Technical Tip: How to configure L2TP using interface/route based IPsec VPN

[skaneria]

Description

This article describes how to set up L2TP over IPsec VPN.
L2TP is mostly used by clients who do not wish to install any client (such as FortiClient), but it is necessary to establish a secure and encrypted VPN connection. 
Windows native client can be used for L2TP connection.

There is an option to configure L2TP in interface/route based IPsec VPN.
If WAN load balancing is being used in versions 5.2/5.4/5.6 and there is a need to configure L2TP, interface/route based L2TP can be used to achieve it.

Scope

FortiGate

Solution

config user local
    edit "test"
        set type password
        set passwd 123456
        next
end

config user group
    edit " L2TP_Group"
        set member "test"
    next
end

config vpn l2tp
    set eip 10.10.10.100
    set sip 10.10.10.1
    set status enable
    set usrgrp "L2TP_Group"
end

config vpn ipsec phase1-interface
    edit "L2TP"
        set type dynamic
        set interface "port9"
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set dhgrp 2
        set net-device enable
        set psksecret <password>
    next
end

config vpn ipsec phase2-interface
    edit "L2TP-p2"
        set phase1name "L2TP"
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set pfs disable
        set encapsulation transport-mode
        set l2tp enable
    next
end

config firewall policy
    edit 0
        set name "L2TP policy"
        set srcintf "L2TP"
        set dstintf "virtual-wan-link"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "L2TP"
    next
end

This set-up requires two firewall policies one for LAN access and for Internet access.

For split-tunneling on L2TP/IPSec VPN refer to this article.

config firewall policy
    edit 0
        set name "IPsec policy"
        set srcintf "L2TP"
        set dstintf "LAN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

config firewall policy
    edit 0
        set name "IPsec policy"
        set srcintf "L2TP"
        set dstintf "WAN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"

        set nat enable
    next
end

To configure L2TP over an IPsec tunnel using the GUI:

1. Configure the corresponding user group: User & Authentication > User Groups.

2. Create the users that would use this connection and add it to the group created:

3. Configure l2tp VPN parameters:

4. Configure VPN IPSEC, go to VPN -> IPsec Wizard:

5. Set Authentication parameters:

6. Set Policy & Routing information:

7. Select 'Create':

8. Select 'show tunnel list':

9. Configure the VPN parameters on the corresponding device and then save:

10. Select the VPN configuration and connect it:

11. Confirm that connection has been established successfully on the FortiGate:

To troubleshoot the L2TP over an IPsec connection, refer to this KB article L2TP in IPsec connectivity issues 

Note:

1. If 'net-device' is set to disable, only one unit can establish an L2TP over IPsec tunnel behind the same NAT unit.
2. After upgrading from v6.4.x or v7.0.0 to v7.0.1 and later, L2TP over IPsec configuration needs to be manually updated as outlined in the below article: Technical Tip: Manual upgradation of L2TP over IPsec configuration after upgrading from 6.4.x or 7.0...
3. L2TPv3 is not supported on FortiOS.