l2tp+ipsec(netscreen)

wzknet@hotmail.com http://k968888.blog.sohu.com

Juniper NetScreen ISG

Juniper NetScreen ISGJuniper NetScreen ISG

Juniper NetScreen ISG-

--

-1000

1000 1000

1000

Remote

RemoteRemote

Remote-

--

-VPN

VPNVPN

VPN(

((

(L2TP OVER IPSEC

及后续问题分析处理及后续问题分析处理

及后续问题分析处理指

南南

南

由

由由

由 wzknet@hotmail.com

wzknet@hotmail.comwzknet@hotmail.com

wzknet@hotmail.com 原创

原创原创

原创

IP (0.0.0.0)

IP (0.0.0.0)IP (0.0.0.0)

IP (0.0.0.0)

Software Version: 5.3.0r10.0, Type:

Software Version: 5.3.0r10.0, Type:Software Version: 5.3.0r10.0, Type:

Software Version: 5.3.0r10.0, Type: Firewall+VPN

Firewall+VPN Firewall+VPN

Firewall+VPN

NetScreen

NetScreenNetScreen

NetScreen-

--

-Remote

RemoteRemote

Remote：

：：

：SafeNet SoftRemote 8.0.0 (Build 14)

SafeNet SoftRemote 8.0.0 (Build 14)SafeNet SoftRemote 8.0.0 (Build 14)

SafeNet SoftRemote 8.0.0 (Build 14)

以下为

以下为以下为

以下为 NetScreen ISG

NetScreen ISGNetScreen ISG

NetScreen ISG-

--

-1000

：：

：

set ippool "VPN_SZ_POOL" 11.2.1.1 11.2.4.254

set ippool "VPN_SZ_POOL" 11.2.1.1 11.2.4.254set ippool "VPN_SZ_POOL" 11.2.1.1 11.2.4.254

set ippool "VPN_SZ_POOL" 11.2.1.1 11.2.4.254

定义

定义定义

定义 L2TP+IKE User

L2TP+IKE UserL2TP+IKE User

L2TP+IKE User：

：：

：

WebUI：

wzknet@hotmail.com http://k968888.blog.sohu.com

CLI：

set user "l2tpoveripsec" ike

set user "l2tpoveripsec" ikeset user "l2tpoveripsec" ike

set user "l2tpoveripsec" ike-

--

-id fqdn "www.l2tpoveripsec.c

id fqdn "www.l2tpoveripsec.cid fqdn "www.l2tpoveripsec.c

id fqdn "www.l2tpoveripsec.com" share

om" shareom" share

om" share-

--

-limit 1

limit 1limit 1

limit 1

set user "l2tpoveripsec" type ike l2tp

set user "l2tpoveripsec" type ike l2tpset user "l2tpoveripsec" type ike l2tp

set user "l2tpoveripsec" type ike l2tp

set user "l2tpoveripsec" "enable"

set user "l2tpoveripsec" "enable"set user "l2tpoveripsec" "enable"

set user "l2tpoveripsec" "enable"

定义

定义定义

定义 L2TPOVERIPSEC

L2TPOVERIPSEC L2TPOVERIPSEC

L2TPOVERIPSEC 用户组

：：

：

WebUI：

CLI：

set user

set userset user

set user-

--

-grou

grougrou

group "l2tpoveripsecusergroup" user "l2tpoveripsec

p "l2tpoveripsecusergroup" user "l2tpoveripsecp "l2tpoveripsecusergroup" user "l2tpoveripsec

p "l2tpoveripsecusergroup" user "l2tpoveripsec"

""

"

wzknet@hotmail.com http://k968888.blog.sohu.com

CLI：

set l2tp default dns1 202.96.128.68

set l2tp default dns1 202.96.128.68set l2tp default dns1 202.96.128.68

set l2tp default dns1 202.96.128.68

定义

定义定义

定义 L2TP

L2TPL2TP

L2TP-

WebUI：

CLI：

set l2tp "l2tpoveripsectunnel" remoteset l2tp "l2tpoveripsectunnel" remote

--

set l2tp "l2tpoveripsectunnel" auth server "Local" user

set l2tp "l2tpoveripsectunnel" auth server "Local" userset l2tp "l2tpoveripsectunnel" auth server "Local" user

set l2tp "l2tpoveripsectunnel" auth server "Local" user-

group "l2tpoveripsecusergroup"group "l2tpoveripsecusergroup"

group "l2tpoveripsecusergroup"

wzknet@hotmail.com http://k968888.blog.sohu.com

CLI：

set address "Trust" "

set address "Trust" "set address "Trust" "

set address "Trust" "l

addraddr

addr" 10.245.

33.1033.10

33.10 255.255.255.255

255.255.255.255 255.255.255.255

255.255.255.255

接着点击 Advanced，进入以下配置界面：

wzknet@hotmail.com http://k968888.blog.sohu.com

CLI：

set ike gateway "l2tpoveripsecgateway" dialup "l2tpoveripsecusergroup" Aggr

set ike gateway "l2tpoveripsecgateway" dialup "l2tpoveripsecusergroup" Aggr set ike gateway "l2tpoveripsecgateway" dialup "l2tpoveripsecusergroup" Aggr

set ike gateway "l2tpoveripsecgateway" dialup "l2tpoveripsecusergroup" Aggr

定义

定义定义

定义 AutoKey IKE

AutoKey IKEAutoKey IKE

AutoKey IKE：

WebUI：

接着点击 Advanced，进入以下配置界面：