Configuration example for client-initiated L2TP tunnel

As shown in Figure 31, a PPP user directly initiates a tunneling request to the LNS to access the corporate network.

1. Configure the LNS:

   # Configure IP addresses for the interfaces. (Details not shown.)

   # Configure the route between the LNS and the remote host. (Details not shown.)

   # Create a local user named vpdnuser, set the password, and enable the PPP service.

   [LNS] local-user vpdnuser class network
   [LNS-luser-network-vpdnuser] password simple Hello
   [LNS-luser-network-vpdnuser] service-type ppp
   [LNS-luser-network-vpdnuser] quit
   

   # Configure local authentication for PPP users in ISP domain system.

   [LNS] domain system
   [LNS-isp-system] authentication ppp local
   [LNS-isp-system] quit
   

   # Enable L2TP.

   [LNS] l2tp enable
   

   # Create a PPP address pool.

   [LNS] ip pool aaa 192.168.0.10 192.168.0.20
   [LNS] ip pool aaa gateway 192.168.0.1
   

   # Create Virtual-Template 1, specify its PPP authentication mode as CHAP, and use address pool aaa to assign IP addresses to the PPP users.

   [LNS] interface virtual-template 1
   [LNS-virtual-template1] ppp authentication-mode chap domain system
   [LNS-virtual-template1] remote address pool aaa
   [LNS-virtual-template1] quit
   

   # Create L2TP group 1 in LNS mode.

   [LNS] l2tp-group 1 mode lns
   

   # Configure the local tunnel name as LNS.

   [LNS-l2tp1] tunnel name LNS
   

   # Specify Virtual-Template 1 for receiving calls.

   [LNS-l2tp1] allow l2tp virtual-template 1
   

   # Disable tunnel authentication.

   [LNS-l2tp1] undo tunnel authentication
   

2. Configure the remote host:

   # Configure the IP address of the remote host as 2.1.1.1, and configure a route to the LNS (1.1.2.2).

   # Create a virtual private network connection by using the Windows system, or install the L2TP LAC client software, such as WinVPN Client.

   # Complete the following configuration procedure (the procedure depends on the client software):

   • Specify the PPP username as vpdnuser and the password as Hello.

   • Specify the Internet interface address of the security gateway as the IP address of the LNS. In this example, the Ethernet interface for the tunnel on the LNS has an IP address of 1.1.2.2.

   • Modify the connection attributes: set the protocol to L2TP, the encryption attribute to customized, and the authentication mode to CHAP.

# On the remote host, initiate the L2TP connection. After the connection is established, the remote host can obtain the IP address 192.168.0.10 and ping the private IP address of the LNS (192.168.0.1).

# On the LNS, use the display l2tp session command to check the established L2TP session.

[LNS-l2tp1] display l2tp session
LocalSID      RemoteSID      LocalTID      State
89            36245          10878         Established

# On the LNS, use the display l2tp tunnel command to check the established L2TP tunnel.

[LNS-l2tp1] display l2tp tunnel
LocalTID RemoteTID State         Sessions RemoteAddress    RemotePort RemoteName 
10878    21        Established   1        2.1.1.1          1701       PC