В данной статье приведен пример настройки сервера и клиента L2TP с шифрованием IPSec(L2TP over IPSec), при подключении клиента L2TP к серверу происходит отправка запроса на аутентификацию и дальнейшую авторизацию данного запроса на FreeRADIUS.

Конфигурация сервера L2TP
object-group service ISAKMP
  port-range 500
  port-range 4500
exit
object-group service L2TP
  port-range 1701
exit

radius-server host 192.168.0.1
  key ascii-text <password_radius>
exit

system fan-speed auto

security zone untrusted
exit
security zone VPN
exit
security zone trusted
exit

interface gigabitethernet 1/0/1
  description "WAN"
  security-zone untrusted
  ip address 192.0.2.1/30
exit
interface gigabitethernet 1/0/2
  description "to_RADIUS"
  security-zone trusted
  ip address 192.168.0.10/24
exit
security zone-pair untrusted self
  rule 10
    action permit
    match protocol udp
    match destination-port object-group ISAKMP
    enable
  exit
  rule 20
    action permit
    match protocol udp
    match destination-port object-group L2TP
    enable
  exit
  rule 30
    action permit
    match protocol esp
    enable
  exit
  rule 40
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair trusted self
  rule 1
    action permit
    enable
  exit
exit
security zone-pair VPN self
  rule 1
    action permit
    enable
  exit
exit

remote-access l2tp L2TP_VPN
  authentication mode radius
  authentication method mschap-v2
  local-address ip-address 172.16.1.1
  outside-address ip-address 192.0.2.1
  security-zone VPN
  ipsec authentication method pre-shared-key
  ipsec authentication pre-shared-key ascii-text <password>
  enable
exit

ip route 0.0.0.0/0 192.0.2.2

esr# sh security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
L2TP_VPN(L2TP)                    192.0.2.1         192.0.2.2         0xdbc485f02a918a8b   0xf35f68db78152b34   Established   

esr# sh remote-access status l2tp 
User               IP-address        Server                                   
----------------   ---------------   --------------------------------------   
<username>           172.16.1.2        l2tp(L2TP_VPN)                           
Count sessions: 1

После отправки клиентом L2TP запроса на установку VPN по протоколу L2TP over IPSec изначально устанавливается IPSec соединение между сервером L2TP и клиентом L2TP. Далее с сервера L2TP отправляется запрос на RADIUS для согласования аутентификации  учётных данных клиента L2TP. Включение режима аутентификации с помощью RADIUS производится командой authentication mode radius в конфигурации remote-access l2tp L2TP_VPN.

Конфигурация клиента L2TP
security zone untrusted
exit

interface gigabitethernet 1/0/1
  security-zone untrusted
  ip address 192.168.100.1/30
exit
tunnel l2tp 1
  ip firewall disable
  authentication method mschap-v2
  username l2tptest password ascii-text encrypted 8CB5107EA7005AFF
  remote address 192.0.2.1
  ipsec authentication method pre-shared-key
  ipsec authentication pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
  enable
exit

security zone-pair untrusted self
  rule 1
    action permit
    enable
  exit
exit

ip route 0.0.0.0/0 192.168.100.2

esr# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
l2tp_1(L2TP)                      192.168.100.1     192.0.2.1         0xa6c2aa9c2efe5a7a   0xb52ae197fc0c5eaa   Established   
 
esr# sh tunnels status l2tp
Tunnel             Admin   Link    MTU      Local IP           Remote IP          Last change                 
                   state   state                                                                              
----------------   -----   -----   ------   ----------------   ----------------   -------------------------   
l2tp 1             Up      Up      1500     172.16.1.2         172.16.1.1         13 minutes and 24 seconds
Пример минимальной конфигурации RADIUS
root@comp:~# cat /etc/freeradius/users 
<username> Cleartext-Password := "<password>"
        Framed-IP-Address = 172.16.1.2,
        Framed-Protocol == PPP

root@comp:~# cat /etc/freeradius/clients.conf
client 192.168.0.10 {
    secret = <password_radius>
    shortname = esr
    }

Проверка с помощью Wireshark успешной аутентификации и авторизации на Radius: