28-3
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 28 Configuring L2TP over IPSec
Configuring L2TP over IPSec Connections
Configuring L2TP over IPSec Connections
To configure the security appliance to accept L2TP over IPSec connections, follow these steps:
Note The security appliance does not establish an L2TP/IPSec tunnel with Windows 2000 if either the Cisco
VPN Client Version 3.x or the Cisco VPN 3000 Client Version 2.5 is installed. Disable the Cisco VPN
Service for the Cisco VPN Client Version 3.x, or the ANetIKE Service for the Cisco VPN 3000 Client
Version 2.5 from the Services panel in Windows 2000 (click Start>Programs>Administrative
Tools>Serv ice s). Then restart the IPSec Policy Agent Service from the Services panel, and reboot the
machine.
Step 1 Specify IPSec to use transport mode rather than tunnel mode with the mode keyword of the
crypto ipsec transform-set command:
hostname(config)# crypto ipsec transform-set trans_name mode transport
Step 2 (Optional) Specify the local address pool used to allocate the IP address to the client using the
address-pool command in tunnel-group general-attributes mode:
hostname(config)# tunnel-group name general-attributes
hostname(config-tunnel-general)# address-pool pool_name
Step 3 (Optional) Instruct the security appliance to send DNS server IP addresses to the client with the
dns value command from group policy configuration mode:
hostname(config)# group-policy group_policy_name attributes
hostname(config-group-policy)# dns value [none | IP_primary [IP_secondary]]
Step 4 (Optional) Instruct the security appliance to send WINS server IP addresses to the client using the
wins-server command from group policy configuration mode:
hostname(config-group-policy)# wins-server value [none | IP_primary [IP_secondary]]
Step 5 (Optional) Generate a AAA accounting start and stop record for an L2TP session using the
accounting-server-group command from tunnel group general-attributes mode:
hostname(config)# tunnel-group name general-attributes
hostname(config-tunnel-general)# accounting-server-group aaa_server_group
Step 6 Configure L2TP over IPSec as a valid VPN tunneling protocol for a group or user with the
vpn-tunnel-protocol l2tp-ipsec command:
For a group, enter group-policy attributes mode:
hostname(config)# group-policy group_policy_name attributes
hostname(config-group-policy)# vpn-tunnel-protocol l2tp-ipsec
For a user, enter username attributes mode:
hostname(config)# username user_name attributes
hostname(config-username)# vpn-tunnel-protocol l2tp-ipsec
Step 7 Create a tunnel group with the tunnel-group command, and link the name of the group policy to the
tunnel group with the default-group-policy command from tunnel group general-attributes mode:
hostname(config)# tunnel-group name type ipsec-ra
hostname(config)# tunnel-group name general-attributes
hostname(config-tunnel-general)# group-policy group_policy_name
To Next Page
Loading...
Need help?
General