放开安全策略机制，FW1不配IP

[FW1]firewall zone  trust 	
[FW1-zone-trust]add interface GigabitEthernet 1/0/0
[FW1]security-policy 	
[FW1-policy-security]default action permit 

FW2 和FW3

[FW2]interface g1/0/1
[FW2-GigabitEthernet1/0/1]ip address 20.1.1.1 24	
[FW2]firewall zone trust 	
[FW2-zone-trust]add interface GigabitEthernet 1/0/0
[FW2]firewall zone untrust 
[FW2-zone-untrust]add interface  GigabitEthernet 1/0/1

[FW3]in g1/0/0
[FW3-GigabitEthernet1/0/0]ip address 20.1.1.2 24
[FW3]interface g1/0/1
[FW3-GigabitEthernet1/0/1]ip address 192.168.1.254 24
[FW3]firewall zone untrust 
[FW3-zone-untrust]add interface GigabitEthernet 1/0/0
[FW3]firewall zone trust 
[FW3-zone-trust]add interface GigabitEthernet 1/0/1

建立pppoe连接，设定拨号接口

client

[client]interface Dialer 1
[client-Dialer1]dialer user user1
[client-Dialer1]dialer-group 1	
[client-Dialer1]dialer bundle 1
[client-Dialer1]ip address ppp-negotiate 
[client-Dialer1]ppp chap user user1
[client-Dialer1]ppp chap password  cipher passwd123
[client]dialer-rule 1 ip permit
[client]interface g1/0/0
[client-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1]

server

[server]interface Virtual-Template 1
[server-Virtual-Template1]ppp authentication-mode chap 
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[server-Virtual-Template1]ip address  2.2.2.2 24
[server]interface g1/0/0	
[server-GigabitEthernet1/0/0]pppoe-server bind  virtual-template  1
[server]interface g1/0/0	
[server-GigabitEthernet1/0/0]pppoe-server bind  virtual-template  1
[server]aaa
[server-aaa]domain default 
[server-aaa-domain-default]service-type l2tp	
[server]user-manage user user1 domain default 
[server-localuser-user1]password Passwd123

建立L2tp隧道

1.LAC配置

[server]l2tp enable 
[server]l2tp-group 1
[server-l2tp-1]tunnel  authentication
[server-l2tp-1]tunnel  password cipher Hello123
[server-l2tp-1]tunnel name lac
[server-l2tp-1]start  l2tp ip 20.1.1.2 fullusername  user1

LNS配置

[LNS]ip pool l2tp
[LNS-ip-pool-l2tp]section 0 172.16.0.2 172.16.0.100
[LNS]aaa 	
[LNS-aaa]service-scheme l2tp
[LNS-aaa-service-l2tp]ip-pool l2tp
[LNS-aaa-domain-default]service-type l2tp 
[LNS]user-manage user user1 domain  default 
[LNS-localuser-user1]password Passwd123
[LNS]interface Virtual-Template 1	
[LNS-Virtual-Template1]ppp authentication-mode chap 
 The command is used to configure the PPP authentication mode on the local end. 
Confirm that the peer end adopts the corresponding PPP authentication. Continue[
Y/N]:y
[LNS]interface Virtual-Template 1
[LNS-Virtual-Template1]ip address 172.16.0.1 24
[LNS-Virtual-Template1]remote service-scheme l2tp	
[LNS]firewall zone dmz 
[LNS-zone-dmz]add interface Virtual-Template 1	
[LNS]l2tp enable 	
[LNS]l2tp-group 1
[LNS-l2tp-1]allow l2tp  virtual-template  1 remote lac domain de	
[LNS-l2tp-1]tunnel  authentication
[LNS-l2tp-1]tunnel password cipher Hello123
[LNS]l2tp-group 1	
[LNS-l2tp-1]mandatory-chap