vpn_l2tp_ipsec.pdf - CH A P T E R 65 Configuring L2TP over...

C H A P T E R
65-1
Cisco ASA 5500 Series Configuration Guide using the CLI
65
Configuring L2TP over IPsec
This chapter describes how to configure L2TP over IPsec/IKEv1 on the ASA. This chapter includes the
following topics:
•
Information About L2TP over IPsec/IKEv1, page 65-1
•
Licensing Requirements for L2TP over IPsec, page 65-3
•
Guidelines and Limitations, page 65-7
•
Configuring L2TP over IPsec, page 65-8
•
Feature History for L2TP over IPsec, page 65-18
Information About L2TP over IPsec/IKEv1
Layer 2 Tunneling Protocol (L2TP) is a VPN tunneling protocol that allows remote clients to use the public
IP network to securely communicate with private corporate network servers. L2TP uses PPP over UDP (port
1701) to tunnel the data.
L2TP protocol is based on the client/server model. The function is divided between the L2TP Network
Server (LNS), and the L2TP Access Concentrator (LAC). The LNS typically runs on a network gateway
such as a router, while the LAC can be a dial-up Network Access Server (NAS) or an endpoint device with a
bundled L2TP client such as Microsoft Windows, Apple iPhone, or Android.
The primary benefit of configuring L2TP with IPsec/IKEv1 in a remote access scenario is that remote
users can access a VPN over a public IP network without a gateway or a dedicated line, which enables
remote access from virtually anyplace with POTS. An additional benefit is that no additional client
software, such as Cisco VPN client software, is required.
Note
L2TP over IPsec supports only IKEv1. IKEv2 is not supported.
The configuration of L2TP with IPsec/IKEv1 supports certificates using the preshared keys or RSA
signature methods, and the use of dynamic (as opposed to static) crypto maps. This summary of tasks
assumes completion of IKEv1, as well as pre-shared keys or RSA signature configuration. See
Chapter 41, “Configuring Digital Certificates,” for the steps to configure preshared keys, RSA, and
dynamic crypto maps.
Note
L2TP with IPsec on the ASA allows the LNS to interoperate with native VPN clients integrated in such
operating systems as Windows, MAC OS X, Android, and Cisco IOS. Only L2TP with IPsec is
supported, native L2TP itself is not supported on ASA.

65-2
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 65 Configuring L2TP over IPsec
Information About L2TP over IPsec/IKEv1
The minimum IPsec security association lifetime supported by the Windows client is 300 seconds. If the
lifetime on the ASA is set to less than 300 seconds, the Windows client ignores it and replaces it with a
300 second lifetime.
IPsec Transport and Tunnel Modes
By default, the ASA uses IPsec tunnel mode—the entire original IP datagram is encrypted, and it
becomes the payload in a new IP packet. This mode allows a network device, such as a router, to act as
an IPsec proxy. That is, the router performs encryption on behalf of the hosts. The source router encrypts
packets and forwards them along the IPsec tunnel. The destination router decrypts the original IP
datagram and forwards it on to the destination system. The major advantage of tunnel mode is that the