Microsoft LT2P/IPsec VPN with Loopback Interface?

Hello,

 

I was wondering if anyone has had any experience with setting up a dial-up Microsoft VPN (L2TP/IPsec) VPN with a loopback interface instead of specifying a physical WAN interface?

 

My configuration:

 

L2TP:

config vpn l2tp

set eip 192.168.55.250

set sip 192.168.55.1

set status enable

set usrgrp "Test"

 

IPsec Phase 1:

config vpn ipsec phase1

edit "winvpn"

set type dynamic

set interface "lo_vpn"

set peertype any

set proposal aes256-md5 3des-sha1 aes192-sha1

set dhgrp 2

set psksecret ENC xxxxxxx

 

IPsec Phase 2:

config vpn ipsec phase2

edit "winvpn"

set phase1name "winvpn"

set proposal aes256-md5 3des-sha1 aes192-sha1

set pfs disable

set encapsulation transport-mode

set keylifeseconds 3600

next

end

 

Security and IPsec policy:

edit 25 (To allow L2TP, ICMP, and IPsec to hit the loopback interface)

set name "lo_winvpn"

set srcintf "wan1"

set dstintf "lo_vpn"

set srcaddr "all"

set dstaddr "lo_winvpn"

set action accept

set schedule "always"

set service "AH" "ALL_ICMP" "ESP" "GRE" "IKE" "L2TP"

next

edit 26

set name "ipsec_winvpn"

set srcintf "internal"

set dstintf "lo_vpn"

set srcaddr "all"

set dstaddr "all"

set action ipsec

set schedule "always"

set service "ALL"

set inbound enable

set vpntunnel "winvpn"

next

edit 27

set name "winvpn"

set srcintf "lo_vpn"

set dstintf "internal"

set srcaddr "windowsvpn_range"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

next

 

I followed the following guide:

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-ipsecvpn-52/L2TP_and_IPsec/Config_FGT_Unit.htm

The public IP address associated with the loopback interface is a routable IP address which responds to ICMP.

Performing a tcpdump on the firewall I can see communication between the client and server over ports 4500, 500, and 1701 although the connection does not establish.

 

Performing the following debug commands also doesn't provide any output when I try to establish the VPN:

diagnose debug application ike -1

diagnose debug application l2tp -1

diagnose debug enable

 

I have also enabled IPsec services on Windows and the error I receive on Windows is "Error 809" which indicates the remote server isn't responding?

 

Any help would be appreciated :)