L2tp local verification and AAA verification under H3C Firewall

I Local Authentication
1 configure ip
[H3C] inter eth0/0
[H3C-Ethernet0/0] ip add 192.168.3.1 24
[H3C-Ethernet0/0] inter eth0/4
[H3C-Ethernet0/4] ip add 61.130.130.21 24
2 enable l2tp
[H3C] enable l2tp for l2tp
[H3C] domain system
[H3C-isp-system] ip pool 1 192.168.50.10 192.168.50.20 create an address pool
3. Create a local account
[H3C] local-user user1
A [H3C-luser-user1] password simple 123
[H3C-luser-user1] service-type ppp
4. Create a Virtual Interface
[H3C] inter Virtual-Template 0
[H3C-Virtual-Template0] ip address 192.168.50.5 24
[H3C-Virtual-Template0] ppp authentication-mode pap verification method is pap
[H3C-Virtual-Template0] remote address pool 1 assigns an ip address to the client as address pool 1
5. Create a group and allow l2tp
[H3C] l2tp-group 1
[H3C-l2tp1] mandatory-lcp
[H3C-l2tp1] allow l2tp virtual-template 0
[H3C-l2tp1] undo tunnel authentication
6 plus Area
H3C] firewall zone trust
[H3C-zone-trust] add inter eth0/0
[H3C] firewall zone untrust
[H3C-zone-untrust] add inter eth0/4
[H3C-zone-untrust] add inter Virtual-Template 0
7. Establish an l2tp connection on the client
To facilitate the test, we directly connect the client to the firewall, but cannot configure the gateway.
CloseIpsecTo modify the registry.(Shortcut KeyRegedit)
Add a DWORD file to HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ RasMan \ Parameters. The file name is ProhibitIPSec and the value is 1.
Create an l2tp network connection
<! -- [If! Vml] --> <! -- [Endif] -->
 

 
<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->
 

Open
<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

7Test
<! -- [If! Vml] --> <! -- [Endif] -->

 
<! -- [If! Vml] --> <! -- [Endif] -->
 

<! -- [If! Vml] --> <! -- [Endif] -->
 

 
 
II WithAAAServer Authentication
1. Firewall Configuration
[H3C] radius scheme l2tp creation scheme
[H3C-radius-l2tp] pri authentication 192.168.3.100 radius server address
[H3C-radius-l2tp] key authentication 123456 negotiate key
[H3C-radius-l2tp] accounting optional audit optional
[H3C-radius-l2tp] server-type standard server type standard
[H3C-radius-l2tp] user-name-format without-domain no domain access
[H3C] domain sytem
[H3C-isp-sytem] radius-scheme l2tp
[H3C-isp-sytem] accounting optional
[H3C-isp-sytem] access-limit enable 10
 
2 AAA Configuration
<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->

<! -- [If! Vml] --> <! -- [Endif] -->
 

Now, the test is successful, and you can try it out.