C H A P T E R 65-1 Cisco ASA 5500 Series Configuration Guide using the CLI 65 Configuring L2TP over IPsec This chapter describes how to configure L2TP over IPsec/IKEv1 on the ASA. This chapter includes the following topics: • Information About L2TP over IPsec/IKEv1, page 65-1 • Licensing Requirements for L2TP over IPsec, page 65-3 • Guidelines and Limitations, page 65-7 • Configuring L2TP over IPsec, page 65-8 • Feature History for L2TP over IPsec, page 65-18 Information About L2TP over IPsec/IKEv1 Layer 2 Tunneling Protocol (L2TP) is a VPN tunneling protocol that allows remote clients to use the public IP network to securely communicate with private corporate network servers. L2TP uses PPP over UDP (port 1701) to tunnel the data. L2TP protocol is based on the client/server model. The function is divided between the L2TP Network Server (LNS), and the L2TP Access Concentrator (LAC). The LNS typically runs on a network gateway such as a router, while the LAC can be a dial-up Network Access Server (NAS) or an endpoint device with a bundled L2TP client such as Microsoft Windows, Apple iPhone, or Android. The primary benefit of configuring L2TP with IPsec/IKEv1 in a remote access scenario is that remote users can access a VPN over a public IP network without a gateway or a dedicated line, which enables remote access from virtually anyplace with POTS. An additional benefit is that no additional client software, such as Cisco VPN client software, is required. Note L2TP over IPsec supports only IKEv1. IKEv2 is not supported. The configuration of L2TP with IPsec/IKEv1 supports certificates using the preshared keys or RSA signature methods, and the use of dynamic (as opposed to static) crypto maps. This summary of tasks assumes completion of IKEv1, as well as pre-shared keys or RSA signature configuration. See Chapter 41, “Configuring Digital Certificates,” for the steps to configure preshared keys, RSA, and dynamic crypto maps. Note L2TP with IPsec on the ASA allows the LNS to interoperate with native VPN clients integrated in such operating systems as Windows, MAC OS X, Android, and Cisco IOS. Only L2TP with IPsec is supported, native L2TP itself is not supported on ASA.
65-2 Cisco ASA 5500 Series Configuration Guide using the CLI Chapter 65 Configuring L2TP over IPsec Information About L2TP over IPsec/IKEv1 The minimum IPsec security association lifetime supported by the Windows client is 300 seconds. If the lifetime on the ASA is set to less than 300 seconds, the Windows client ignores it and replaces it with a 300 second lifetime. IPsec Transport and Tunnel Modes By default, the ASA uses IPsec tunnel mode—the entire original IP datagram is encrypted, and it becomes the payload in a new IP packet. This mode allows a network device, such as a router, to act as an IPsec proxy. That is, the router performs encryption on behalf of the hosts. The source router encrypts packets and forwards them along the IPsec tunnel. The destination router decrypts the original IP datagram and forwards it on to the destination system. The major advantage of tunnel mode is that the
You've reached the end of your free preview.
Want to read all 18 pages?
- Winter '15