Fortinet black logo

Cookbook

L2TP over IPsec

Copy Link
Copy Doc ID af0e75e9-211f-11ea-9384-00505692583a:386346
Download PDF

L2TP over IPsec

This is an example of L2TP over IPsec.

This example uses a locally defined user for authentication, a Windows PC or Android tablet as the client, and net‑device is set to enable in the phase1‑interface settings. If net-device is set to disable, only one device can establish an L2TP over IPsec tunnel behind the same NAT device.

To configure L2TP over an IPsec tunnel using the GUI:
  1. Go to VPN > IPsec Wizard.

  2. Enter a VPN Name. In this example, L2tpoIPsec.
  3. configure the following settings for VPN Setup:
    1. For Template Type, select Remote Access.
    2. For Remote Device Type, select Native and Windows Native.
    3. Click Next.
  4. Configure the following settings for Authentication:
    1. For Incoming Interface, select port9.
    2. For Authentication Method, select Pre-shared Key.
    3. In the Pre-shared Key field, enter your-psk as the key.
    4. For User Group, select L2tpusergroup
    5. Click Next.
  5. Configure the following settings for Policy & Routing:
    1. From the Local Interface dropdown menu, select port10.
    2. Configure the Local Address as 172.16.101.0.
    3. Configure the Client Address Range as 10.10.10.1-10.10.10.100.
    4. Leave the Subnet Mask at its default value.
    5. Click Create.
To configure L2TP over an IPsec tunnel using the CLI:
  1. Configure the WAN interface and static route on HQ.
    config system interface
        edit "port9"
            set alias "WAN"
            set ip 22.1.1.1 255.255.255.0
        next
        edit "port10"
            set alias "Internal"
            set ip 172.16.101.1 255.255.255.0
        next
    end   
    config router static
        edit 1
            set gateway 22.1.1.2
            set device "port9"
        next  
    end   
  2. Configure IPsec phase1-interface and phase2-interface on HQ.
    config vpn ipsec phase1-interface
        edit "L2tpoIPsec"
            set type dynamic
            set interface "port9"
            set peertype any
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set dpd on-idle
            set dhgrp 2
            set net-device enable
            set psksecret sample
            set dpd-retryinterval 60
        next
    end
    config vpn ipsec phase2-interface
        edit "L2tpoIPsec"
            set phase1name "L2tpoIPsec"
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set pfs disable
            set encapsulation transport-mode
            set l2tp enable
        next
    end
  3. Configure a user and user group on HQ.
    config user local
        edit "usera"
            set type password
            set passwd usera
            next
    end
    config user group
        edit "L2tpusergroup"
            set member "usera"
        next
    end
  4. Configure L2TP on HQ.
    config vpn l2tp
        set status enable
        set eip 10.10.10.100
        set sip 10.10.10.1
        set usrgrp "L2tpusergroup"
    end
  5. Configure a firewall address that is applied in L2TP settings to assign IP addresses to clients once the L2TP tunnel is established.
    config firewall address
        edit "L2TPclients"
            set type iprange
            set start-ip 10.10.10.1
            set end-ip 10.10.10.100
        next
    end
  6. Configure a firewall policy.
    config firewall policy
        edit 1
            set name "Bridge_IPsec_port9_for_l2tp negotiation"
            set srcintf "L2tpoIPsec"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "L2TP"
        next
        edit 2
            set srcintf "L2tpoIPsec"
            set dstintf "port10"
            set srcaddr "L2TPclients"
            set dstaddr "172.16.101.0"
            set action accept
            set schedule "always"
            set service "ALL"
            set nat enable
        next
    end
To view the VPN tunnel list on HQ:
diagnose vpn tunnel list

list all ipsec tunnel in vd 0
----
name=L2tpoIPsec_0 ver=1 serial=8 22.1.1.1:0->10.1.100.15:0
bound_if=4 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/216 options[00d8]=npu create_dev no-sysctl rgwy-chg 
 parent=L2tpoIPsec index=0
proxyid_num=1 child_num=0 refcnt=13 ilast=0 olast=0 ad=/0
stat: rxp=470 txp=267 rxb=57192 txb=12679
dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=L2tpoIPsec proto=17 sa=1 ref=3 serial=1 transport-mode add-route
  src: 17:22.1.1.1-22.1.1.1:1701
  dst: 17:10.1.100.15-10.1.100.15:0
  SA:  ref=3 options=1a6 type=00 soft=0 mtu=1470 expire=2339/0B replaywin=2048
       seqno=10c esn=0 replaywin_lastseq=000001d6 itn=0
  life: type=01 bytes=0/0 timeout=3585/3600
  dec: spi=ca646443 esp=3des key=24 af62a0fffe85d3d534b5bfba29307aafc8bfda5c3f4650dc
       ah=sha1 key=20 89b4b67688bed9be49fb86449bb83f8c8d8d7432
  enc: spi=700d28a0 esp=3des key=24 5f68906eca8d37d853814188b9e29ac4913420a9c87362c9
       ah=sha1 key=20 d37f901ffd0e6ee1e4fdccebc7fdcc7ad44f0a0a
  dec:pkts/bytes=470/31698, enc:pkts/bytes=267/21744
  npu_flag=00 npu_rgwy=10.1.100.15 npu_lgwy=22.1.1.1 npu_selid=6 dec_npuid=0 enc_npuid=0
----
name=L2tpoIPsec_1 ver=1 serial=a 22.1.1.1:4500->22.1.1.2:64916
bound_if=4 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/472 options[01d8]=npu create_dev no-sysctl rgwy-chg rport-chg 
 parent=L2tpoIPsec index=1
proxyid_num=1 child_num=0 refcnt=17 ilast=2 olast=2 ad=/0
stat: rxp=5 txp=4 rxb=592 txb=249
dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=0
natt: mode=keepalive draft=32 interval=10 remote_port=64916
proxyid=L2tpoIPsec proto=17 sa=1 ref=3 serial=1 transport-mode add-route
  src: 17:22.1.1.1-22.1.1.1:1701
  dst: 17:22.1.1.2-22.1.1.2:0
  SA:  ref=3 options=1a6 type=00 soft=0 mtu=1454 expire=28786/0B replaywin=2048
       seqno=5 esn=0 replaywin_lastseq=00000005 itn=0
  life: type=01 bytes=0/0 timeout=28790/28800
  dec: spi=ca646446 esp=aes key=32 ea60dfbad709b3c63917c3b7299520ff7606756ca15d2eb7cbff349b6562172e
       ah=md5 key=16 2f2acfff0b556935d0aab8fc5725c8ec
  enc: spi=0b514df2 esp=aes key=32 a8a92c2ed0e1fd7b6e405d8a6b9eb3be5eff573d80be3f830ce694917d634196
       ah=md5 key=16 e426c33a7fe9041bdc5ce802760e8a3d
  dec:pkts/bytes=5/245, enc:pkts/bytes=4/464
  npu_flag=00 npu_rgwy=22.1.1.2 npu_lgwy=22.1.1.1 npu_selid=8 dec_npuid=0 enc_npuid=0
To view the L2TP VPN status:
diagnose debug enable
diagnose vpn l2tp status
----
----

HQ # Num of tunnels: 2
----
Tunnel ID = 1 (local id), 42 (remote id)  to 10.1.100.15:1701 
   control_seq_num = 2, control_rec_seq_num = 4,
   last recv pkt = 2
Call ID = 1 (local id), 1 (remote id), serno = 0, dev=ppp1,
      assigned ip = 10.10.10.2
      data_seq_num = 0,
      tx = 152 bytes (2), rx= 21179 bytes (205)
Tunnel ID = 3 (local id), 34183 (remote id)  to 22.1.1.2:58825 
   control_seq_num = 2, control_rec_seq_num = 4,
   last recv pkt = 2
Call ID = 3 (local id), 18820 (remote id), serno = 2032472593, dev=ppp2,
      assigned ip = 10.10.10.3
      data_seq_num = 0,
      tx = 152 bytes (2), rx= 0 bytes (0)
----
--VD 0: Startip = 10.10.10.1, Endip = 10.10.10.100
        enforece-ipsec = false
----

L2TP over IPsec

This is an example of L2TP over IPsec.

This example uses a locally defined user for authentication, a Windows PC or Android tablet as the client, and net‑device is set to enable in the phase1‑interface settings. If net-device is set to disable, only one device can establish an L2TP over IPsec tunnel behind the same NAT device.

To configure L2TP over an IPsec tunnel using the GUI:
  1. Go to VPN > IPsec Wizard.

  2. Enter a VPN Name. In this example, L2tpoIPsec.
  3. configure the following settings for VPN Setup:
    1. For Template Type, select Remote Access.
    2. For Remote Device Type, select Native and Windows Native.
    3. Click Next.
  4. Configure the following settings for Authentication:
    1. For Incoming Interface, select port9.
    2. For Authentication Method, select Pre-shared Key.
    3. In the Pre-shared Key field, enter your-psk as the key.
    4. For User Group, select L2tpusergroup
    5. Click Next.
  5. Configure the following settings for Policy & Routing:
    1. From the Local Interface dropdown menu, select port10.
    2. Configure the Local Address as 172.16.101.0.
    3. Configure the Client Address Range as 10.10.10.1-10.10.10.100.
    4. Leave the Subnet Mask at its default value.
    5. Click Create.
To configure L2TP over an IPsec tunnel using the CLI:
  1. Configure the WAN interface and static route on HQ.
    config system interface
        edit "port9"
            set alias "WAN"
            set ip 22.1.1.1 255.255.255.0
        next
        edit "port10"
            set alias "Internal"
            set ip 172.16.101.1 255.255.255.0
        next
    end   
    config router static
        edit 1
            set gateway 22.1.1.2
            set device "port9"
        next  
    end   
  2. Configure IPsec phase1-interface and phase2-interface on HQ.
    config vpn ipsec phase1-interface
        edit "L2tpoIPsec"
            set type dynamic
            set interface "port9"
            set peertype any
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set dpd on-idle
            set dhgrp 2
            set net-device enable
            set psksecret sample
            set dpd-retryinterval 60
        next
    end
    config vpn ipsec phase2-interface
        edit "L2tpoIPsec"
            set phase1name "L2tpoIPsec"
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set pfs disable
            set encapsulation transport-mode
            set l2tp enable
        next
    end
  3. Configure a user and user group on HQ.
    config user local
        edit "usera"
            set type password
            set passwd usera
            next
    end
    config user group
        edit "L2tpusergroup"
            set member "usera"
        next
    end
  4. Configure L2TP on HQ.
    config vpn l2tp
        set status enable
        set eip 10.10.10.100
        set sip 10.10.10.1
        set usrgrp "L2tpusergroup"
    end
  5. Configure a firewall address that is applied in L2TP settings to assign IP addresses to clients once the L2TP tunnel is established.
    config firewall address
        edit "L2TPclients"
            set type iprange
            set start-ip 10.10.10.1
            set end-ip 10.10.10.100
        next
    end
  6. Configure a firewall policy.
    config firewall policy
        edit 1
            set name "Bridge_IPsec_port9_for_l2tp negotiation"
            set srcintf "L2tpoIPsec"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "L2TP"
        next
        edit 2
            set srcintf "L2tpoIPsec"
            set dstintf "port10"
            set srcaddr "L2TPclients"
            set dstaddr "172.16.101.0"
            set action accept
            set schedule "always"
            set service "ALL"
            set nat enable
        next
    end
To view the VPN tunnel list on HQ:
diagnose vpn tunnel list

list all ipsec tunnel in vd 0
----
name=L2tpoIPsec_0 ver=1 serial=8 22.1.1.1:0->10.1.100.15:0
bound_if=4 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/216 options[00d8]=npu create_dev no-sysctl rgwy-chg 
 parent=L2tpoIPsec index=0
proxyid_num=1 child_num=0 refcnt=13 ilast=0 olast=0 ad=/0
stat: rxp=470 txp=267 rxb=57192 txb=12679
dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=L2tpoIPsec proto=17 sa=1 ref=3 serial=1 transport-mode add-route
  src: 17:22.1.1.1-22.1.1.1:1701
  dst: 17:10.1.100.15-10.1.100.15:0
  SA:  ref=3 options=1a6 type=00 soft=0 mtu=1470 expire=2339/0B replaywin=2048
       seqno=10c esn=0 replaywin_lastseq=000001d6 itn=0
  life: type=01 bytes=0/0 timeout=3585/3600
  dec: spi=ca646443 esp=3des key=24 af62a0fffe85d3d534b5bfba29307aafc8bfda5c3f4650dc
       ah=sha1 key=20 89b4b67688bed9be49fb86449bb83f8c8d8d7432
  enc: spi=700d28a0 esp=3des key=24 5f68906eca8d37d853814188b9e29ac4913420a9c87362c9
       ah=sha1 key=20 d37f901ffd0e6ee1e4fdccebc7fdcc7ad44f0a0a
  dec:pkts/bytes=470/31698, enc:pkts/bytes=267/21744
  npu_flag=00 npu_rgwy=10.1.100.15 npu_lgwy=22.1.1.1 npu_selid=6 dec_npuid=0 enc_npuid=0
----
name=L2tpoIPsec_1 ver=1 serial=a 22.1.1.1:4500->22.1.1.2:64916
bound_if=4 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/472 options[01d8]=npu create_dev no-sysctl rgwy-chg rport-chg 
 parent=L2tpoIPsec index=1
proxyid_num=1 child_num=0 refcnt=17 ilast=2 olast=2 ad=/0
stat: rxp=5 txp=4 rxb=592 txb=249
dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=0
natt: mode=keepalive draft=32 interval=10 remote_port=64916
proxyid=L2tpoIPsec proto=17 sa=1 ref=3 serial=1 transport-mode add-route
  src: 17:22.1.1.1-22.1.1.1:1701
  dst: 17:22.1.1.2-22.1.1.2:0
  SA:  ref=3 options=1a6 type=00 soft=0 mtu=1454 expire=28786/0B replaywin=2048
       seqno=5 esn=0 replaywin_lastseq=00000005 itn=0
  life: type=01 bytes=0/0 timeout=28790/28800
  dec: spi=ca646446 esp=aes key=32 ea60dfbad709b3c63917c3b7299520ff7606756ca15d2eb7cbff349b6562172e
       ah=md5 key=16 2f2acfff0b556935d0aab8fc5725c8ec
  enc: spi=0b514df2 esp=aes key=32 a8a92c2ed0e1fd7b6e405d8a6b9eb3be5eff573d80be3f830ce694917d634196
       ah=md5 key=16 e426c33a7fe9041bdc5ce802760e8a3d
  dec:pkts/bytes=5/245, enc:pkts/bytes=4/464
  npu_flag=00 npu_rgwy=22.1.1.2 npu_lgwy=22.1.1.1 npu_selid=8 dec_npuid=0 enc_npuid=0
To view the L2TP VPN status:
diagnose debug enable
diagnose vpn l2tp status
----
----

HQ # Num of tunnels: 2
----
Tunnel ID = 1 (local id), 42 (remote id)  to 10.1.100.15:1701 
   control_seq_num = 2, control_rec_seq_num = 4,
   last recv pkt = 2
Call ID = 1 (local id), 1 (remote id), serno = 0, dev=ppp1,
      assigned ip = 10.10.10.2
      data_seq_num = 0,
      tx = 152 bytes (2), rx= 21179 bytes (205)
Tunnel ID = 3 (local id), 34183 (remote id)  to 22.1.1.2:58825 
   control_seq_num = 2, control_rec_seq_num = 4,
   last recv pkt = 2
Call ID = 3 (local id), 18820 (remote id), serno = 2032472593, dev=ppp2,
      assigned ip = 10.10.10.3
      data_seq_num = 0,
      tx = 152 bytes (2), rx= 0 bytes (0)
----
--VD 0: Startip = 10.10.10.1, Endip = 10.10.10.100
        enforece-ipsec = false
----