Bug report: L2TP does not require IPsec

Forum|Forum|10 years ago
June 11, 2016
4 replies
6290 views

Recently I reconfigured my home network and I forgot to update my IPsec policy configuration, as a result my home vpn server was not negotiating any IPsec SA with the Foritgate vpn/router at work, but to my surprise they were able to successfully establish a VPN tunnel, an unencrypted/unprotected one. Granted it was a mistake on the other end, but allowing an unencrypted L2TP to establish is a security hole for a commercial (security appliance) product like Fortigate. It should be a straightforward fix by *requiring* IPsec for all traffic to/from port 1701.

5.2

MikePruett

New Member

That's not really a flaw I think.

As there are different types of tunnels that encrypt either just the header or the header and the payload. Sounds like it is using the former right now.

luoqiAuthor

New Member

We are not talking all different types of tunnels here, we're specifically talking about L2TP/IPsec as defined in rfc3193. So yes, I'm pretty sure it is a bug, and worse still a security risk.

emnoc

New Member

No it not a bug, you have a L2TP tunnel and L2TP over Ipsec, you enable a L2TP tunnel that relies on tcp 1701 and sometimes 1702. This is not a bug just misunderstanding of what you did.

The difference in the fortiOS cfg are major items are;

config vpn l2tp

and

config vpn ipsec-phase1

and change the mode from tunnel to transport

Can you post the cfg of whatever you did ? and show us the cli output of get vpn l2tp ?

Ken

Sign up

Login with SSO

Login to the community

Login with SSO