4

Actually, I would like to allow users to use either the 64-bit Cisco VPN client or the Windows 7 built in client. Is this possible?

Additional information: The IOS host is the 881w-A-K9 ISR running version 15.1(4)M4.

There is no current VPN configuration.

Update 2015-02-06

I asked this question a year and a half ago, but I still do not have enough information to complete this task. I want to use the built-in L2TP/IPsec Windows client to dial-in to my router. The accepted answer to that question doesn't actually cover dial-in scenarios.

My immediate question is if this is even possible. It's hard for me to believe that it isn't, but this pages says:

Client-initiated tunnels using the L2TP or L2TPv3 protocol must be initiated by a router configured as the local peer. The L2TP and L2TPv3 protocols are not supported for client-initiated tunnels from a client PC.

However, this page, which is older, doesn't make any such warning. What is the authoritative answer to this question?

Improve this question
2
  • You should provide us more information regarding the version of code you are running. Also edit your post to include any configuration that you have tried.
    – knotseh
    Jul 14, 2013 at 20:26
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 9, 2017 at 23:05

3 Answers 3

Reset to default
4

To configure IPSec with the native Windows7 client, you need L2TP + IPSec on IOS and Windows 7 L2TP + IPSec.

Improve this answer
3
  • So the configuration I'm looking to implement is people working remoting VPNing in to the home office on their laptops. The "home office" has the Cisco 881w on the edge. I think that the Cisco configuration you provided is for hosts on the inside VPNing out - or are they the same config?
    – ThomasMcLeod
    Jul 15, 2013 at 13:58
  • The config I hyperlinked to is for the Cisco 881w LNS (which is the VPN termination device)... I included the config with NAT / PAT support in case you run into this situation (which is somewhat common that multiple people share the same IP public address... perhaps two of your sales staff visit a customer, who NATs them to the same public address)... I did not have time to test the CCO config this morning
    – Mike Pennington
    Jul 15, 2013 at 14:02
  • This configuration doesn't actually involve direct computer to router VPN, aka VPDN.
    – ThomasMcLeod
    Feb 7, 2015 at 8:12
2

Use this in your Cisco router:

vpdn enable
vpdn logging
vpdn logging local
vpdn logging user
!
vpdn-group 1
 accept-dialin
 !! This will allow L2TP & PPTP
  protocol any
  virtual-template 1
 force-local-chap
 lcp renegotiation always
 no l2tp tunnel authentication
 l2tp tunnel timeout no-session 15
!
username youruser password 1234
!
crypto keyring UserVPN
  pre-shared-key address 0.0.0.0 0.0.0.0 key test1234
!
crypto ipsec transform-set AES-SHA esp-aes 256 esp-sha-hmac
 mode transport
!
crypto isakmp policy 20
 encr 3des
 authentication pre-share
 group 2
!
crypto dynamic-map UserVPN 10
 set nat demux
 set transform-set AES-SHA
!
crypto map Gig0 10 ipsec-isakmp dynamic UserVPN
!
!! This is my WAN interface, replace it with yours
interface GigabitEthernet0
 crypto map Gig0
!
interface Virtual-Template1
 ip unnumbered GigabitEthernet0
 ip mtu 1392
 ip nat inside
 ip tcp adjust-mss 1352
 !! I happen to have an IP pool called 192.168.0.0/24. Replace this with your
 !! DHCP pool or an ip local pool
 peer default ip address dhcp-pool 192.168.0.0/24
 ppp encrypt mppe 128
 ppp authentication ms-chap-v2
 ! Put in your DNS servers here. 192.168.0.254 is my router.
 ppp ipcp dns 192.168.0.254 8.8.8.8
!

Create a new VPN connection in Windows with type L2TP and as PSK test1234. When connecting, supply as username "youruser" and as password "1234".

Improve this answer
4
  • Isn't the l2tp security command necessary in vpdn-group 1 mode?
    – ThomasMcLeod
    Feb 9, 2015 at 15:24
  • No. This was taken from a known working config (I run it on my own router).
    – RedShift
    Feb 9, 2015 at 18:32
  • Edit: to clarify; The connection is already protected because an IPsec SA is already established before the actual L2TP tunnel is built.
    – RedShift
    Feb 9, 2015 at 18:45
  • Does this config require encryption of all traffic on GigabitEthernet0? The dynamic crypto map doesn't have match parameters.
    – ThomasMcLeod
    Feb 11, 2015 at 1:39
-2

The built in Windows client is a PPTP client, while the Cisco client is an IPSEC client (PPTP is old and insecure), maybe you should forget both and set up an SSL VPN on your ASA.

Improve this answer
1
  • 1
    Incorrect... PPTP, L2TP/IPSec, SSTP, and IKEv2 are supported by Win7. WinXP supports PPTP and L2TP/IPSec.
    – Ricky
    Jul 15, 2013 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.