No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE40E V800R010C10SPC500 Configuration Guide - User Access 01

This is NE40E V800R010C10SPC500 Configuration Guide - User Access
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring an L2TP Tunnel on an L3VPN for User Access

Example for Configuring an L2TP Tunnel on an L3VPN for User Access

This section provides an example for configuring an L2TP tunnel on an L3VPN for user access. This configuration example consists of networking requirements, configuration roadmap, configuration procedure, and configuration files.

Networking Requirements

As shown in Figure 10-15, the NE40E A and NE40E B function as the PE on the MPLS backbone; NE40E A functions as the LAC; NE40E B functions as the LNS; an L2TP tunnel is set up on the VPN. Loopback 0 belongs to VRF 1, loopback 1 also belongs to VRF 2.

Figure 10-15 Networking diagram for establishing an L2TP Tunnel on an L3VPN for user access
NOTE:

Interfaces 1 through 2 are GE 2/0/0.100,GE3/0/0.



Device Interface IP address
DeviceA GigabitEthernet 3/0/0 172.16.1.1/24
LoopBack 0 10.1.1.3/24
LoopBack 1 10.2.1.3/24
LoopBack 2 1.1.1.9/32
lsr-id 1.1.1.9
DeviceB GigabitEthernet 3/0/0 172.16.1.2/24
LoopBack 0 10.3.1.3/24
LoopBack 1 10.4.1.3/24
LoopBack 2 2.2.2.9/32
lsr-id 2.2.2.9

Configuration Roadmap

  1. Set up an MPLS VPN on the backbone network.

  2. Bind the interface of the L2TP tunnel to the VPN instance.

  3. Configure dial-up parameters at the user side.

  4. Configure a LAC.

  5. Configure an LNS.

Data Preparation

To complete the configuration, you need the following data:

  • MPLS LSR ID of each PE, which is the IP address of Loopback 2

  • Usernames and passwords of PC1 and PC2

  • Tunnel password, the tunnel name on the LNS, and the tunnel name on the LAC

  • VPN instance

  • Numbers of two VT interfaces and numbers of two L2TP groups

  • Number, range, and mask of the remote address pool

Procedure

  1. Configure the devices on the user side.

    To create a dialup connection, dial the access number specified on Device A, and receive addresses assigned by the LNS server.

    Regarding PC1, input the user name user1@isp1 and password in the ejected dial-up terminal window (The user name and password have been registered on the LNS).

    Regarding PC2, input the user name user1@isp2 and password in rejected dial-up terminal window (The user name and password have been registered on the LNS).

  2. Configure DeviceA (the LAC side).

    # Configure VT interface 1.

    <Device> system-view
    [~Device] sysname DeviceA
    [*DeviceA] interface virtual-template 1
    [*DeviceA-Virtual-Template1] ppp authentication-mode chap
    [*DeviceA-Virtual-Template1] commit
    [~DeviceA-Virtual-Template1] quit

    # Bind VT interface 1 to GE 2/0/0.100.

    [~DeviceA] interface gigabitethernet 2/0/0.100
    [*DeviceA-GigabitEthernet2/0/0.100] pppoe-server bind virtual-template 1
    [*DeviceA-GigabitEthernet2/0/0.100] user-vlan 1 100
    [*DeviceA-GigabitEthernet2/0/0.100-vlan-1-100] commit
    [~DeviceA-GigabitEthernet2/0/0.100-vlan-1-100] quit

    # Configure a BAS interface.

    [~DeviceA-GigabitEthernet2/0/0.100] bas
    [*DeviceA-GigabitEthernet2/0/0.100-bas] access-type layer2-subscriber
    [*DeviceA-GigabitEthernet2/0/0.100-bas] authentication-method ppp
    [*DeviceA-GigabitEthernet2/0/0.100-bas] commit
    [~DeviceA-GigabitEthernet2/0/0.100-bas] quit
    [~DeviceA-GigabitEthernet2/0/0.100] quit

    # Create a VPN instance.

    [~DeviceA] ip vpn-instance vrf1
    [*DeviceA-vpn-instance-vrf1] route-distinguisher 100:1
    [*DeviceA-vpn-instance-vrf1] vpn-target 100:1 both
    [*DeviceA-vpn-instance-vrf1] commit
    [~DeviceA-vpn-instance-vrf1] quit
    [~DeviceA] ip vpn-instance vrf2
    [*DeviceA-vpn-instance-vrf2] route-distinguisher 100:2
    [*DeviceA-vpn-instance-vrf2] vpn-target 100:2 both
    [*DeviceA-vpn-instance-vrf2] commit
    [~DeviceA-vpn-instance-vrf2] quit

    # Create the loopback interface.

    [~DeviceA] interface loopback0
    [*DeviceA-LoopBack0] ip binding vpn-instance vrf1
    [*DeviceA-LoopBack0] ip address 10.1.1.3 255.255.255.0
    [*DeviceA-LoopBack0] commit
    [~DeviceA-LoopBack0] quit
    [~DeviceA] interface loopback1
    [*DeviceA-LoopBack1] ip binding vpn-instance vrf2
    [*DeviceA-LoopBack1] ip address 10.2.1.3 255.255.255.0
    [*DeviceA-LoopBack1] commit
    [~DeviceA-LoopBack1] quit

    # Configure an L2TP group and related attributes of the L2TP group.

    [~DeviceA] l2tp enable
    [~DeviceA] l2tp-group lac1
    [*DeviceA-l2tp-lac1] tunnel name lac1
    [*DeviceA-l2tp-lac1] start l2tp ip 10.3.1.3
    [*DeviceA-l2tp-lac1] tunnel authentication
    [*DeviceA-l2tp-lac1] tunnel password simple 1qaz#EDC
    [*DeviceA-l2tp-lac1] tunnel source loopback0
    [*DeviceA-l2tp-lac1] commit
    [~DeviceA-l2tp-lac1] quit
    [~DeviceA] l2tp-group lac2
    [*DeviceA-l2tp-lac2] tunnel name lac2
    [*DeviceA-l2tp-lac2] start l2tp ip 10.4.1.3
    [*DeviceA-l2tp-lac2] tunnel authentication
    [*DeviceA-l2tp-lac2] tunnel password simple 1qaz#EDC
    [*DeviceA-l2tp-lac2] tunnel source loopback1
    [*DeviceA-l2tp-lac2] commit
    [~DeviceA-l2tp-lac2] quit

    # Configure the RADIUS server on LAC 1.

    [~DeviceA] radius-server group radius1
    [*DeviceA-radius-radius1] radius-server authentication 10.0.0.249 1812
    [*DeviceA-radius-radius1] radius-server accounting 10.0.0.249 1813
    [*DeviceA-radius-radius1] radius-server shared-key itellin
    [*DeviceA-radius-radius1] commit
    [~DeviceA-radius-radius1] quit

    # Configure the domain to which the user belongs on LAC 1.

    [~DeviceA] aaa
    [*DeviceA-aaa] domain isp1
    [*DeviceA-aaa-domain-isp1] l2tp-group lac1
    [*DeviceA-aaa-domain-isp1] radius-server group radius1
    [*DeviceA-aaa-domain-isp1] authentication-scheme default1
    [*DeviceA-aaa-domain-isp1] accounting-scheme default1
    [*DeviceA-aaa-domain-isp1] commit
    [~DeviceA-aaa-domain-isp1] quit
    [~DeviceA-aaa] domain isp2
    [*DeviceA-aaa-domain-isp2] l2tp-group lac2
    [*DeviceA-aaa-domain-isp2] radius-server group radius1
    [*DeviceA-aaa-domain-isp2] authentication-scheme default1
    [*DeviceA-aaa-domain-isp2] accounting-scheme default1
    [*DeviceA-aaa-domain-isp2] commit
    [~DeviceA-aaa-domain-isp2] quit
    [~DeviceA-aaa] quit

  3. Configure DeviceB (the LNS side).

    # Create two VPN instances.

    [~DeviceB] ip vpn-instance vrf1
    [*DeviceB-vpn-instance-vrf1] route-distinguisher 100:1
    [*DeviceB-vpn-instance-vrf1] vpn-target 100:1 both
    [*DeviceB-vpn-instance-vrf1] commit
    [~DeviceB-vpn-instance-vrf1] quit
    [~DeviceB] ip vpn-instance vrf2
    [*DeviceB-vpn-instance-vrf2] route-distinguisher 100:2
    [*DeviceB-vpn-instance-vrf2] vpn-target 100:2 both
    [*DeviceB-vpn-instance-vrf2] commit
    [~DeviceB-vpn-instance-vrf2] quit

    # Create the loopback interface.

    [~DeviceB] interface loopback0
    [*DeviceB-LoopBack0] ip binding vpn-instance vrf1
    [*DeviceB-LoopBack0] ip address 10.3.1.3 255.255.255.0
    [*DeviceB-LoopBack0] commit
    [~DeviceB-LoopBack0] quit
    [*DeviceB] interface loopback1
    [*DeviceB-LoopBack1] ip binding vpn-instance vrf2
    [*DeviceB-LoopBack1] ip address 10.4.1.3 255.255.255.0
    [*DeviceB-LoopBack1] commit
    [~DeviceB-LoopBack1] quit

    # Create VT interface 1.

    [~DeviceB] interface virtual-template 1
    [*DeviceB-Virtual-Template1] ppp authentication-mode chap
    [*DeviceB-Virtual-Template1] commit
    [~DeviceB-Virtual-Template1] quit

    # Enable L2TP and configure L2TP groups.

    [~DeviceB] l2tp enable
    [~DeviceB] l2tp-group lns1
    [*DeviceB-l2tp-lns1] tunnel name lns1
    [*DeviceB-l2tp-lns1] allow l2tp virtual-template 1 remote lac1
    [*DeviceB-l2tp-lns1] tunnel authentication
    [*DeviceB-l2tp-lns1] tunnel password simple 1qaz#EDC
    [*DeviceB-l2tp-lns1] commit
    [~DeviceB-l2tp-lns1] quit
    [~DeviceB] l2tp-group lns2
    [*DeviceB-l2tp-lns1] tunnel name lns2
    [*DeviceB-l2tp-lns1] allow l2tp virtual-template 1 remote lac2
    [*DeviceB-l2tp-lns1] tunnel authentication
    [*DeviceB-l2tp-lns1] tunnel password simple 1qaz#EDC
    [*DeviceB-l2tp-lns1] commit
    [~DeviceB-l2tp-lns1] quit

    # Create LNS group 1, and bind the tunnel board and the interfaces to the LNS group.

    [~DeviceB] lns-group group1
    [*DeviceB-lns-group-group1] bind slot 1 
    [*DeviceB-lns-group-group1] bind source LoopBack0
    [*DeviceB-lns-group-group1] bind source LoopBack1
    [*DeviceB-lns-group-group1] commit
    [~DeviceB-lns-group-group1] quit

    # Configure the address pool used to assign addresses to users.

    [~DeviceB] ip pool pool1 bas local
    [*DeviceB-ip-pool-pool1] gateway 192.168.0.1 255.255.255.0
    [*DeviceB-ip-pool-pool1] section 0 192.168.0.10 192.168.0.100
    [*DeviceB-ip-pool-pool1] commit
    [~DeviceB-ip-pool-pool1] quit
    [~DeviceB] ip pool pool2 bas local
    [*DeviceB-ip-pool-pool2] gateway 172.30.0.1 255.255.255.0
    [*DeviceB-ip-pool-pool2] section 0 172.30.0.10 172.30.0.100
    [*DeviceB-ip-pool-pool2] commit
    [~DeviceB-ip-pool-pool2] quit

    # Configure the RADIUS server.

    [~DeviceB] radius-server group radius1
    [*DeviceB-radius-radius1] radius-server authentication 20.20.20.1 1812
    [*DeviceB-radius-radius1] radius-server accounting 20.20.20.1 1813
    [*DeviceB-radius-radius1] radius-server shared-key itellin
    [*DeviceB-radius-radius1] commit
    [~DeviceB-radius-radius1] quit

    # Configure the domain to which the user belongs.

    [~DeviceB] aaa
    [*DeviceB-aaa] domain isp1
    [*DeviceB-aaa-domain-isp1] radius-server group radius1
    [*DeviceB-aaa-domain-isp1] authentication-scheme default1
    [*DeviceB-aaa-domain-isp1] accounting-scheme default1
    [*DeviceB-aaa-domain-isp1] ip-pool pool1
    [*DeviceB-aaa-domain-isp1] commit
    [~DeviceB-aaa-domain-isp1] quit
    [~DeviceB-aaa] domain isp2
    [*DeviceB-aaa-domain-isp2] radius-server group radius1
    [*DeviceB-aaa-domain-isp2] authentication-scheme default1
    [*DeviceB-aaa-domain-isp2] accounting-scheme default1
    [*DeviceB-aaa-domain-isp2] ip-pool pool2
    [*DeviceB-aaa-domain-isp2] commit
    [~DeviceB-aaa-domain-isp2] quit
    [~DeviceB-aaa] quit

  4. Verify the configuration

    # The route for the interface of the tunnel linking the LAC to the LNS must be reachable.

    [~DeviceA] ping -vpn-instance vrf1 10.3.1.3
    PING 10.3.1.3: 56  data bytes, press CTRL_C to break                           
        Reply from 10.3.1.3: bytes=56 Sequence=1 ttl=255 time=12 ms                  
        Reply from 10.3.1.3: bytes=56 Sequence=2 ttl=255 time=10 ms                  
        Reply from 10.3.1.3: bytes=56 Sequence=3 ttl=255 time=5 ms                   
        Reply from 10.3.1.3: bytes=56 Sequence=4 ttl=255 time=8 ms                   
                                                                                    
      --- 10.3.1.3 ping statistics ---                                               
        4 packet(s) transmitted                                                     
        4 packet(s) received                                                        
        0.00% packet loss                                                           
        round-trip min/avg/max = 5/8/12 ms                           
    [~DeviceA] ping -vpn-instance vrf2 10.4.1.3
    PING 10.4.1.3: 56  data bytes, press CTRL_C to break                           
        Reply from 10.4.1.3: bytes=56 Sequence=1 ttl=255 time=12 ms                  
        Reply from 10.4.1.3: bytes=56 Sequence=2 ttl=255 time=10 ms                  
        Reply from 10.4.1.3: bytes=56 Sequence=3 ttl=255 time=5 ms                   
        Reply from 10.4.1.3: bytes=56 Sequence=4 ttl=255 time=8 ms                   
                                                                                    
      --- 10.4.1.3 ping statistics ---                                               
        4 packet(s) transmitted                                                     
        4 packet(s) received                                                        
        0.00% packet loss                                                           
        round-trip min/avg/max = 5/8/12 ms                           

    # The L2TP user can go online normally.

Configuration Files

  • Configuration file of DeviceA

    #
     sysname DeviceA
    #
     mpls lsr-id 1.1.1.9
     mpls
      lsp-trigger all
    #
    mpls ldp
    #
    radius-server group radius1
     radius-server authentication 10.0.0.249 1812 
     radius-server accounting 10.0.0.249 1813 
     radius-server shared-key itellin
    #
    ip vpn-instance vrf1
    route-distinguisher 100:1
     vpn-target 100:1 export-extcommunity
     vpn-target 100:1 import-extcommunity
    #
    ip vpn-instance vrf2
    route-distinguisher 200:1
     vpn-target 200:1 export-extcommunity
     vpn-target 200:1 import-extcommunity
    #
    l2tp-group lac1
     tunnel password simple 1qaz#EDC
     tunnel name lac1
     start l2tp ip 10.3.1.3
     tunnel source LoopBack0
    l2tp-group lac2
     tunnel password simple 1qaz#EDC
     tunnel name lac2
     start l2tp ip 10.4.1.3
     tunnel source LoopBack1
    #
    aaa
    domain isp1
      authentication-scheme default1
      accounting-scheme default1
      radius-server group radius1
      l2tp-group lac1
    domain isp2
      authentication-scheme default1
      accounting-scheme default1
      radius-server group radius1
      l2tp-group lac2
    #
    interface Virtual-Template1
    ppp authentication-mode chap
    #
    interface GigabitEthernet2/0/0
     undo shutdown 
    #
    interface GigabitEthernet2/0/0.100
     undo shutdown
     pppoe-server bind Virtual-Template 1
     user-vlan 1 100
     bas
      access-type layer2-subscriber
    #
    interface GigabitEthernet3/0/0
     undo shutdown
    ip address 172.16.1.1 255.255.255.0
     mpls
     mpls ldp
    #
    interface LoopBack0
     ip binding vpn-instance vrf1
     ip address 10.1.1.3 255.255.255.0
    #
    interface LoopBack1
     ip binding vpn-instance vrf2
     ip address 10.2.1.3 255.255.255.0
    #
    interface LoopBack2
     ip address 1.1.1.9 255.255.255.255
    #
    bgp 100
     peer 2.2.2.9 as-number 100
     peer 2.2.2.9 connect-interface LoopBack2
    #
     ipv4-family unicast
      undo synchronization
      peer 2.2.2.9 enable
    #
     ipv4-family vpnv4
      policy vpn-target
      peer 2.2.2.9 enable
     #
     ipv4-family vpn-instance vrf1
      import-route direct
      import-route unr
     #
     ipv4-family vpn-instance vrf2
      import-route direct
      import-route unr
    #
    ospf 1
     area 0.0.0.0
      network 172.16.1.0 0.0.0.255
      network 1.1.1.9 0.0.0.0
    #
    return
  • Configuration file of Device B

    #
     sysname DeviceB
    #
     mpls lsr-id 2.2.2.9
     mpls
      lsp-trigger all
    #
    mpls ldp
    #
    radius-server group radius1
     radius-server authentication 20.20.20.1 1812 
     radius-server accounting 20.20.20.1 1813 
     radius-server shared-key itellin
    #
    ip vpn-instance vrf1
    route-distinguisher 100:1
     vpn-target 100:1 export-extcommunity
     vpn-target 100:1 import-extcommunity
    #
    ip vpn-instance vrf2
    route-distinguisher 100:2
     vpn-target 100:2 export-extcommunity
     vpn-target 100:2 import-extcommunity
    #
    l2tp-group lns1
     allow l2tp virtual-template 1 remote lac1
     tunnel password simple 1qaz#EDC
     tunnel name lns1
    #
    l2tp-group lns2
     allow l2tp virtual-template 1 remote lac2
     tunnel password simple 1qaz#EDC
     tunnel name lns2
    #
    lns-group group1
     bind slot 1 
     bind source LoopBack0
     bind source LoopBack1
    #
    ip pool pool1 bas local
     gateway 192.168.0.1 255.255.255.0
     section 0 192.168.0.10 10.10.0.100
    #
    ip pool pool2  bas local
     gateway 172.30.0.1 255.255.255.0
     section 0 172.30.0.10 10.10.0.100
    #
    aaa
    domain  isp1
      radius-server group  radius1
      authentication-scheme   default1
      accounting-scheme   default1
      ip-pool pool1
    domain  isp2
      radius-server group  radius1
      authentication-scheme   default1
      accounting-scheme   default1
      ip-pool pool2
    #
    interface LoopBack0
     ip binding vpn-instance vrf1
     ip address 10.3.1.3 255.255.255.0
    #
    interface LoopBack1
     ip binding vpn-instance vrf2
     ip address 10.4.1.3 255.255.255.0
    #
    interface LoopBack2
     ip address 2.2.2.9 255.255.255.255
    #
    interface Virtual-Template1
    ppp authentication-mode chap
    #
    interface GigabitEthernet3/0/0
     undo shutdown
     ip address 172.17.1.2 255.255.255.0
      mpls
     mpls ldp
    #
    bgp 100
     peer 1.1.1.9 as-number 100
     peer 1.1.1.9 connect-interface LoopBack2
     #
     ipv4-family unicast
      undo synchronization
      peer 1.1.1.9 enable
     #
     ipv4-family vpnv4
      policy vpn-target
      peer 1.1.1.9 enable
     #
     ipv4-family vpn-instance vrf1
      import-route direct
      import-route unr
     #
     ipv4-family vpn-instance vrf2
      import-route direct
      import-route unr
    #
    ospf 1
     area 0.0.0.0
      network 172.17.1.0 0.0.0.255
      network 2.2.2.9 0.0.0.0
    #
    return
Translation
Download
Updated: 2019-01-03

Document ID: EDOC1100055031

Views: 19355

Downloads: 85

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next