topic Re: L2TP on ASA software image on FPR1150 in Network Security

L2TP on ASA software image on FPR1150

KayaaKashyap — Mon, 17 Feb 2025 14:08:27 GMT

Hi Community,

I am looking for step by step guide to configure L2TP VPN on FPR1150 with ASA image on it.

Also what will be prerequisite?

Is it only possible over IPsec VPN?

Re: L2TP on ASA software image on FPR1150

Rob Ingram — Mon, 17 Feb 2025 14:39:20 GMT

@KayaaKashyap well the Cisco documents says the ASA supports L2TP for IKEv1/IPSec Remote Access VPN. However AnyConnect/Secure Client only supports IKEv2, not IKEv1. I assume you'd have to use the client OS built-in client (if supported).

https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/vpn/asa-922-vpn-config/vpn-l2tp-ipsec.html?bookSearch=true

Re: L2TP on ASA software image on FPR1150

KayaaKashyap — Mon, 17 Feb 2025 17:53:46 GMT

This is requirement to connect two remote sites with L2TP which are connected over Sdwan, is it feasible without Public IP?

Re: L2TP on ASA software image on FPR1150

Rob Ingram — Mon, 17 Feb 2025 17:58:49 GMT

@KayaaKashyap perhaps run VXLAN between the switches at the two sites over the tunnel.

Re: L2TP on ASA software image on FPR1150

KayaaKashyap — Mon, 17 Feb 2025 18:01:16 GMT

As per our client requirements, VXLAN is not much secure and client is looking for L2TP only.

Re: L2TP on ASA software image on FPR1150

MHM Cisco World — Mon, 17 Feb 2025 18:01:36 GMT

I remember that we suggest to ypu vxlan.

Also why ypu want l2 tunnel between two site?

MHM

Re: L2TP on ASA software image on FPR1150

KayaaKashyap — Mon, 17 Feb 2025 18:05:05 GMT

This is functionality testing on their Pilot sites.

They want to test all possible/feasible functionality to implement it as per requirements.

Re: L2TP on ASA software image on FPR1150

Rob Ingram — Mon, 17 Feb 2025 18:05:30 GMT

@KayaaKashyap if the sites communicate using SDWAN then the traffic is encrypted, so whether it's VXLAN or L2TP communication is secure. You could run L2TP or VXLAN on the switches and just tunnel over the SDWAN.

Re: L2TP on ASA software image on FPR1150

MHM Cisco World — Mon, 17 Feb 2025 20:33:31 GMT

Ok' are there any l3 device behind ASA'

You can end l2tp vpn in this device and bypass traffic through ASA.

Only you need to open port for l2tp in asa' for bypass traffic.

MHM