Cisco ISR4321 – Firewall and VPN Functionalities

Taking a shot in the dark here because there are a lot of variables you didn't mention. Please update the question to include the specific technologies you are using, your currnet config, and the error you are getting. But if you are using for instance, DMVPN + EZVPN, you will probably have to use keyrings and multiple ISAKMP profiles. Since you point to phase 1 issues I would check that. The following links give reference configs for DMVPN and EZVPN and L2L+EZVPN. You should be able to modify to suit your needs.

Here's a ISAKMP Profile reference for some lunchtime reading.

Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future

Since you did not say that the L2s would be running ACLs, I would not see a difference. I am guessing you will run tagging on the inside ASAs to the distribution layer. My firewalls connect directly to aggregation switches with a dedicated vlan that runs HSRP/VRRP between each set of firewalls and the agg switches.

As to private line traffic, I do not use ASA but I think they have the zones construct like IOS ZBF and you will keep VPN traffic from going to/from the private line traffic without going through packet filtering.

It sounds like default route points to the 5540 and you will use more specific routes to get to your internal VPN access pools and the private line addresses. The 5545 has the default route pointing to the 5540 and it is ok for VPN traffic to hit the internet directly (don't know if you split tunnel on your VPN clients) and other routes to your internal address space.

So I can not see any real problems with your plan. But some of my above assumptions may be wrong