L2TP for Remote Dial-Up Users over two ISP
Created: Mar 27, 2021 22:24:43Latest reply: Mar 30, 2021 01:21:59
508
12
0
0
0
HiCoins as reward：
0
(problem unresolved)
Hello!
I'm working on configuration L2TP on my AR651 Huawei router. I have two ISPs and I want the router to accepts L2TP connection on both interfaces toward my ISPs. I decided to make a VPN instance to separate l2tp groups. But the problem is that I can set vpn-instance param in l2tp-group section only if I've set remote param (which means my client's hostname). It works for branch to main office scheme, but not for remote connecting users. Is there any way to solve this problem?
- x
- convention：
- Emotion(0)
Featured Answers
VolanD
Created Mar 29, 2021 07:43:44
(0)
(0)
But I cannot use the same l2tp-group for two ISP connections. My plan was to put them in two different vpn-instances. If I use l2tp-group 1 I don't need remote name in my configuration. And it probably works for global routing-table. But what about the second l2tp-group in separated vpn-instance? I must set remote name param becouse the allow command format: allow l2tp virtual-template virtual-template-number [ remote remote-name [ vpn-instance vpn-instance-name ] ]
VolanD
Reply chenhui Created Mar 29, 2021 09:08:25
(0)
(0)
If I have two public IP addresses (for instance: XX.XX.XX.XX for ISP1 and YY.YY.YY.YY for ISP2) I must add a default route to my configuration to make moblie users access to the router. I cannot have two default routers in global routing-table. So if I want to use both ISP connections I have to separate the routing tables. |
All Answers
VolanD
Created Mar 28, 2021 11:45:15
(0)
(0)
Thank you for your reply. But unfortunally this is not my case. In my network I don't have L2TP client routers, only users PC connecting to LNS via two ISPs. My plan was to put l2tp-groups in two separatied vpn-instances. And it works if I use client's hostname as remote param in l2tp-group allow section. But in real life I have many clients with different hostnames. That means I cannot use l2tp-group in separated VPNs for remote clients, only if I have predicated L2TP client routers. |
VolanD
Created Mar 29, 2021 07:43:44
(0)
(0)
But I cannot use the same l2tp-group for two ISP connections. My plan was to put them in two different vpn-instances. If I use l2tp-group 1 I don't need remote name in my configuration. And it probably works for global routing-table. But what about the second l2tp-group in separated vpn-instance? I must set remote name param becouse the allow command format: allow l2tp virtual-template virtual-template-number [ remote remote-name [ vpn-instance vpn-instance-name ] ]
VolanD
Reply chenhui Created Mar 29, 2021 09:08:25
(0)
(0)
If I have two public IP addresses (for instance: XX.XX.XX.XX for ISP1 and YY.YY.YY.YY for ISP2) I must add a default route to my configuration to make moblie users access to the router. I cannot have two default routers in global routing-table. So if I want to use both ISP connections I have to separate the routing tables. |
VolanD
Created Mar 30, 2021 07:14:02
(0)
(0)
Hello! Thank you for yout reply! I've added a network diagram in my first message. I need default routes because I want my mobile users be able to connect to XX.XX.XX.XX or YY.YY.YY.YY. If I have two default routes in global table I face a situation when user connected to XX.XX.XX.XX receives a reply with source YY.YY.YY.YY (because of balancing). On the other hand, I can add a default route in vpn-instance, but I cannot bind l2tp-group with this vpn-instance then.
VolanD
Reply chenhui Created Mar 30, 2021 10:30:00
(0)
(0)
Because if I have two defaults in my configuration the router replies with XX.XX.XX.XX or YY.YY.YY.YY as a source address. AFAK huawei doesn't track users connection. In that case, user may initiate his l2tp on XX.XX.XX.XX address, but router (if it has two defaults) replies from the second interface YY.YY.YY.YY , then the user's l2tp client stops the connection.
|
Comment
Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
- Politically sensitive content
- Content concerning pornography, gambling, and drug abuse
- Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
