Cisco ASA Series Cli Configuration Manual page 1603

Chapter 1 Configuring L2TP over IPsec
Command
Step 8
ip local pool pool_name starting_address-ending_address
mask subnet_mask
Example:
hostname(config)# ip local pool sales_addresses
10.4.5.10-10.4.5.20 mask 255.255.255.0
Step 9
address-pool pool_name
Example:
hostname(config)# tunnel-group DefaultRAGroup
general-attributes
hostname(config-tunnel-general)# address-pool
sales_addresses
Step 10
authentication-server-group server_group
Example:
hostname(config)# tunnel-group DefaultRAGroup
general-attributes
hostname(config-tunnel-general)# authentication-server-group
sales_server LOCAL
Step 11
authentication auth_type
Example:
hostname(config)# tunnel-group name ppp-attributes
hostname(config-ppp)# authentication ms-chap-v1
Step 12
tunnel-group tunnel group name ipsec-attributes
Example:
hostname(config)# tunnel-group DefaultRAGroup
ipsec-attributes
hostname(config-tunnel-ipsec)# pre-shared-key cisco123
Step 13
accounting-server-group aaa_server_group
Example:
hostname(config)# tunnel-group sales_tunnel
general-attributes
hostname(config-tunnel-general)# accounting-server-group
sales_aaa_server
Step 14
l2tp tunnel hello seconds
Example:
hostname(config)# l2tp tunnel hello 100
Configuring L2TP over IPsec
Purpose
(Optional) Creates an IP address pool.
(Optional) Associates the pool of IP
addresses with the connection profile
(tunnel group).
Specifies a method to authenticate users
attempting L2TP over IPsec connections,
for the connection profile (tunnel group). If
you are not using the ASA to perform local
authentication, and you want to fallback to
local authentication, add LOCAL to the end
of the command.
Specifies the PPP authentication protocol
for the tunnel group. See
types of PPP authencation and their
characteristics.
Sets the pre-shared key for your connection
profile (tunnel group).
(Optional) Generates a AAA accounting
start and stop record for an L2TP session for
the connection profile (tunnel group).
Configures the interval (in seconds)
between hello messages. The range is 10
through 300 seconds. The default is 60
seconds.
Cisco ASA Series CLI Configuration Guide
Table 1-1 for the
1-11