Technical Tip: LDAP users with Windows L2TP Native clients

Description

This article describes how to fix the issue when LDAP users cannot connect with Windows L2TP native clients.

Scope

FortiGate.

Solution

LDAP user authentication is supported for PPTP, L2TP, IPsec VPN, and firewall authentication but due to point-to-point protocol limitations, only PAP (Packet Authentication Protocol).
As Windows native client uses MSCHAP or MSCHAPv2 by default, it is possible to change it to PAP: in the Security tab of the L2TP connection setting, select 'Advanced', select 'Settings', enable 'Unencrypted password PAP' and select 'OK'.

Related article:

Technical Tip: Setup L2TP over IPSEC VPN on FortiGate with LDAP authentication