华为 SecPath 防火墙 通过ACL限制L2TP用户访问的

一、 组网需求：

PC1和PC2两个移动L2TP拨入到SecPath1000F上，分别获取不同的IP地址，通过ACL限制不同l2tp-group接入的用户实现控制。

二、 组网图

  

三、 配置步骤

SecPath1000F的主要配置

#                                                                               

 sysname Quidway                                                               

#                                                                              

 l2tp enable                                                    //启用L2TP     

#                                                                              

 firewall packet-filter enable                                                 

 firewall packet-filter default permit                                         

#                                                                              

 undo connection-limit enable                                                  

 connection-limit default deny                                                 

 connection-limit default amount upper-limit 50 lower-limit 20                 

#                                                                              

 firewall statistic system enable                                              

#                                                                               

radius scheme system                                                           

#                                                                              

domain aaa                                          //创建域aaa，分配地址1     

 ip pool 1 10.0.0.2 10.0.0.200                                                 

domain bbb                                          //创建域bbb，分配地址2    

 ip pool 2 10.0.1.2 10.0.1.200                                                 

domain system                                                                  

#                                                                              

local-user test                                             //创建L2TP帐户     

 password simple test                                                           

 service-type ppp                                                              

#                                                                              

acl number 3000                                                                 

 rule 0 deny ip source 10.0.0.2 0                                              

 rule 1 deny ip source 10.0.0.3 0                                              

 rule 2 deny tcp destination 192.168.1.99 0                                     

 rule 3 permit ip                                                              

#                                                                              

interface Virtual-Template1                                  //创建虚接口1     

 ppp authentication-mode chap domain aaa                                       

 ip address 10.0.0.1 255.255.255.0                                             

 remote address pool 1                                                         

 firewall packet-filter 3000 inbound                 //在虚接口下启用包过滤     

#                                                                              

interface Virtual-Template2                                  //创建虚接口2     

 ppp authentication-mode cin bbb                                               

 ip address 10.0.1.1 255.255.255.0                                             

 remote address pool 2                                                         

#                                                                               

interface Aux0                                                                 

 async mode flow                                                               

#                                                                               

interface GigabitEthernet0/0                                                   

 ip address 202.38.1.1 255.255.255.0                                           

#                                                                               

interface GigabitEthernet0/1                                                   

 ip address 192.168.1.1 255.255.255.0                                          

#                                                                              

interface GigabitEthernet1/0                                                   

#                                                                              

interface GigabitEthernet1/1                                                   

#                                                                               

interface Encrypt2/0                                                           

#                                                                              

interface NULL0                                                                 

#                                                                              

firewall zone local                                                            

 set priority 100                                                               

#                                                                              

firewall zone trust                                                            

 add interface GigabitEthernet0/1                                               

 set priority 85                                                               

#                                                                              

firewall zust                                                                   

 add interface GigabitEthernet0/0                                              

 add interface Virtual-Template1                                               

 add interface Virtual-Template2                                               

 set priority 5                                                                

#                                                                              

firewall zone DMZ                                                              

 set priority 50                                                               

#                                                                              

firewall interzone local trust                                                 

#                                                                              

firewall interzone local untrust                                               

#                                                                               

firewall interzone local DMZ                                                   

#                                                                              

firewall interzone trust untrust                                                

#                                                                              

firewall interzone trust DMZ                                                   

#                                                                               

firewall interzone DMZ untrust                                                 

#                                                                              

l2tp-group 1                                                //创建L2TP组1    

 undo tunnel authentication                                                    

 allow l2tp virtual-template 1 remote aaa domain aaa                           

#                                                                              

l2tp-group 2                                                //创建L2TP组2    

 undo tunnel authentication                                                    

 allow l2tp virtual-template 2 remote bbb domain bbb                           

#                                                                               

 ip route-static 0.0.0.0 0.0.0.0 202.38.1.2 preference 60                      

#

CCIE Security 2009 IOS防火墙合集