{"id":21635,"date":"2024-12-26T15:00:53","date_gmt":"2024-12-26T08:00:53","guid":{"rendered":"https:\/\/thegioifirewall.com\/?p=21185"},"modified":"2025-03-24T07:27:20","modified_gmt":"2025-03-24T07:27:20","slug":"huong-dan-cau-hinh-vpn-l2tp-tren-thiet-bi-tuong-lua-sophos-xgs","status":"publish","type":"post","link":"https:\/\/vacif.com\/en\/huong-dan-cau-hinh-vpn-l2tp-tren-thiet-bi-tuong-lua-sophos-xgs\/","title":{"rendered":"H\u01af\u1edaNG D\u1eaaN C\u1ea4U H\u00ccNH VPN L2TP TR\u00caN THI\u1ebeT B\u1eca T\u01af\u1edcNG L\u1eecA SOPHOS XGS"},"content":{"rendered":"\n

1.T\u1ed5ng quan<\/strong><\/p>\n\n\n\n

B\u00e0i vi\u1ebft n\u00e0y s\u1ebd h\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh t\u00ednh n\u0103ng L2TP VPN tr\u00ean thi\u1ebft b\u1ecb t\u01b0\u1eddng l\u1eeda Sophos XGS \u0111\u1ec3 truy c\u1eadp t\u1eeb xa v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9. Giao th\u1ee9c Layer Two Tunneling Protocol (L2TP) cho ph\u00e9p b\u1ea1n cung c\u1ea5p k\u1ebft n\u1ed1i \u0111\u1ebfn m\u1ea1ng c\u1ee7a m\u00ecnh th\u00f4ng qua c\u00e1c \u0111\u01b0\u1eddng h\u1ea7m ri\u00eang tr\u00ean Internet.<\/p>\n\n\n\n

2.Chi ti\u1ebft c\u1ea5u h\u00ecnh<\/strong><\/p>\n\n\n\n

\u0110\u1ea7u ti\u00ean ta s\u1ebd t\u1ea1o group VPN, b\u1eb1ng c\u00e1ch \u0111i \u0111\u1ebfn m\u1ee5c Authentication > Groups<\/strong>, ch\u1ecdn Add \u0111\u1ec3 t\u1ea1o 1 group m\u1edbi.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Group name*<\/strong>: ti\u1ebfn h\u00e0nh \u0111\u1eb7t t\u00ean<\/p>\n\n\n\n

Group type*<\/strong>: ch\u1ecdn Normal<\/strong><\/p>\n\n\n\n

Surfing quota*<\/strong>: ch\u1ecdn Unlimited Internet Access<\/strong><\/p>\n\n\n\n

Access time*<\/strong>: ch\u1ecdn Allowed all the time<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

C\u00e1c th\u00f4ng kh\u00e1c v\u1eabn gi\u1eef nguy\u00ean m\u1eb7c \u0111\u1ecbnh.<\/p>\n\n\n\n

Sau \u0111\u00f3 \u1ea5n Save<\/strong> \u0111\u1ec3 l\u01b0u l\u1ea1i.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Sau khi t\u1ea1o group vpn xong, ta s\u1ebd ti\u1ebfn h\u00e0nh t\u1ea1o user vpn \u0111\u1ec3 th\u00eam v\u00e0o group. B\u1eb1ng c\u00e1ch ch\u1ecdn Authentication > Users<\/strong>, ch\u1ecdn Add<\/strong> \u0111\u1ec3 t\u1ea1o user m\u1edbi.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Username*<\/strong>: ti\u1ebfn h\u00e0nh \u0111\u1eb7t username \u0111\u1ec3 \u0111\u0103ng nh\u1eadp<\/p>\n\n\n\n

Name*<\/strong>: \u0111\u1eb7t t\u00ean<\/p>\n\n\n\n

User type*<\/strong>: ch\u1ecdn User<\/p>\n\n\n\n

Password*<\/strong>: \u0110\u1eb7t m\u1eadt kh\u1ea9u cho t\u00e0i kho\u1ea3n user<\/p>\n\n\n\n

Email*<\/strong>: nh\u1eadp email c\u1ee7a b\u1ea1n<\/p>\n\n\n\n

Group*<\/strong>: Ch\u1ecdn group \u0111\u00e3 t\u1ea1o tr\u01b0\u1edbc \u0111\u00f3<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

C\u00e1c th\u00f4ng s\u1ed1 kh\u00e1c gi\u1eef nguy\u00ean m\u1eb7c \u0111\u1ecbnh, sau \u0111\u00f3 nh\u1ea5n Save.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

B\u00e2y gi\u1edd ta s\u1ebd v\u00e0o Remote access VPN<\/strong> > L2TP<\/strong> > sau \u0111\u00f3 ch\u1ecdn L2TP global settings.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

T\u00edch ch\u1ecdn Enable L2TP<\/strong><\/p>\n\n\n\n

Assign IP from*<\/strong>:  \u0111i\u1ec1n range DHCP s\u1ebd c\u1ea5p khi user th\u1ef1c hi\u1ec7n VPN <\/p>\n\n\n\n

Primary DNS server*<\/strong>:  \u0111i\u1ec1n th\u00f4ng tin DNS ch\u00ednh<\/p>\n\n\n\n

Secondary DNS server<\/strong>: \u0111i\u1ec1n th\u00f4ng tin DNS ph\u1ee5<\/p>\n\n\n\n

Sau \u0111\u00f3 \u1ea5n Add member<\/strong> \u0111\u1ec3 ti\u1ebfn h\u00e0nh add group VPN ho\u1eb7c user VPN<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Ch\u1ecdn group VPN \u0111\u00e3 t\u1ea1o tr\u01b0\u1edbc \u0111\u00f3, sau \u0111\u00f3 \u1ea5n Add.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u1ea4n Ok.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u1ea4n Close<\/strong> \u0111\u1ec3 tho\u00e1t.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Sau \u0111\u00f3 \u1ea5n Apply.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

V\u1eabn \u1edf m\u1ee5c Remote access VPN<\/strong>, tab L2TP<\/strong>, \u1ea5n Add.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Name*<\/strong>: \u0111\u1eb7t t\u00ean<\/p>\n\n\n\n

Profile*<\/strong>: ch\u1ecdn DefaultL2TP<\/strong><\/p>\n\n\n\n

Gateway type*<\/strong>: ch\u1ecdn Respond only <\/strong>(gi\u1eef k\u1ebft n\u1ed1i lu\u00f4n s\u1eb5n s\u00e0ng \u0111\u1ec3 ph\u1ea3n h\u1ed3i m\u1ecdi y\u00eau c\u1ea7u t\u1edbi)<\/p>\n\n\n\n

Authentication type*<\/strong>: ch\u1ecdn Preshared key <\/strong>(x\u00e1c th\u1ef1c \u0111i\u1ec3m cu\u1ed1i b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng kh\u00f3a b\u00ed m\u1eadt m\u00e0 c\u1ea3 2 \u0111i\u1ec3m cu\u1ed1i \u0111\u1ec1u bi\u1ebft)<\/p>\n\n\n\n

Preshared key*<\/strong>: \u0111i\u1ec1n m\u1eadt kh\u1ea9u <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Local WAN port*<\/strong>: ch\u1ecdn port WAN \u0111\u00f3ng vai tr\u00f2 tunnel<\/p>\n\n\n\n

Remote host*<\/strong>: \u0111\u1ecba ch\u1ec9 IP ho\u1eb7c hostname c\u1ee7a endpoint t\u1eeb xa. \u0110\u1ec3 ch\u1ec9 \u0111\u1ecbnh b\u1ea5t k\u1ef3 \u0111\u1ecba ch\u1ec9 IP n\u00e0o, b\u1ea1n c\u00f3 th\u1ec3 nh\u1eadp \u0111\u1ecba ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n (*).<\/p>\n\n\n\n

Allow NAT traversal<\/strong>: b\u1eadt NAT traversal n\u1ebfu c\u00f3 thi\u1ebft b\u1ecb NAT gi\u1eefa c\u00e1c endpoint c\u1ee7a b\u1ea1n<\/p>\n\n\n\n

Remote subnet*<\/strong>: \u0111\u1ec3 Any<\/strong> (m\u1ea1ng t\u1eeb xa m\u00e0 b\u1ea1n mu\u1ed1n c\u1ea5p quy\u1ec1n truy c\u1eadp)<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

C\u00e1c th\u00f4ng s\u1ed1 gi\u1eef nguy\u00ean m\u1eb7c \u0111\u1ecbnh, sau \u0111\u00f3 \u1ea5n Save.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Nh\u1ea5p v\u00e0o bi\u1ec3u t\u01b0\u1ee3ng m\u00e0u \u0111\u1ecf b\u00ean d\u01b0\u1edbi c\u1ed9t Active<\/strong> \u0111\u1ec3 b\u1eaft \u0111\u1ea7u k\u1ebft n\u1ed1i. Sau khi k\u1ebft n\u1ed1i, n\u00f3 s\u1ebd hi\u1ec3n th\u1ecb m\u00e0u xanh l\u00e1 c\u00e2y.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Ti\u1ebfp theo ta s\u1ebd thi\u1ebft l\u1eadp \u0111\u1ed9 \u01b0u ti\u00ean route, th\u1ee9 t\u1ef1 \u01b0u ti\u00ean m\u1eb7c \u0111\u1ecbnh l\u00e0 Static routes, SD-WAN policy routes, VPN routes<\/strong>. \u0110\u1ec3 thi\u1ebft l\u1eadp k\u1ebft n\u1ed1i L2TP, VPN routes<\/strong> ph\u1ea3i \u0111\u1ebfn tr\u01b0\u1edbc, ti\u1ebfp theo l\u00e0 Static routes<\/strong> v\u00e0 SD-WAN policy routes<\/strong> theo b\u1ea5t k\u1ef3 th\u1ee9 t\u1ef1 n\u00e0o.<\/p>\n\n\n\n

\u0110\u1ea7u ti\u00ean c\u1ea7n \u0111\u0103ng nh\u1eadp v\u00e0o CLI c\u1ee7a t\u01b0\u1eddng l\u1eeda. \u1ede giao di\u1ec7n web admin truy c\u1eadp v\u00e0o d\u1ea5u m\u0169i t\u00ean nh\u01b0 h\u00ecnh ch\u1ecdn Console.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Ti\u1ebfn h\u00e0nh nh\u1eadp password t\u01b0\u1eddng l\u1eeda.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Ch\u1ecdn m\u1ee5c s\u1ed1 4.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u1ede \u0111\u00e2y m\u00ecnh ta thi\u1ebft l\u1eadp \u0111\u1ed9 \u01b0u ti\u00ean r\u1ed3i. N\u1ebfu ch\u01b0a h\u00e3y d\u00f9ng l\u1ec7nh sau: <\/p>\n\n\n\n

system route_precedence set vpn static sdwan_policyroute <\/strong><\/p>\n\n\n\n

Sau \u0111\u00f3 d\u00f9ng l\u1ec7nh n\u00e0y \u0111\u1ec3 ki\u1ec3m tra l\u1ea1i:<\/p>\n\n\n\n

system route_precedence show<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Ti\u1ebfp theo ta s\u1ebd t\u1ea1o Firewall rule \u0111\u1ec3 cho ph\u00e9p k\u1ebft n\u1ed1i t\u1eeb VPN v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9. Ngo\u00e0i ra ta c\u0169ng c\u00f3 th\u1ec3 vi\u1ebft th\u00eam rule \u0111\u1ec3 cho ph\u00e9p theo chi\u1ec1u ng\u01b0\u1ee3c l\u1ea1i.<\/p>\n\n\n\n

\u0110i t\u1edbi Rules and policies<\/strong> > Firewall rules<\/strong>, ch\u1ecdn Add firewall rule<\/strong> r\u1ed3i ch\u1ecdn ti\u1ebfp New firewall rule<\/strong>.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Rule name*<\/strong>: \u0111\u1eb7t t\u00ean<\/p>\n\n\n\n

Action<\/strong>: ch\u1ecdn Accept<\/strong><\/p>\n\n\n\n

T\u00edch ch\u1ecdn Log firewall traffic<\/strong><\/p>\n\n\n\n

Rule possition<\/strong>: ch\u1ecdn Top<\/strong><\/p>\n\n\n\n

Rule group<\/strong>: ch\u1ecdn None<\/strong><\/p>\n\n\n\n

Source zones*: <\/strong>ch\u1ecdn zone VPN<\/strong><\/p>\n\n\n\n

Source network and devices*: <\/strong>ch\u1ecdn Any <\/strong>(c\u00f3 th\u1ec3 gi\u1edbi h\u1ea1n l\u1ea1i th\u00e0nh subnet m\u00ecnh mu\u1ed1n)<\/p>\n\n\n\n

During scheduled time: <\/strong>ch\u1ecdn All the time<\/strong><\/p>\n\n\n\n

Destination zone*: <\/strong>ch\u1ecdn zone LAN<\/strong><\/p>\n\n\n\n

Destination network*: <\/strong>ch\u1ecdn Any <\/strong>(c\u00f3 th\u1ec3 gi\u1edbi h\u1ea1n l\u1ea1i th\u00e0nh subnet m\u00ecnh mu\u1ed1n)<\/p>\n\n\n\n

Services: <\/strong>ch\u1ecdn Any<\/strong><\/p>\n\n\n\n

Sau \u0111\u00f3 \u1ea5n Save<\/strong> \u0111\u1ec3 l\u01b0u<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n

L\u01b0u \u00fd:<\/strong> N\u1ebfu b\u1ea1n mu\u1ed1n l\u1edbp m\u1ea1ng ng\u01b0\u1eddi d\u00f9ng VPN c\u00f3 th\u1ec3 truy c\u1eadp Internet th\u00f4ng qua thi\u1ebft b\u1ecb Firewall th\u00ec t\u1ea1o 1 Firewall rule v\u1edbi Source zones* l\u00e0 VPN v\u00e0 Destination zone* l\u00e0 WAN. <\/p>\n\n\n\n

V\u00e0o Administration > Device access<\/strong>, t\u00edch ch\u1ecdn IPsec<\/strong> \u1edf Zone WAN.<\/strong><\/p>\n\n\n\n

\"\"\/<\/figure>\n","protected":false},"excerpt":{"rendered":"

1.T\u1ed5ng quan B\u00e0i vi\u1ebft n\u00e0y s\u1ebd h\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh t\u00ednh n\u0103ng L2TP VPN tr\u00ean thi\u1ebft b\u1ecb t\u01b0\u1eddng l\u1eeda Sophos XGS \u0111\u1ec3 truy c\u1eadp t\u1eeb xa v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9. Giao th\u1ee9c Layer Two Tunneling Protocol (L2TP) cho ph\u00e9p b\u1ea1n cung c\u1ea5p k\u1ebft n\u1ed1i \u0111\u1ebfn m\u1ea1ng c\u1ee7a m\u00ecnh th\u00f4ng qua c\u00e1c \u0111\u01b0\u1eddng h\u1ea7m ri\u00eang tr\u00ean […]<\/p>\n","protected":false},"author":9,"featured_media":21649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[80],"tags":[541,490],"class_list":["post-21635","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-huong-dan-tai-lieu","tag-l2tp-vpn","tag-vpn","entry","has-media"],"_links":{"self":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/21635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/comments?post=21635"}],"version-history":[{"count":2,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/21635\/revisions"}],"predecessor-version":[{"id":21673,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/21635\/revisions\/21673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media\/21649"}],"wp:attachment":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media?parent=21635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/categories?post=21635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/tags?post=21635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}