Web: Example for Configuring L2TP over IPSec to Allow Mobile Users to Access the Headquarters Using Mac OS X Terminals

Procedure

1. Configure the LNS.
   1. Set an IP address for each interface and assign the interfaces to security zones.
      1. Choose Network > Interface.

      2. Click of GE1/0/1 and set the following parameters:

         Zone	untrust
         IPv4
         IP Address	1.1.1.2/24

      3. Click OK.

      4. Repeat the preceding steps to set the parameters of the GE1/0/3 interface.

         Zone	trust
         IPv4
         IP Address	192.168.1.1/24

   2. Configure security policies.

      1. Choose Policy > Security Policy > Security Policy.

      2. Click Add and set the parameters of the security policy for the Untrust->Trust as follows:

         When the web UI is used to configure L2TP over IPSec, the FW uses Virtual-template 0 to communicate with the peer. When the PC dials up to the FW using L2TP, the FW adds Virtual-template 0 to the security zone of the interface that receives L2TP packets. In this example, the security zone refers to the Untrust zone to which interface GE1/0/1 is added. Employees on the move need to access intranet resources. Therefore, you need to configure an interzone security policy between the security zone where Virtual-template 0 resides and the security zone where the intranet resides. In the example, you need to configure an interzone security policy between the Untrust and Trust zone.

         If you assign Virtual-template 0 to another security zone through the CLI, enable the interzone security policy between the zone where Virtual-template 0 resides and the security zone where the intranet resides.

         Name	policy_ipsec_1
         Source Zone	untrust
         Destination Zone	trust
         Source Address/Region	10.1.1.2-10.1.1.100
         Destination Address/Region	192.168.1.0/24
         Action	Permit

         Name	policy_ipsec_2
         Source Zone	trust
         Destination Zone	untrust
         Source Address/Region	192.168.1.0/24
         Destination Address/Region	10.1.1.2-10.1.1.100
         Action	Permit

      3. Repeat preceding steps to configure security policies for the Untrust -> Local interzones.

         Name	policy_ipsec_3
         Source Zone	untrust
         Destination Zone	local
         Destination Address/Region	1.1.1.2/32
         Action	Permit

   3. Configure an L2TP user.

      1. Choose Object > User.

      2. Select the default authentication domain.

      3. Under User/User Group/Security Group Management List, click Add, select Add User, and set the following parameters.

         User Name	macpc
         Password	Hello123
         Confirm Password	Hello123

      4. Click OK.

   4. Configure the L2TP over IPSec tunnel.

      1. Choose Network > IPSec > IPSec, and click Add under IPSec Policy List.

      2. Select Site-to-multisite as Scenario as L2TP over IPSec client.

      3. Configure Basic Configuration as follows. The headquarters needs to be accessed by multiple branches. Therefore, do not specify the remote gateway address. The pre-shared key is Admin@123.

      4. Configure Dial-up User Configuration as follows.

      5. Under Data Flow to Be Encrypted, click Add to add a data flow as follows.

      6. Configure IKE and IPSec protocol.

      7. Click Apply to complete the configurations.

   5. The LAC client uses the built-in L2TP client to dial up. Tunnel verification is not supported. Therefore, you need to disable tunnel verification on the FW.
      1. Choose Network > L2TP > L2TP. In L2TP Group List, click default-lns and deselect Tunnel Password Authentication.
      2. Click OK.

2. Configure a route on the HQ server.

   To communicate with mobile employees, the HQ server must have a route to the L2TP address pool, with the next hop pointing to the LAN interface address of the FW.

3. Configure the mobile employee's PC.
   1. As shown in Figure 3-17, click in Dock. Alternatively, choose APPLE > System Preferences at the upper left corner of the system desktop.
      Figure 3-17 Desktop Dock
      

   2. As shown in Figure 3-18, choose Internet & Wireless > Network.
      Figure 3-18 Accessing the VPN setting page
      

   3. As shown in Figure 3-19, click + in the lower left corner to create a network connection.
      Figure 3-19 Creating a network connection
      

   4. Figure 3-20 shows the configuration page. Set Interface to VPN, VPN Type to L2TP over IPSec, and Service Name to any value (using VPN(L2TP) as an example). After the configuration is complete, click Create.
      Figure 3-20 Creating a VPN connection
      

   5. As shown in Figure 3-21, click VPN(L2TP) in the left column. Server Address indicates the IP address of the interface on the LNS connecting to the Internet. 1.1.1.2 is used as an example. Account Name indicates the user name registered with the LNS. macpc is used as an example.
      Figure 3-21 Setting the IP address and user name
      

   6. Click Authentication Settings... shown in Figure 3-21. On the page shown in Figure 3-22, choose User Authentication > Password, and enter an authentication password (using abcd1234! as an example) for user macpc. Then choose Machine Authentication > Shared Secret and enter the preshared key (using abc123 as an example). After the configuration is complete, click OK.
      Figure 3-22 Setting the authentication password and preshared password
      

   7. Click Advanced... in the lower right corner of Figure 3-21. On the page shown in Figure 3-23, select the first three items of Session on the Options tab page. After the configuration is complete, click OK.
      Figure 3-23 Setting advanced options for a VPN connection
      

   8. Click Apply in the lower right corner of Figure 3-21 to make all parameters take effect.