Extend production VLAN behind ASA5510 to remote site and 2821

[johartman]

I have an ASA 5510 and would like to extend one of the subnets behind this ASA out to my house that has a cable modem, a wireless router/switch and then behind that I have a 2821 router.  I've been reading and it looks like L2TP may be the way to go but can't find and config examples.  Again, I would like to securely extend one and nail up a permanent connection of one of the VLANs in the production network all the way into my house using my cable modem and the 2821.  Any config examples would be much appreciated!  Also, any IOS recommendations for the 2821 would be much appreciated.  Lastly, does L2TP look like the way I need to go?  I'm attaching a very basic Visio diagram of what I'm trying to do.  Thanks, john

[Roman Rodichev · Accepted solution]

You need L2TPv3.

ASA doesn't support it but will pass L2TPv3 traffic through.

At work you'll need to add another router. L3 switches don't support it.

The configuration for a router would be:

pseudowire-class test

encapsulation l2tpv3

ip local interface loopback0 (this will be the source of the tunnel, can use any interface that has reachability to the remote xconnect IP)

!

int fas0/0.30

(don't put an ip address here)

encapsulation dot1q 30

xconnect X.X.X.X 1000 pw-class test

X.X.X.X is the remote router interface IP that's used as "ip local interface" in the remote configuration

make sure 1000 (VC ID) matches on both sides

[johartman]

So if we don't have the funds to purchase another router to sit behind the ASA they may not be a way to allow that subnet to be tunneled across?  If that's the case, should I just nail up an IPSec tunnel betwen the remote 2821 which tarverses another low end router and cable modem back to the ASA?

[Roman Rodichev]

without L2TPv3 you can't extend a subnet like that

correct, you might as well just do a VPN tunnel and route to a different subnet. Was there a need to have L2 connectivity?

[johartman]

I just wanted to be in the same domain and on the same subnet as other servers to configure them from that site.

Thanks for your input.

I guess I'll search for a config guide to lock up a permanent VPN tunnel and have permanent access to that subnet from that site.