Problem

When Cisco released version 7 of the operating system for PIX/ASA they dropped support for the firewall acting as a PPTP VPN device.

Note: If you want to use PPTP you can still terminate PPTP VPNs on a Windows server, if you enable PPTP and GRE Passthrough on the ASA.

But if you want to use the native Windows VPN client you can still use L2TP over IPSEC. I had a look around the net to work out how to do this and most decent articles are written using the older versions of the ASDM, and the CLI information I found on Cisco's site didn't help either.

Bottom line: - Use the ASDM to configure L2TP VPN's, and there's so many bits you need to alter, you might as well have done it from command line anyway. Also the ASDM generates a lot of ugly code. (This will probably be fixed in future ASDM releases).

What I'm using

1. Cisco ASA5505 version 8.4(3)and ASDM version 6.4(7).

2. Network behind the ASA 10.254.254.0/24.

3. IP addresses of the remote clients 192.168.100.1 to 10 (DNS 10.254.254.5).

4. Split tunnelling enabled.

5. Local (On the ASA) user authentication.

6. Authentication via Pre Shared Key 1234567890.

Solution

Configure the ASA 5500 for L2TP IPSEC VPNs

1. Connect to the ASA, go to "enable mode", then to "Configure terminal mode"

User Access Verification

Password:
Type help or '?' for a list of available commands.
PetesASA> enable
Password: ********
PetesASA# configure Terminal
PetesASA(config)#

3. Now to make sure the traffic that's going to travel over out VPN is not NATTED.

Note: This is assuming that 192.168.100.0/24 is the remote VPN clients subnet, and 10.254.254.0/24 is the subnet BEHIND the ASA.

8. Create a group policy, that hold the following, DNS server IP(s) that will be leased to the remote clients. Tunnel type (L2TP IPSEC), enable spit tunnelling using the ACL we created in step 4. The domain name that will be given to the remote clients. The "intercept-dhcp enable" looks after a Windows client problem. And finally create a user and password.

Note: In this example I'm using the ASA's local database of users for authentication.

10. For the tunnel group, setup a shared key, and the authentication method for our clients.

Note: We are disabling CHAP and enabling MSCHAP v2.

Configure Windows VPN client for L2TP IPSEC connection to Cisco ASA 5500

Note: Windows 7 x64 bit used.

1. Launch the "Network and Sharing Center" > Setup a new connection or network.

2. Connect to a workplace > Next.

3. Use my Internet connection (VPN).

4. Type in the name or IP address of the ASA, and a name for the connection. At this point select "Don't connect now" or it will fail. > Next.

5. Type in the user credentials > Create.

6. Close.

7. Now you need to edit the connection > Start > ncpa.cpl {enter}.

8. Right click the VPN connection you created earlier and select properties.

9. Security tab > Change the VPN type to "Layer 2 Tunnelling Protocol with IPsec (L2TP/IPsec) > Additional Settings and enter the pre shared key you set on the firewall (in the tunnel-group) >OK > Tick MSCHAP version 2 only.

10. Networking tab > Internet Protocol Version 4 (TCP/IPv4) > Properties > Advanced.

11. Untick "Use default gateway on remote network" > OK > OK > OK.

12. Then launch the connection and enter your credentials.

13. Note: You may find that the connection WONT WORK until you have selected a network type (when prompted) even if you have the Windows Firewall disabled.

Cisco ASA Site to Site VPN's Site to Site ISAKMP VPN

Set up Remote Access PPTP VPN's in server 2008

Using the Microsoft VPN client through Cisco ASA/PIX

Enable Split Tunnel for IPSEC / SSLVPN / WEBVPN Clients