华为对l2tp创建ip安全策略

华为设备可以通过以下步骤来创建L2TP/IPSec VPN的IP安全策略：

1. 创建防火墙策略：

firewall name fw1
rule 10 permit udp source 0.0.0.0 0 destination 0.0.0.0 0 destination-port eq 1701
rule 20 permit udp source 0.0.0.0 0 destination 0.0.0.0 0 destination-port eq isakmp
rule 30 permit esp
rule 40 permit ah

2. 创建IKE策略：

ike proposal ike1
encryption-algorithm aes-cbc 256
authentication-algorithm sha2-256
dh group14
sa duration 86400

ike peer ipsec1
pre-shared-key huawei@123
proposal ike1
nat traversal keepalive 20 on-demand

3. 创建IPSec策略：

ipsec proposal ipsec1
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-cbc 256
pfs group14
sa duration 86400

ipsec policy ipsec1 isakmp
proposal ipsec1

4. 创建L2TP协议模板：

l2tp tunnel-template tunnel1
l2tp authentication local
l2tp remote-ip 0.0.0.0
l2tp hello interval 30
l2tp retransmit retry 3
l2tp max-retransmit-time 60
l2tp enable fast-retransmit
l2tp ipsec policy ipsec1

5. 创建LNS实例：

l2tp-group lns1
undo tunnel authentication
tunnel password huawei@123
tunnel-template tunnel1
l2tp default-domain example.com
l2tp-access-type user
l2tp-access-user test password encrypted huawei@123

6. 配置LNS实例与接口：

interface Virtual-Template1
l2tp-group lns1
ip address 192.168.1.1 255.255.255.0

这样就可以成功创建L2TP/IPSec VPN的IP安全策略。