Dialup IPSEC/L2TP VPN to resources behind FG

[FransUrbo]

I'd like to connect to my FortiGate 50E at home from work and access all my resources at home.

I've managed to get my OSX laptop to connect and authenticate properly, but I don't get a route on the laptop, nor is there a DNS server added.

I've recently replaced a home-made VPN/NAT/IPSEC gateway based on Linux that I setup years ago. It used OpenSwan and there I added local networks and had it send the local IP of the VPN tunnel as DNS server to the client.

However, I'm not sure how to do this with FortiOS (v5.4). I created my VPN using the "Dialup - Android (Native L2TP/IPsec)" template, setup phase1 and phase2 (correctly I though, but apparently not):

    FortiGate # show vpn ipsec phase1-interface     config vpn ipsec phase1-interface          edit "L2TP IPSEC"             set type dynamic             set interface "wan1"             set peertype any             set mode-cfg enable             set proposal aes256-md5 3des-sha1 aes192-sha1             set dpd on-idle             set comments "VPN: L2TP IPSEC (Created by VPN wizard)"             set dhgrp 2             set ipv4-start-ip 192.168.6.1             set ipv4-end-ip 192.168.6.254             set dns-mode auto             set ipv4-split-include "local_network_lan"             set unity-support disable             set psksecret REMOVED

        next     end

    FortiGate # show vpn ipsec phase2-interface     config vpn ipsec phase2-interface         edit "L2TP IPSEC"             set phase1name "L2TP IPSEC"             set proposal aes256-md5 3des-sha1 aes192-sha1             set pfs disable             set encapsulation transport-mode             set l2tp enable             set comments "VPN: L2TP IPSEC (Created by VPN wizard)"             set keylifeseconds 3600         next         edit "cluster"             set phase1name "L2TP IPSEC"             set src-subnet 10.0.4.0 255.255.0.0         next         edit "lan"             set phase1name "L2TP IPSEC"             set src-subnet 192.168.69.0 255.255.255.0         next     end

The networks 10.0.0.0/16 and 192.168.69.0/24 are some of the networks I have at home. But no matter if I put them as *src-subnet* or *dst-subnet*, the result is the same - no route on the laptop.

And I have no idea where to specify that the VPN should "send" the local end of the VPN tunnel as a DNS server.

If I manually add a network route with the gw of the other end of the VPN tunnel on my laptop, I can access all my resources, but only with the IP..   So the VPN works, it's just that it won't broadcast a route or name server to the laptop/clients.

[FransUrbo]

If I manually add a network route with the gw of the other end of the VPN tunnel on my laptop, I can access all my resources, but only with the IP..

So the VPN works, it's just that it won't broadcast a route or name server to the laptop/clients.