L2TP over IPsec

Creating a User Group

To create a VPN tunnel via IPsec, you need to create users who will be granted access and combine them into a group. The process for creating users and groups is similar to the previous section.

IPSec Wizard

To configure L2TP over an IPsec tunnel:

1. Go to VPN → IPsec Wizard.

2. Select the Remote Access template type.

3. For Remote Device Type, select Native and Windows Native.

4. In the Name field, enter a name for the tunnel.

5. Specify the Incoming Interface to which connections will come (in this case, it is wan1).

6. Select Pre-shared Key in Authentication Method and enter the value of the secret key in the field below. In the future, this key will need to be entered on the client when configuring a VPN connection.

7. In the User Group parameter, enter the group you created under Creating a User Group.

8. At the Policy & Routing stage, specify the local interface to which remote clients will connect, in the drop-down menu.

9. In the Local Address parameter, specify the subnet to which users will have access. In this case, the all address object is selected.

10. To select a specific subnet, click + and select an address from the existing ones.

11. To create an address in the pop-up window, click Create or Policy & Objects → Addresses → Create New.

12. In the Client Address Range field, specify the pool of addresses that will be assigned to remote clients upon connection.

13. Make sure that these addresses don’t match the internal addressing.

14. Leave the default Subnet Mask.

15. Click Create.

After that, a tunnel is created, and a summary of created objects appears on the screen.

Configuring a Connection on a Windows client

To configure a VPN connection in Windows:

1. Go to Network and Sharing Center → Set up a new connection or network .
2. Select Connect to a workplace in the new window, then — Use my Internet connection (VPN).
3. Enter the FortiGate IP address in the Internet address field.
4. Enter a name for the connection in the Destination name field.
5. After that, the created connection will appear among the available networks.
6. Go to the Change adapter settings tab in the Network and Sharing Center window.
7. Select the created VPN connection from the networks that appear.
8. Right-click Properties.
9. Go to the Security tab in the Properties window.
10. Select Layer 2 Tunneling Protocol with IPsec (L2TP/IPsec) in the Type of VPN parameter.
11. Go to Advanced settings.
12. Select the Use preshared for authentication parameter.
13. Enter the secret key value that was entered earlier when configuring the tunnel in the Key field.
14. Click OK to connect.
15. Enter the username you created earlier and the password.