Cisco 500 Series, Configuration Manual

Page: 593 / 1140

C H A P T E R
28-1
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
28
Configuring L2TP over IPSec
This chapter describes how to configure IPSec over L2TP on the security appliance, and includes the
following topics:
•
L2TP Overview, page 28-1
• Configuring L2TP over IPSec Connections, page 28-3
•
Viewing L2TP over IPSec Connection Information, page 28-5
L2TP Overview
Layer 2 Tunneling Protocol (L2TP) is a VPN tunneling protocol which allows remote clients to use the
public IP network to securely communicate with private corporate network servers. L2TP uses PPP over
UDP (port 1701) to tunnel the data.
L2TP protocol is based on the client/server model. The function is divided between the L2TP Network
Server (LNS), and the L2TP Access Concentrator (LAC). The LNS typically runs on a network gateway
such as a router, while the LAC can be a dial-up Network Access Server (NAS), or a PC with a bundled
L2TP client such as Microsoft Windows 2000.
The primary benefit of configuring L2TP with IPSec in a remote access scenario is that remote users can
access a VPN over a public IP network without a gateway or a dedicated line, enabling remote access
from virtually anyplace with POTS. An additional benefit is that the only client requirement for VPN
access is the use of Windows 2000 with Microsoft Dial-Up Networking (DUN). No additional client
software, such as Cisco VPN client software, is required.
To configure L2TP over IPSec, first configure IPSec transport mode to enable IPSec with L2TP. Then
configure L2TP with a virtual private dial-up network VPDN group.
The configuration of L2TP with IPSec supports certificates using the pre-shared keys or RSA signature
methods, and the use of dynamic (as opposed to static) crypto maps. This summary of tasks assumes
completion of IKE, as well as pre-shared keys or RSA signature configuration. See “
Chapter 39,
“Configuring Certificates,” ” for the steps to configure pre-shared keys, RSA, and dynamic crypto maps.
Note
L2TP with IPSec on the security appliance allows the LNS to interoperate with the Windows 2000 L2TP
client. Interoperability with LACs from Cisco and other vendors is currently not supported. Only L2TP
with IPSec is supported, native L2TP itself is not supported on security appliance.
The minimum IPSec security association lifetime supported by the Windows 2000 client is 300 seconds.
If the lifetime on thesecurity appliance is set to less than 300 seconds, the Windows 2000 client ignores
it and replaces it with a 300 second lifetime.