Address/Region	10.1.3.0/24
         Action	Permit

2. Configure the SecoClient at the mobile user side.
   1. Open the SecoClient and access the home page.

      Select New Connection from the Connect drop-down list.
      
      

   2. Set L2TP VPN connection parameters.

      In the New Connection navigation tree, select L2TP/IPSec. Set connection parameters and click OK.

      The tunnel authentication password is Hello123.
      
      

   3. Log in to the L2TP VPN gateway.
      1. Select the created L2TP VPN connection from the Connect drop-down list and click Connect.
         
         
      2. On the login page, enter the user name and password.
         
         
      3. Click Login to initiate a VPN connection request.

         A message on a VPN access success will be displayed on the web UI.
         
         After the connection is established, mobile users can access intranet resources as intranet users.