Web: Example for Accessing the Virtual System Network Using a Windows 7 PC Through an L2TP over IPSec Tunnel

Procedure

• Configure FW_A.
  1. Enter Dashboard. In Device Information, click Configure following Virtual System to enable the virtual system.

  2. Configure the resource class of the virtual system.
     1. Choose System > Virtual System > Resource Class.

     2. Click Add. Set the number of assured IPSec tunnels and maximum number of IPSec tunnels of the virtual system by referring to the configuration of system resource class r1 of vsysa.

        The number of assured IPSec tunnels cannot be larger than the maximum number of IPSec tunnels.

  3. In the root system, create virtual system vsysa and allocate resources.
     1. Choose System > Virtual System > Virtual System.

     2. Click Add. Select the Basic Settings tab and configure basic parameters for the virtual system.

     3. Select the Interface Settings tab, click Add, and allocate an interface to the virtual system.

     4. Click OK.

  4. Configure the interface in the root system and add the interface to the security zone. The IP address of Virtual-if0 can be any value as long as it does not conflict with the IP address on any other interface.
     1. Choose Network > Interface.

     2. Click Edit in the line where interface GE1/0/1 is located, and configure the IP address and security zone.

     3. Click Edit in the line where interface Virtual-if0 is located, and configure the IP address and security zone.

  5. Configure the route in the root system. Assume that the next-hop IP address of FW_A is 1.1.1.2.
     1. Choose Network > Route > Static Route.

     2. Click Add. Add a default route destined for the Internet.

  6. Configure security policies in the root system.
     1. Choose Policy > Security Policy > Security Policy.

     2. Click Add, select Add Security Policy, and configure security policies.

        # Configure a security policy for the access from the Trust zone to the Untrust zone, and allow intranet users to access the Internet.

        You can configure strict security policies for IP addresses of intranet users. Therefore, when configuring security policies in the root system, you do not need to specify the address range.

        # Configure the security policy for the access from the Local zone to the Untrust zone, and allow FW_A to establish an IPSec tunnel with the peer device.

        # Configure the security policy for the access from the Untrust zone to the Local zone, and allow the peer device to establish an IPSec tunnel with FW_A.

        The Local-Untrust interzone policy controls whether IKE negotiation packets can pass through the FW. This policy can use the source and destination addresses, protocol, or port as the matching condition. In this example, the source and destination addresses are used as the matching condition. To use the protocol or port as the matching condition, you need to enable ESP, port 500 for UDP (port 4500 also in NAT traversal scenarios) and port 1701 for UDP.

  7. Configure an interface in vsysa.

     1. In the Virtual System drop-down list, select vsysa to enter vsysa.

     2. Choose Network > Interface.

     3. Click Edit in the line where interface GE1/0/2 is located, and configure the IP address and security zone.

     4. Click Edit in the line where Virtual-if1 is located and configure the IP address and security zone.

  8. Configure routes in vsysa to guide Internet access traffic from employees in vsysa to the root system.

     In this example, the network topology and routing configuration are simplified. If vsysa only needs to communicate with the Internet, set Destination Address/Mask to 0.0.0.0 0.0.0.0. That is, all packets are sent to the root system. In practice, for accurate routing information, Destination Address/Mask should be set to a specific Internet address range that the intranet users are allowed to access. Incorrect routing configurations may interrupt the communications of the private networks connected to vsysa.

     1. Choose Network > Router > Static Route.

     2. Click Add and add a static route.

  9. Configure a security policy in vsysa.
     1. Choose Policy > Security Policy > Security Policy.

     2. Click Add, select Add Security Policy, and configure security policies.

        # Configure a security policy for the access from the Trust zone to the Untrust zone, and allow users in network A to access resources of LCA Client 1.

        # Configure a security policy for the access from the Untrust zone to the Trust zone, and allow LCA Client 1 to access resources of network A.

  10. In the root system, configure the address pool, authentication domain, and object.

      1. In the Virtual System drop-down list, select public to enter the root system.

      2. Choose Object > IP Address Pool, click Add, and create user address pool pool1.

      3. Choose Object > User > Authentication Domain, click Add, and create authentication domain network_vsysa based on vsysa.

      4. Choose Object > User > network_vsysa, select L2TP/L2TP over IPSec in Scenario, click Add in User Management List, and create an intranet user of vsysa. In this example, the user name is user0001 and password is Hello@123.

      5. Click Apply.

  11. In the root system, configure an L2TP over IPSec tunnel.
      1. Choose Network > IPSec > IPSec, click Add, select Site-to-multisite in Scenario, and select L2TP over IPSec client in Peer Type.

      2. Configure basic information about the IPSec policy and set the authentication mode to Pre-Shared Key and key type to Different.

      3. In IKE User Information List, click Add. Add IKE user information, and set pre-shared key to Admin@123.

         The configuration on the local end is used as a template. IPSec tunnel protection involves traffic of multiple virtual systems. Therefore, you do not need to manually configure to-be-encrypted traffic when configuring IPSec policies in the root system, and the to-be-encrypted traffic is subject to negotiation with the peer end.

      4. Configure the user address pool, and select pool1 in the IP Address Pool drop-down list.

      5. Expand Advanced in IKE/IPSec Proposal, and configure a security proposal.

      6. Click Apply. The configuration on FW_A is complete.

• Configure routes for an internal server of network A.

  The internal server of network A can communicate with LAC Client 1 only when a route destined to the user address pool is configured. The next-hop address of the route must destine for the intranet interface address of vsysa.

• Configure VPN connection parameters for LAC Client 1.
  1. View the IPSec service state and ensure that the IPSec service is enabled.
     1. In Start > Run, run the services.msc command, and click OK. The Services page is displayed.
     2. In the Name column, ensure that IPsec Policy Agent is in the Started state. If IPsec Policy Agent is not in the Started state, right-click IPsec Policy Agent and select Properties. Set Startup type to Automatic and click Apply. Then, select Start in Service type.
     3. Close the Services page.

  2. Create an L2TP over IPSec connection.

  3. After configuration, use software of LAC Client 1 to dial up. The dialing is successful.