This is the configuration for L2TP/IPSEC on Cisco ASA.
This assumes that there is an aaa-server configured named ad_vpn for vpn users.
When using aaa-server protocol ldap then only pap is valid authentication type.
If you use radius authentication instead of ldap then ms-chap-v2 authentication can be enabled.

ip local pool vpnclient 172.16.20.100-172.16.20.120 mask 255.255.255.0

access-list vpnclient_splitTunnelAcl remark Internal

access-list vpnclient_splitTunnelAcl standard permit 192.168.45.0 255.255.255.0
group-policy vpnclient internal

group-policy vpnclient attributes

 vpn-tunnel-protocol IPSec l2tp-ipsec

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value vpnclient_splitTunnelAcl

 intercept-dhcp enable
tunnel-group DefaultRAGroup general-attributes

 address-pool vpnclient

 authentication-server-group ad_vpn

 default-group-policy vpnclient

 strip-realm

 strip-group

tunnel-group DefaultRAGroup ipsec-attributes

 pre-shared-key *****

tunnel-group DefaultRAGroup ppp-attributes

 authentication pap

 no authentication chap

 no authentication ms-chap-v1
crypto ipsec ikev1 transform-set l2tp1 esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set l2tp1 mode transport

crypto ipsec ikev1 transform-set l2tp2 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set l2tp2 mode transport

crypto ipsec ikev1 transform-set aes-256-l2tp esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set aes-256-l2tp mode transport
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set l2tp1 l2tp2 aes-256-l2tp

no crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto isakmp nat-traversal 20
crypto ikev1 policy 5

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

crypto ikev1 policy 10

 authentication pre-share

 encryption aes

 hash sha

 group 2

 lifetime 86400
crypto ikev1 enable outside