windows 10 vpn l2tp over ipsec not connected

hi,

i assume that the Mikrotik is behind the FortiGate w/ a private IP addreess.

on the FGT you need to create a VIP ( port forward ) with the public IP of the FGT 193.x.x.x , one UDP/1701 

e.g.

config firewall vip
    edit "L2TP_UDP_1701"
        set extip <Public_IP>
        set extintf "any"
        set mappedip <Internal_VPN_Server_IP>
        set extport 1701
        set mappedport 1701
        set protocol "udp"
    next
end

then create firewall policy using the source interface WAN , destination interface - where the mikrotik is connected , source all ( or restrict to certain countries or public IPs ) and destination the VIP created previously, service all - then test again.

L.E.

my question now will be, you do you need another VPN on top of an existing VPN connection?

“my question now will be, you do you need another VPN on top of an existing VPN connection?  “ answere —- i  not need anothe vpn ,i also have set ssl_vpn for forticlient and ipsec between two fortigate .its all about vpn

Hi ​@cucuvea25 ,

Based on my understanding, it appears that the MikroTik device is positioned behind the FortiGate. Could you provide the MikroTik's IP address and clarify the exact connection setup between the remote FortiGate and the MikroTik router?

Additionally, could you please confirm if you are able to ping the MikroTik's IP address (the one used for establishing the L2TP connection) through the IPsec tunnel?

In this scenario, it seems that the FortiGate is acting as a pass-through for the L2TP WAN connection via the IPsec tunnel. Please ensure that the relevant traffic is included in the Phase 2 selectors. You may also consider capturing packets with a sniffer to analyze the flow and identify where packets may be getting dropped.

Run the following command on both FortiGate devices simultaneously to see the connection and capture traffic:
# diagnose sniffer packet any "host x.x.x.x and host y.y.y.y" 6 0 l
 
Please confirm whether any source NAT is being applied to the PC before the traffic is forwarded through the tunnel. If not, mention the actual source IP address.

Note: Replace x.x.x.x with the source IP address and y.y.y.y with the MikroTik IP address.
 

Mikrotik ip public is 194.xx.xx.xx, between mikrotik and fortigate is not set l2tp tunel,ping is able from fortigate  to mikrotik .