FortiGate and Windows L2TP / IPsec with Split Tunneling

 Problem

In some scenarios, the user does not want to install an additional VPN client on their device, but use the already built-in one from Windows.

Thus, the FortiGate SSL VPN solution cannot be used.

So that only systems behind the FortiGate unit are accessible, a split tunnel connection must be established.

Solution

The L2TP over IPsec VPN solution is used for this purpose. First an IPsec connection is established between the client and FortiGate and then an L2TP connection is established. This is authenticated via a PSK and L2TP via username and password.

The following steps are necessary to implement this solution.

IPsec Connection

config vpn ipsec phase1-interface
    edit "Dialup"
        set type dynamic
        set interface "wan"
        set peertype any
        set net-device disable
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set dhgrp 2
        set wizard-type dialup-windows
        set psksecret ****
	next
end
config vpn ipsec phase2-interface
    edit "Dialup"
        set phase1name "Dialup"
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set pfs disable
        set encapsulation transport-mode
        set l2tp enable
        set keylifeseconds 3600
    next
end

• type: set as dialup tunnel
• dhgrp: set DH-Group (Windows support only DH Group 2)
• psksecret: Set your PSK for the IPsec connection
• encapsulation: set it to transport-mode
• l2tp: enable to use L2TP over IPsec

Firewall-Policy

As usual with the FortiGate, a firewall policy is required for the allowed connection between VPN clients and the systems behind the firewall.

Important: Use the "l2t.root" Interface!

config firewall policy
    edit 0
        set name "vpn_Dialup_remote_0"
        set srcintf "l2t.root"
        set dstintf "lan"
        set action accept
        set srcaddr "Dialup_range"
        set dstaddr "192.168.1.0/24"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

l2t.root Interface

This interface need the first IP address of your 

Push Routes to Client

Without this step you have to add the routes on the client manually. With this solution you are able to push needed routes to the Client.

This solution works from FortiOS 7.0.1 and above.

Fortinet Community Entry