Technical Tip: How to establish VPN connection between Windows 10 and FortiGate with L2TP over IPSec using PSK

This article describes how to configure FortiGate so Microsoft’s L2TP/IPSec VPN client configured on Windows 10 PC will have access to the network(s) behind FortiGate in a secure manner. 

When deploying L2TP/IPSec VPN between Windows 10 PC and FortiGate, it is possible to run into issues (where the tunnel failed to come up), if not using 'VPN Proposals' supported by Windows 10. 

FortiGate v6.2, FortiGate v6.4, FortiGate v7.0, FortiGate v7.6.

L2TP over IPsec can be deployed on FortiGate through CLI or GUI. It is advisable to follow the GUI configuration template on FortiGate (Under VPN -> IPsec Wizard -> VPN Setup).

Configuring L2TP over IPSec (GUI).

Step 1: 

Create a User Account:

A 'user account' is required on FortiGate for 'L2TP over IPSec' deployment. 

1. Go to GUI Interface, User & Device -> User Definition -> Create New (then create a new user account – fill in required info). 
2. Go to User & Device -> User Groups -> Create New (then create a new user group and add the user account created). 

Step 2: 

Create the VPN.

Go to the GUI Interface, VPN -> IPsec Wizard  -> VPN Setup  -> Remote Access  -> Native  -> Windows Native (fill in required information) and select 'Next'.

• On the Authentication tab -> Select 'Pre-shared Key' (provide key)  -> Select 'User Group' (earlier created) and select 'Next'.

• On the 'Policy & Routing' tab -> Local Interface (LAN) -> Local Address (choose unit address) -> Client Add range (Fill in the desired IP range) -> Leave 'subnet Mask' as default, and select 'Next'.

Note:

Do not change the 'Subnet Mask', leave it as the default. 

Review the newly created VPN and once okay, select 'Create'.  

VPN Summary: 

As of FortiOS version 7.6.x, the GUI layout has changed:

• Select VPN client type, Authentication method, and Transport.

To avoid misunderstanding, the PSK option was changed to appear gray (disabled) since v7.6.3, as Microsoft considers L2TP and IKEv2 separated protocols with their own settings and no relation between them.

• In the Next section, configure the Remote Endpoint IP address.

• In the Next Section, select Incoming and Local Interface and Local Address Group.

• At the end, review and select Submit.

Note:

The proposal used in phase1 (and phase 2) by the FortiGate wizard should be supported by Windows. The deployment will not work if a proposal not supported by Windows 10 (or other Windows) L2TP/IPsec is chosen. 

Step 3: 

Create L2TP/IPSec on Windows 10. 

On Windows, select Start -> Settings -> Network & Internet -> VPN -> Add a VPN connection. 

Fill in the 'Add a VPN connection' tab using the screenshot below as a guide. Select 'save' once done. 

Note:

'Server name or address' is the IP address of the FortiGate WAN Interface. 

Verification: 

Select Connect under the newly created VPN, and it should connect and access the network behind FortiGate if everything is configured correctly. 

Note that the IP specified under the Client Address Range of FortiGate is assigned to the PC. 

Related documents:

L2TP in IPsec connectivity issues

VPN connection types