H3C F1000配置（生产环境）

trrtrtrt

<N606FW>dis cu
#
version 5.20, Release 3721P06
#
sysname N606FW
#
l2tp enable
#
undo voice vlan mac-address 00e0-bb00-0001
#
domain default enable system
#
ipv6
#
telnet server enable
#
undo ip http port 8888
#
undo alg dns
undo alg rtsp
undo alg h323
undo alg sip
undo alg sqlnet
undo alg pptp
undo alg ils   
undo alg nbt
undo alg msn
undo alg qq
undo alg tftp
undo alg sccp
undo alg gtp
#
inline-interfaces 1
#
acl number 2000
rule 0 permit source 192.168.16.131 0
rule 1 permit source 192.168.16.132 0
rule 2 permit source 192.168.16.133 0
rule 3 permit source 192.168.16.134 0
rule 4 permit source 192.168.16.135 0
rule 5 permit source 192.168.16.136 0
rule 6 permit source 192.168.16.137 0
rule 7 permit source 192.168.16.138 0
rule 8 permit source 192.168.16.139 0
rule 9 permit source 192.168.16.140 0
rule 10 permit source 192.168.16.141 0
rule 11 permit source 192.168.16.142 0
rule 12 permit source 192.168.16.143 0
rule 13 permit source 192.168.16.144 0
rule 14 permit source 192.168.16.145 0
rule 15 permit source 192.168.16.146 0
rule 16 permit source 192.168.16.162 0
rule 17 permit source 192.168.16.11 0
acl number 2001
rule 0 permit source 192.168.100.0 0.0.0.255
rule 1 deny
#
acl number 3333
rule 0 permit ip source 192.168.0.250 0
#
vlan 1
#
vlan 502
#
vlan 600 to 601
#
vlan 801
description 录播
#
vlan 805
description guanli
#
domain system
authentication ppp local
access-limit disable
state active
idle-cut disable
self-service-url disable
ip pool 1 192.168.100.131 192.168.100.145
#
pki domain default
crl check disable
#
user-group system
group-attribute allow-guest
#
local-user admin
password cipher $c$3$V66rDBQOusX12iu+1NhZFWrpKXKBQz1YVOLA0ONYZaZME/94=
authorization-attribute level 3
service-type ssh telnet
service-type web
local-user nic
password cipher $c$3$+J2PnuZQlX4//QJe4c/HbvBxGFFihUhLQKA+UF6EcNc8=
service-type ppp
#
ssl server-policy default
pki-domain default
ssl server-policy access-policy
pki-domain default
#
l2tp-group 1
undo tunnel authentication
allow l2tp virtual-template 0
tunnel name nic
#
interface Virtual-Template0
ppp authentication-mode chap domain system
remote address pool 1
ip address 192.168.100.254 255.255.255.128
#
interface NULL0
#
interface Vlan-interface1
nat outbound 2000
ip address 192.168.100.11 255.255.255.128
#
interface Vlan-interface601
#
interface Vlan-interface805
description guanli
shutdown
ip address 192.168.252.10 255.255.255.252
#
interface GigabitEthernet0/0
port link-mode route
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet0/1
port link-mode route
#
interface GigabitEthernet0/5
port link-mode route
#
interface GigabitEthernet0/6
port link-mode route
#
interface GigabitEthernet0/7
port link-mode route
#
interface GigabitEthernet0/8
port link-mode route
#
interface GigabitEthernet0/9
port link-mode route
#
interface GigabitEthernet0/10
port link-mode route
#
interface GigabitEthernet0/11
port link-mode route
#
interface GigabitEthernet0/2
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 502 600 to 601 801 805
combo enable fiber
speed 1000
duplex full
port inline-interfaces 1
#
interface GigabitEthernet0/3
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 600 to 601 801
speed 1000
duplex full
port inline-interfaces 1
#
interface GigabitEthernet0/4
port link-mode bridge
description 8080
port link-type trunk
port trunk permit vlan 1 502 600 to 601 805
combo enable fiber
#
ssl-vpn server-policy access-policy
#
ip route-static 0.0.0.0 0.0.0.0 192.168.100.112
ip route-static 192.168.100.128 255.255.255.128 192.168.100.112
ip route-static 192.168.100.133 255.255.255.255 192.168.100.112
#
info-center source FILTER channel 1 log state off
info-center loghost 192.168.100.45
undo info-center enable
#
snmp-agent
snmp-agent local-engineid 800063A2030CDA41B211187
snmp-agent community read public
snmp-agent sys-info version all
#
ssh server enable
#
ip https ssl-server-policy default
ip https enable
#
load xml-configuration
#
user-interface con 0
user-interface vty 0 4
authentication-mode scheme
#
return

zhangxiajun

谢谢分享

mayiwen123456

L2TP
#设置用户名及口令：
local-user nic
password cipher $c$3$+J2PnuZQlX4//QJe4c/HbvBxGFFihUhLQKA+UF6EcNc8=
service-type ppp
#对VPN用户采用本地验证：

domain system
authentication ppp local
ip pool 1 192.168.100.131 192.168.100.145

#启用L2TP服务，并设置一个L2TP组
l2tp enable

l2tp-group 1

#配置虚拟模板

interface Virtual-Template0
ip address 192.168.100.254 255.255.255.128
ppp authentication-mode chap domain system
remote address pool 1

#配置LNS侧接收的通道,并取消验证
l2tp-group 1
allow l2tp virtual-template 0
undo  tunnel authentication
tunnel name nic

mayiwen123456

ssl server-policy default  #创建一个名为default的SSL服务端策略
pki-domain default  #域名随意
ip https ssl-server-policy default   #配置HTTPS服务使用的SSL服务器端策略关联，并使能HTTPS
ip https enable

ssl server-policy access-policy  #建立SSL PKI域access-police名字随意
pki-domain default  #域名字随意
ssl-vpn server-policy access-policy #SSL VPN 调用SSL PKI域access-police

ppa

好东西啊  就在等这个东西