IIJ SEIL/X1 で SoftEther VPN Server の L2TPv3 over IPsec を終端する

hostname "seil.home"
timezone "Japan"
environment login-timer 300
option ip monitor-linkstate on
option ip update-connected-route on
option ipv6 monitor-linkstate on
option ipv6 update-connected-route on
l2tp hostname seil.home
l2tp add pgw hostname whopper router-id 0.0.0.0 cookie off retry 5 hello-interval 1
interface lan0 description "LAN"
interface lan0 media auto
interface lan0 add 192.168.0.1/24
interface lan1 description "WAN"
interface lan1 media auto
interface lan1 queue normal
interface lan1 add dhcp
interface lan1 add 192.168.255.1/24
interface lan2 description "Private gateway"
interface lan2 media auto
interface lan2 add 192.168.30.200/24
interface l2tp0 description "Private gateway"
interface l2tp0 tunnel 192.168.255.1 192.0.2.1
interface l2tp0 l2tp pgw remote-end-id whopper
bridge group add lan stp off
bridge interface lan0 group lan stp off
bridge group add pgw stp off aging-time 300
bridge interface lan2 group pgw stp off
bridge interface l2tp0 group pgw stp off
route add default dhcp
route dynamic rip disable
route dynamic ospf disable
route dynamic bgp disable
route dynamic redistribute static-to-rip disable
route dynamic redistribute static-to-ospf disable
route dynamic redistribute ospf-to-rip disable
route dynamic redistribute rip-to-ospf disable
route dynamic redistribute connected-to-rip enable
route dynamic redistribute connected-to-ospf enable
route dynamic pim-sparse disable
route6 dynamic ripng disable
route6 dynamic redistribute static-to-ripng disable
route6 dynamic redistribute connected-to-ripng enable
route6 dynamic pim-sparse disable
application-gateway input-interface add lan0
application-gateway service add HTTP_PRIVATE1 mode http destination 10.0.0.0/8
application-gateway service add HTTP_PRIVATE2 mode http destination 172.16.0.0/12
application-gateway service add HTTP_PRIVATE3 mode http destination 192.168.0.0/16
nat timeout 900
nat logging off
nat upnp off
nat upnp interface lan1
nat napt add private 192.168.0.1-192.168.0.254 interface lan1
nat proxy sip add port 5060 protocol tcpudp
nat option port-assignment random
proxyarp disable
dhcp enable
dhcp mode server
dhcp interface lan0 enable
dhcp interface lan0 expire 24
dhcp interface lan0 pool 192.168.0.2/24 253
dhcp interface lan0 dns add 192.168.0.1
dhcp6 client disable
dhcp6 client interface pppoe0
ntp enable
ntp server add 210.173.160.27
ntp server add 210.173.160.57
ntp server add 210.173.160.87
ike nat-keepalive-interval 30  dpd-interval 7 dpd-maxfail 5
ike auto-initiation enable
ike preshared-key add "192.0.2.1" "burgerking"
ike proposal add pgw encryption aes256 hash sha1 authentication preshared-key dh-group modp1024
ike peer add pgw address 192.0.2.1 exchange-mode aggressive proposals pgw my-identifier fqdn "seil.home" nat-traversal enable dpd enable prefer-new-phase1 enable
ipsec security-association proposal add pgw pfs-group modp1024 authentication-algorithm hmac-sha1 encryption-algorithm aes256
ipsec security-association add pgw tunnel lan1 192.0.2.1 ike pgw esp enable
ipsec security-policy add pgw security-association pgw protocol 115 src 192.168.255.1/32 dst 192.0.2.1/32
cbq link-bandwidth 100Mbps
snmp disable
snmp community "public"
snmp security-model community-based off
snmp security-model user-based on
snmp trap disable
syslog debug-level off
syslog facility local1
syslog remote off
translator timeout 300
resolver enable
resolver address add 1.1.1.1
rtadvd disable
httpd enable
sshd enable
telnetd enable
vendor OEM