L2TP on ASA software image on FPR1150

[KayaaKashyap]

Hi Community, 

I am looking for step by step guide to configure L2TP VPN on FPR1150 with ASA image on it.

Also what will be prerequisite?

Is it only possible over IPsec VPN?

[Rob Ingram · Accepted solution]

@KayaaKashyap well the Cisco documents says the ASA supports L2TP for IKEv1/IPSec Remote Access VPN. However AnyConnect/Secure Client only supports IKEv2, not IKEv1. I assume you'd have to use the client OS built-in client (if supported).

https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/vpn/asa-922-vpn-config/vpn-l2tp-ipsec.html?bookSearch=true

[KayaaKashyap]

This is requirement to connect two remote sites with L2TP which are connected over Sdwan, is it feasible without Public IP? 

[Rob Ingram]

@KayaaKashyap perhaps run VXLAN between the switches at the two sites over the tunnel.

[KayaaKashyap]

As per our client requirements, VXLAN is not much secure and client is looking for L2TP only.

[Rob Ingram]

@KayaaKashyap if the sites communicate using SDWAN then the traffic is encrypted, so whether it's VXLAN or L2TP communication is secure. You could run L2TP or VXLAN on the switches and just tunnel over the SDWAN.

[MHM Cisco World]

I remember that we suggest to ypu vxlan.

Also why ypu want l2 tunnel between two site?

MHM

[KayaaKashyap]

This is functionality testing on their Pilot sites.

They want to test all possible/feasible functionality to implement it as per requirements.

[MHM Cisco World]

Ok' are there any l3 device behind ASA' 

You can end l2tp vpn in this device and bypass traffic through ASA.

Only you need to open port for l2tp in asa' for bypass traffic.

MHM