Cisco asa l2tp over ipsec configuration details
Cisco ASA L2TP over IPSEC configuration details
1 create a × × address pool
Ciscoasa (config) # ip local pool * * pool 192.168.151.11-192.168.151.15 mask 255.255.255.0
2 configure Ipsec encryption algorithm to 3DES and SHA
Ciscoasa (config) # crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
3 configure IPSec transport mode to transport, default to tunnel mode (L2TP only supports transport)
Ciscoasa (config) # crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
4 use transport groups to define dynamic encryption policies
Ciscoasa (config) # crypto dynamic-map outside_dyn_map 10 set transform-set TRANS_ESP_3DES_SHA
5 define crypto map and apply it to public network interface (outside)
# crypto map outside_map 10 ipsec-isakmp dynamic outside_dyn_map
# crypto map outside_map interface outside
6 enable isakmp policy support on the public network interface
Ciscoasa (config) crypto isakmp enable outside
7 define isakmp policy
Ciscoasa (config) # crypto isakmp policy 10
Ciscoasa (config-isakmp-policy) # authentication pre-share
Ciscoasa (config-isakmp-policy) # encryption 3des
Ciscoasa (config-isakmp-policy) # hash sha
Ciscoasa (config-isakmp-policy) # group 2
Ciscoasa (config-isakmp-policy) # lifetime 86400
Ciscoasa (config-isakmp-policy) # exit
8 set nat traversal
Ciscoasa (config) # crypto isakmp nat-traversal 10
9 configure default internal group policy
Ciscoasa (config) # group-policy DefaultRAGroup internal
10 configure default internal group policy properties
Ciscoasa (config) # group-policy DefaultRAGroup attributes
Ciscoasa (config-group-policy) # *-tunnel-protocol IPSec l2tp-ipsec
Ciscoasa (config-group-policy) # default-domain value cisco.com
Ciscoasa (config-group-policy) # dns-server value 202.96.209.133
Note: if you configure L2TP over IPsec as a * tunnel protocol, you must add IPSec. Only L2tp color sectional tunnel cannot be dialed.
11 create a local user, configure a password for the user, and indicate the encryption algorithm
Ciscoasa (config) # username frank password frank mschap
12 to create a default tunnel group, be sure to use defaultRAGroup,L2TP that does not support other groups, and define the authentication method as local.
Ciscoasa (config) # tunnel-group DefaultRAGroup general-attributes
Ciscoasa (config-tunnel-general) # authentication-server-group LOCAL
Ciscoasa (config-tunnel-general) # default-group-policy DefaultRAGroup
Ciscoasa (config-tunnel-general) # address-pool * * pool
Ciscoasa (config-tunnel-general) # exit
13 make the group policy that the user belongs to
Ciscoasa (config-tunnel-general) # username frank attributes
Ciscoasa (config-username) # *-group-policy DefaultRAGroup
Ciscoasa (config-username) # *-tunnel-protocol IPSec l2tp-ipsec
Ciscoasa (config-username) # exit
14 configure the ipsec attribute of the default tunnel group, and configure the default tunnel group authentication method as ms-chap-v2
Ciscoasa (config) # tunnel-group DefaultRAGroup ppp-attributes
Ciscoasa (config-ppp) # authentication ms-chap-v2
Ciscoasa (config-ppp) # exit
15 client Settings
Win 7 needs to modify the registry
[HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ PolicyAgent]
"AssumeUDPEncapsulationContextOnSendRule" = dword:00000002
16 create a connection to the work area × × connection on the client, and set the properties of *
