Technical Tip: L2TP over IPSec with Split-Tunneling disabled

[FortiArt]

Description	This articles describes how configure L2TP over IPSec with Split-Tunneling disabled and how to adjust some relevant settings to make it work compared to the configuration using the wizard.
Scope	FortiGate.
Solution	How L2TP works: L2TP tunneling initiates a connection between LAC (L2TP Access Concentrator – i.e., Remote User) and LNS (L2TP Network Server – i.e., FortiGate), the protocol’s two endpoints on the Internet. After which, a PPP link layer is enabled and encapsulated, and afterwards it’s carried over the web using a secure connection such as IPSec vpn or other secure connections. In brief, L2TP is an encapsulation protocol that need some secure connection, such as IPSec vpn, to send the traffic securely between the two communicating endpoints. Configuration Steps: Go to VPN - > IPsec Wizard . Enter a VPN Name. In this example, 'Hello'. Configure the following settings for VPN Setup: For Template Type, select Remote Access. For Remote Device Type, select Native and Windows Native. Select 'Next'. Configure the remaining settings as in the following screenshots for authentication, routing, etc. and keep hitting next until the tunnel is created (port1 is the public interface and port2 is the internal interface): After tunnel creation using the wizard, the firewall policies created by wizard will look like: Change the firewall policies to look like the following: Change the service to ALL on the first firewall policy from Hello -> port1. Change NAT to Enabled on the same firewall policy (to allow all Internet traffic). Change NAT to Disabled on the second firewall policy from Hello -> port2 (to be able to see the source IP addresses of the remote users). Results: After configuring the above and the Windows PC the tunnel should come up and activated: Relevant CLI configuration (optional): Enable net-device to allow more than 1 remote connection from behind the same NAT device: Enable enforce-ipsec to force the L2TP to only run over IPSec connection: Sample Outputs (can be used as reference output): Check the status of the L2TP on FGT as per the following: Check the status of the L2TP on the Windows PC as per the following: To debug the L2TP issues, run regular ike, PPP, and L2TP debug commands together, or in the shown order: diagnose debug reset diagnose debug application ike -1 diagnose debug application ppp -1 diagnose debug application l2tp -1 diagnose debug enable To stop the debug, use the command given below: diagnose debug disable diagnose debug reset