Shulou(Shulou.com)06/01 Report--

Inter vlan 1

Nameif inside

Ip address 172.16.1.1 255.255.255.0

Inter vlan 2

Nameif outside

Ip address xx.xx.xx.xx 255.255.255.240

Inter eth 0/0

Switchport access vlan 1

No shutdown

Inter eth 0/1

Switchport access vlan 2

No shutdown

/ / basic configuration

Ip local pool l2tp-ipsec_address 192.168.1.1-192.168.1.10

/ / address pool for * * users

Access-list split extended permit ip host 172.17.1.9 any

/ / make a tunnel separation list, which has no effect in the actual test. Limit it with acl.

Group-policy l2tp-ipsec_policy internal / / define a group-policy

Group-policy l2tp-ipsec_policy attributes / / set the properties of group-policy

* *-tunnel-protocol l2tp-ipsec

/ / use as a tunnel separation list

Username cisco password cisco mschap / / create a user name and password and encryption method

Username cisco attributes / / define user attributes

* *-group-policy l2tp-ipsec_policy / / call group-policy

Tunnel-group DefaultRAGroup general-attributes / / configure l2tp over ipsec must use DefaultRAGroup, define general properties

Default-group-policy l2tp-ipsec_policy / / call group-policy

Address-pool l2tp-ipsec_address / / call address pool

Tunnel-group DefaultRAGroup ipsec-attributes / / define ipsec attribute

Pre-shared-key cisc0 / / configure pre-shared key

Tunnel-group DefaultRAGroup ppp-attributes / / defines the authentication method of ppp

No authentication pap

Authentication chap

Authentication ms-chap-v1

Authentication ms-chap-v2

Crypto isakmp policy 10 / / define the first stage tunnel

Authentication pre-share

Encryption 3des

Hash sha

Group 2

Lifetime 86400

Crypto ipsec transform-set trans esp-3des esp-sha-hmac

Crypto ipsec transform-set trans mode transport / / configuration l2tp must be configured as transport

Crypto dynamic-map dyno 10 set transform-set trans / / configuration dynamic encryption diagram

Crypto map * 65535 ipsec-isakmp dynamic dyno

Crypto map * interface outside

Crypto isakmp enable outside

If win7 cannot be dialed, please check whether the ike service is enabled. This example does not involve nat. In the nat environment, the nat of the host that needs to be accessed needs to be excluded.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.