Configuring L2TP over IPSec Connections
To configure the security appliance to accept L2TP over IPSec connections, follow these steps:
Configuring L2TP over IPSec Connections H
Note The security appliance does not establish an L2TP/IPSec tunnel with Windows 2000 if either the Cisco VPN Client Version 3.x or the Cisco VPN 3000 Client Version 2.5 is installed. Disable the Cisco VPN Service for the Cisco VPN Client Version 3.x, or the ANetIKE Service for the Cisco VPN 3000 Client Version 2.5 from the Services panel in Windows 2000 (click Start>Programs>Administrative Tools>Services). Then restart the IPSec Policy Agent Service from the Services panel, and reboot the machine.
Step 1 Specify IPSec to use transport mode rather than tunnel mode with the mode keyword of the crypto ipsec transform-set command:
hostname(config)# crypto ipsec transform-set trans_name mode transport
Step 2 (Optional) Specify the local address pool used to allocate the IP address to the client using the address-pool command in tunnel-group general-attributes mode:
hostname(config)# tunnel-group name general-attributes hostname(config-tunnel-general)# address-pool pool_name
Step 3 (Optional) Instruct the security appliance to send DNS server IP addresses to the client with the dns value command from group policy configuration mode:
hostname(config)# group-policy group_policy_name attributes hostname(config-group-policy)# dns value [none | IP_primary [IP_secondary]]
Step 4 (Optional) Instruct the security appliance to send WINS server IP addresses to the client using the wins-server command from group policy configuration mode:
hostname(config-group-policy)# wins-server value [none | IP_primary [IP_secondary]]
Step 5 (Optional) Generate a AAA accounting start and stop record for an L2TP session using the accounting-server-group command from tunnel group general-attributes mode:
hostname(config)# tunnel-group name general-attributes hostname(config-tunnel-general)# accounting-server-group aaa_server_group
Step 6 Configure L2TP over IPSec as a valid VPN tunneling protocol for a group or user with the vpn-tunnel-protocol l2tp-ipsec command:
For a group, enter group-policy attributes mode:
hostname(config)# group-policy group_policy_name attributes hostname(config-group-policy)# vpn-tunnel-protocol l2tp-ipsec
For a user, enter username attributes mode:
hostname(config)# username user_name attributes hostname(config-username)# vpn-tunnel-protocol l2tp-ipsec
Step 7 Create a tunnel group with the tunnel-group command, and link the name of the group policy to the tunnel group with the default-group-policy command from tunnel group general-attributes mode:
hostname(config)# tunnel-group name type ipsec-ra hostname(config)# tunnel-group name general-attributes hostname(config-tunnel-general)# group-policy group_policy_name
Step 8 Configure the PPP authentication protocol using the authentication type command from tunnel group ppp-attributes mode. Table 28-1 shows the types of PPP authentication, and their characteristics.
hostname(config)# tunnel-group name ppp-attributes hostname(config-ppp)# authentication pap
H Configuring L2TP over IPSec Connections
|
Keyword |
Authentication Type |
Characteristics |
|
chap |
CHAP |
In response to the server challenge, the client returns the encrypted [challenge plus password] with a cleartext username. This protocol is more secure than the PAP, but it does not encrypt data. |
|
EAP |
Enables EAP which permits the security appliance to proxy the PPP authentication process to an external RADIUS authentication server. |
|
|
ms-chap-v1 ms-chap-v2 |
Microsoft CHAP, Version 1 Microsoft CHAP, Version, 2 |
Similar to CHAP but more secure in that the server stores and compares only encrypted passwords rather than cleartext passwords as in CHAP. This protocol also generates a key for data encryption by MPPE. |
|
pap |
PAP |
Passes cleartext username and password during authentication and is not secure. |
Step 9 Specify a method to authenticate users attempting L2TP over IPSec connections. Use the authentication-server-group command from tunnel-group general-attributes mode to configure the security appliance to use an authentication server or its own local database.
Using an Authentication Server
To use an authentication server, use the authentication server group keyword:
hostname(config)# tunnel-group name general-attributes hostname(config-tunnel-general)# authentication-server-group auth_server_group
Using the Local Database
To use the local database, enter the LOCAL keyword.
hostname(config)# tunnel-group name general-attributes hostname(config-tunnel-general)# authentication-server-group LOCAL ^ _
Note The security appliance only supports the PPP authentications PAP and Microsoft CHAP, Versions 1 and 2, on the local database. EAP and CHAP are performed by proxy authentication servers. Therefore, if a remote user belongs to a tunnel group configured with the authentication eap-proxy or authentication chap commands, and the security appliance is configured to use the local database, that user will not be able to connect.
Step 10 Create a user in the local database with the username command from global configuration mode.
If the user is an L2TP client using Microsoft CHAP, Version 1 or Version 2, and the security appliance is configured to authenticate against the local database, you must include the mschap keyword. For Example:
hostname(config)# username t_wmith password eu5d93h mschap
Step 11 Configure the interval (in seconds) between hello messages using the l2tp tunnel hello command in global configuration mode:
hostname(config)# l2tp tunnel hello seconds
Viewing L2TP over IPSec Connection Information H
Step 12 (Optional) If you expect multiple L2TP clients behind a NAT device to attempt L2TP over IPSec connections to the security appliance, you must enable NAT traversal so that ESP packets can pass through one or more NAT devices.
To enable NAT traversal globally, check that ISAKMP is enabled (you can enable it with the crypto isakmp enable command) in global configuration mode and then use the crypto isakmp nat-traversal command. For example:
hostname(config)# crypto isakmp enable hostname(config)# crypto isakmp nat-traversal 30
Continue reading here: Viewing L2TP over IPSec Connection Information
Was this article helpful?