65-7
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter65 Configuring L2TP over IPsec
Prerequisites for Configuring L2TP over IPsec
Prerequisites for Configuring L2TP over IPsec
Configuring L2TP over IPsec has the following prerequisites:
•You can configure the default group policy (DfltGrpPolicy) or a user-defined group policy for
L2TP/IPsec connections. In either case, the group policy must be configured to use the L2TP/IPsec
tunneling protocol. If the L2TP/IPsec tunning protocol is not configured for your user-defined group
policy, configure the DfltGrpPolicy for the L2TP/IPsec tunning protocol and allow your
user-defined group policy to inherit this attribute.
•You need to configure the default connection proflie (tunnel group), DefaultRAGroup, if you are
performing “pre-shared key” authentication. If you are performing certificate-based authentication,
you can use a user-defined connection profile that can be chosen based on certificate identifiers.
•IP connectivity needs to be established between the peers. To test connectivity, try to ping the IP
address of the ASA from your endpoint and try to ping the IP address of your endpoint from the
ASA.
•Make sure that UDP port 1701 is not blocked anywhere along the path of the connection.
•If a Windows 7 endpoint device authenticates using a certificate that specifies a SHA signature type,
the signature type must match that of the ASA, either SHA1 or SHA2.
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single context mode. Multiple context mode is not supported.
Firewall Mode Guidelines
Supported only in routed firewall mode. Transparent mode is not supported.
Failover Guidelines
L2TP over IPsec sessions are not supported by stateful failover.
3. The AnyConnect Essentials license enables AnyConnect VPN client access to the ASA. This license does not support browser-based SSL VPN access or
Cisco Secure Desktop. For these features, activate an AnyConnect Premium license instead of the AnyConnect Essentials license.
Note: With the AnyConnect Essentials license, VPN users can use a Web browser to log in, and download and start (WebLaunch) the AnyConnect client.
The AnyConnect client software offers the same set of client features, whether it is enabled by this license or an AnyConnect Premium SSL VPN Edition
license.
The AnyConnect Essentials license cannot be active at the same time as the following licenses on a given ASA: AnyConnect Premium license (all types)
or the Advanced Endpoint Assessment license. You can, however, run AnyConnect Essentials and AnyConnect Premium licenses on different ASAs in
the same network.
By default, the ASA uses the AnyConnect Essentials license, but you can disable it to use other licenses by using the no anyconnect-essentials command.
For a detailed list of the features supported by the AnyConnect Essentials license and AnyConnect Premium license, see AnyConnect Secure Mobility
Client Features, Licenses, and OSs:
http://www.cisco.com/en/US/products/ps10884/products_feature_guides_list.html