Troubleshooting Tip: Window Native L2TP Disconnected Immediately after Connected

[btey]

Description	This article describes the issue of Windows Native L2TP disconnecting immediately after connection, the troubleshooting steps, and a possible workaround.
Scope	Window native L2TP VPN.
Solution	Verify the tunnel list, and it's status using the following commands: diagnose vpn l2tp status diagnose vpn l2tp tunnel <IPv4 address of client>  (all if don't specify) The  IPsec connection shows u,p, and L2TP information has been negotiated. The PPP link shows up. After 1 second, the following message appear: Run IKE and L2TP debug from FortiGate: diagnose debug application ike -1 diagnose debug application l2tp -1 diagnose debug enable To stop the debug, use the command given below: diagnose debug disable diagnose debug reset l2tp_handle_ppp_packet()-197: l2tp_ppp_recv()-525: tunnel=1 (len=20) RCV: LCP Termiate_Request id(11) len(16) LCP terminated by peer <-- Connection terminated by client. ipcp: down ppp:0x7f3070610800 caller:0xb5550d8 tun:-1 SND: LCP Terminate_Ack id(11) len(4) l2tp_ppp_send()-345: tunnel=1 l2tp_ppp_down()-330: PPP link is down (tun=1) caller_data=0xb5550d8 tear_down_tunnel()-488: closing down tunnel 1 Run the ESP packet capture and decrypt the packet. It will show the following: Client trying to access www.msftconnecttest.com before sending the termination request.   L2TP disconnection will happen when the connection to www.msftconnecttest.com asks for authentication as below: Resolution: Allow access to www.msftconnecttest.com with a captive portal exemption or authentication exemption. Related documents: Technical Tip: Decrypt ESP packets Troubleshooting Tip: L2TP in IPsec connectivity issues Technical Tip: Dial_up Native VPN (L2TP) is no longer supported in Android 13 and above android vers...