Cisco ASA 5505 - Manual (Page 1391)

C H A P T E R
65-1
Cisco ASA 5500 Series Configuration Guide using the CLI
65
Configuring L2TP over IPsec
This chapter describes how to configure L2TP over IPsec/IKEv1 on the ASA. This chapter includes the
following topics:
• Information About L2TP over IPsec/IKEv1, page 65-1
• Licensing Requirements for L2TP over IPsec, page 65-3
• Guidelines and Limitations, page 65-7
• Configuring L2TP over IPsec, page 65-8
• Feature History for L2TP over IPsec, page 65-18
Information About L2TP over IPsec/IKEv1
Layer 2 Tunneling Protocol (L2TP) is a VPN tunneling protocol that allows remote clients to use the public
IP network to securely communicate with private corporate network servers. L2TP uses PPP over UDP (port
1701) to tunnel the data.
L2TP protocol is based on the client/server model. The function is divided between the L2TP Network
Server (LNS), and the L2TP Access Concentrator (LAC). The LNS typically runs on a network gateway
such as a router, while the LAC can be a dial-up Network Access Server (NAS) or an endpoint device with a
bundled L2TP client such as Microsoft Windows, Apple iPhone, or Android.
The primary benefit of configuring L2TP with IPsec/IKEv1 in a remote access scenario is that remote
users can access a VPN over a public IP network without a gateway or a dedicated line, which enables
remote access from virtually anyplace with POTS. An additional benefit is that no additional client
software, such as Cisco VPN client software, is required.
Note L2TP over IPsec supports only IKEv1. IKEv2 is not supported.
The configuration of L2TP with IPsec/IKEv1 supports certificates using the preshared keys or RSA
signature methods, and the use of dynamic (as opposed to static) crypto maps. This summary of tasks
assumes completion of IKEv1, as well as pre-shared keys or RSA signature configuration. See
Chapter 41, “Configuring Digital Certificates,” for the steps to configure preshared keys, RSA, and
dynamic crypto maps.
Note L2TP with IPsec on the ASA allows the LNS to interoperate with native VPN clients integrated in such
operating systems as Windows, MAC OS X, Android, and Cisco IOS. Only L2TP with IPsec is
supported, native L2TP itself is not supported on ASA.