Web: Example for Configuring L2TP over IPSec to Allow Users to Access the Headquarters Using Windows 7 Terminals

Procedure

1. Configure the LNS.
   1. Set an IP address for each interface and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE1/0/1 and set the following parameters:

         Zone	untrust
         IPv4
         IP Address	1.1.1.2/24

      3. Click OK.

      4. Repeat the preceding steps to set the parameters of the GE1/0/3 interface.

         Zone	trust
         IPv4
         IP Address	192.168.1.1/24

   2. Configure security policies to allow specific subnets to communicate.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add and set the parameters of the security policy for the Trust->Untrust interzone as follows:

         Name	policy_ipsec_1
         Source Zone	trust
         Destination Zone	untrust
         Source Address/Region	192.168.1.0/24
         Destination Address/Region	10.1.1.2-10.1.1.100
         Action	Permit

      3. Click OK.

      4. Repeat preceding steps to configure security policies for the Untrust -> Trust, Untrust -> Local, and Local -> Untrust interzones.

         The parameters of the security policy for the Untrust -> Trust interzone are as follows:

         Name	policy_ipsec_2
         Source Zone	untrust
         Destination Zone	trust
         Source Address/Region	10.1.1.2-10.1.1.100
         Destination Address/Region	192.168.1.0/24
         Action	Permit

         The parameters of the security policy for the Untrust -> Local interzone are as follows:

         Name	policy_ipsec_3
         Source Zone	untrust
         Destination Zone	local
         Destination Address/Region	1.1.1.2/32
         Action	Permit

         The parameters of the security policy for the Local -> Untrust interzone are as follows:

         Name	policy_ipsec_4
         Source Zone	local
         Destination Zone	untrust
         Source Address/Region	1.1.1.2/32
         Action	Permit

   3. Configure an L2TP user.

      1. Choose Object > User.

      2. Select the default authentication domain.
      3. Select the L2TP/L2TP over IPSec Scenario.

      4. Under User/User Group/Security Group Management List, Click Add, select Add User, and set the following parameters.

         User Name	vpdnuser
         Password	Hello123
         Confirm Password	Hello123

      5. Click OK.

   4. Configure the L2TP over IPSec tunnel.

      1. Choose Network > IPSec > IPSec, and click Add under IPSec Policy List.

      2. Select Site-to-multisite as Scenario as L2TP over IPSec client.

      3. Configure Basic Configuration as follows. The headquarters needs to be accessed by multiple branches. Therefore, do not specify the remote gateway address. The pre-shared key is Admin@123.
         
         

      4. Configure Dial-up User Configuration as follows.

         1. Choose Add IP pool in the User address pool drop-down list.

         2. Set an IP pool.

         3. Click OK.
      5. Under Data Flow to Be Encrypted, click Add to add a data flow as follows.

      6. Configure IKE and IPSec protocol.

      7. Click Apply to complete the configurations.

   5. The LAC client uses the built-in L2TP client to dial up. Tunnel verification is not supported. Therefore, you need to disable tunnel verification on the FW.
      1. Choose Network > L2TP > L2TP. In L2TP Group List, click default-lns and deselect Tunnel Password Authentication.
      2. Click OK.

2. Configure a route on the HQ server.

   To communicate with mobile employees, the HQ server must have a route to the user address pool, with the next hop pointing to the LAN interface address of the FW.

3. Set dial-in parameters on the LAC client.
   1. View the status of the IPSec service and ensure that the IPSec service is enabled.
      1. Choose Start > Run, enter services.msc, and click OK to access the Services page.
      2. In the Name column, view the IPsec Policy Agent status to ensure that IPsec Policy Agent are in Started state. Otherwise, right-click IPsec Policy Agent and choose Properties. In Properties, set Startup type to Automatic and click Apply. Then select Start in Service type.
      3. Close the Services page.

   2. Create an L2TP over IPSec connection.