Procedure

1. Configure the LNS.
   1. Set an IP address for each interface and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE1/0/1 and set the following parameters:

         Zone	untrust
         IPv4
         IP Address	1.1.1.2/24

      3. Click OK.

      4. Repeat the preceding steps to set the parameters of the GE1/0/3 interface.

         Zone	trust
         IPv4
         IP Address	192.168.1.1/24

   2. Configure security policies.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add and set the parameters of the security policy for the Untrust->Trust as follows:

         When the web UI is used to configure L2TP over IPSec, the FW uses Virtual-template 0 to communicate with the peer. When the PC dials up to the FW using L2TP, the FW adds Virtual-template 0 to the security zone of the interface that receives L2TP packets. In this example, the security zone refers to the Untrust zone to which interface GE1/0/1 is added. Employees on the move need to access intranet resources. Therefore, you need to configure an interzone security policy between the security zone where Virtual-template 0 resides and the security zone where the intranet resides. In the example, you need to configure an interzone security policy between the Untrust and Trust zone.

         If you assign Virtual-template 0 to another security zone through the CLI, enable the interzone security policy between the zone where Virtual-template 0 resides and the security zone where the intranet resides.

         Name	policy_ipsec_1
         Source Zone	untrust
         Destination Zone	trust
         Source Address/Region	10.1.1.2-10.1.1.100
         Destination Address/Region	192.168.1.0/24
         Action	Permit

         Name	policy_ipsec_2
         Source Zone	trust
         Destination Zone	untrust
         Source Address/Region	192.168.1.0/24
         Destination Address/Region	10.1.1.2-10.1.1.100
         Action	Permit

      3. Repeat preceding steps to configure security policies for the Untrust -> Local interzones.

         Name	policy_ipsec_3
         Source Zone	untrust
         Destination Zone	local
         Destination Address/Region	1.1.1.2/32
         Action	Permit

   3. Configure an L2TP user.

      1. Choose Object > User.

      2. Select the default authentication domain.

      3. Under User/User Group/Security Group Management List, Click Add, select Add User, and set the following parameters.

         User Name	vpdnuser
         Password	Hello123
         Confirm Password	Hello123

      4. Click OK.

   4. Configure the L2TP over IPSec tunnel.

      1. Choose Network > IPSec > IPSec, and click Add under IPSec Policy List.

      2. Select Site-to-multisite as Scenario as L2TP over IPSec client.

      3. Configure Basic Configuration as follows. The headquarters needs to be accessed by multiple branches. Therefore, do not specify the remote gateway address. The pre-shared key is Admin@123.

      4. Configure Dial-up User Configuration as follows.

      5. Under Data Flow to Be Encrypted, click Add to add a data flow as follows.

      6. Configure IKE and IPSec protocol.

      7. Click Apply to complete the configurations.

   5. The LAC client uses the built-in L2TP client to dial up. Tunnel verification is not supported. Therefore, you need to disable tunnel verification on the FW.
      1. Choose Network > L2TP > L2TP. In L2TP Group List, click default-lns and deselect Tunnel Password Authentication. Set the Associated Zone to untrust.
      2. Click OK.

2. Configure a route on the HQ server.

   To communicate with mobile employees, the HQ server must have a route to the user address pool, with the next hop pointing to the LAN interface address of the FW.

3. Configure the mobile employee's Android phone.

   Complete the following configurations on the Settings page.