Asa 5505 debug l2tp over ipsec instance
Inter vlan 1
Nameif inside
Ip address 172.16.1.1 255.255.255.0
Inter vlan 2
Nameif outside
Ip address xx.xx.xx.xx 255.255.255.240
Inter eth 0/0
Switchport access vlan 1
No shutdown
Inter eth 0/1
Switchport access vlan 2
No shutdown
/ / basic configuration
Ip local pool l2tp-ipsec_address 192.168.1.1-192.168.1.10
/ / address pool for * * users
Access-list split extended permit ip host 172.17.1.9 any
/ / make a tunnel separation list, which has no effect in the actual test. Limit it with acl.
Group-policy l2tp-ipsec_policy internal / / define a group-policy
Group-policy l2tp-ipsec_policy attributes / / set the properties of group-policy
* *-tunnel-protocol l2tp-ipsec
< split-tunnel-policy tunnelspecified split-tunnel-network-list value split >/ / use as a tunnel separation list
Username cisco password cisco mschap / / create a user name and password and encryption method
Username cisco attributes / / define user attributes
* *-group-policy l2tp-ipsec_policy / / call group-policy
Tunnel-group DefaultRAGroup general-attributes / / configure l2tp over ipsec must use DefaultRAGroup, define general properties
Default-group-policy l2tp-ipsec_policy / / call group-policy
Address-pool l2tp-ipsec_address / / call address pool
Tunnel-group DefaultRAGroup ipsec-attributes / / define ipsec attribute
Pre-shared-key cisc0 / / configure pre-shared key
Tunnel-group DefaultRAGroup ppp-attributes / / defines the authentication method of ppp
No authentication pap
Authentication chap
Authentication ms-chap-v1
Authentication ms-chap-v2
Crypto isakmp policy 10 / / define the first stage tunnel
Authentication pre-share
Encryption 3des
Hash sha
Group 2
Lifetime 86400
Crypto ipsec transform-set trans esp-3des esp-sha-hmac
Crypto ipsec transform-set trans mode transport / / configuration l2tp must be configured as transport
Crypto dynamic-map dyno 10 set transform-set trans / / configuration dynamic encryption diagram
Crypto map * 65535 ipsec-isakmp dynamic dyno
Crypto map * interface outside
Crypto isakmp enable outside
If win7 cannot be dialed, please check whether the ike service is enabled. This example does not involve nat. In the nat environment, the nat of the host that needs to be accessed needs to be excluded.
