244 Fortinet Inc.
Configuring L2TP PPTP and L2TP VPN
2Add a new address group to the interface to which L2TP clients connect.
This can be an interface, VLAN subinterface, or zone.
3Enter a Group Name to identify the address group.
The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and
the special characters - and _. Other special characters and spaces are not allowed.
4To add addresses to the address group, select an address from the Available
Addresses list and select the right arrow to add it to the Members list.
5To remove addresses from the address group, select an address from the Members
list and select the left arrow to remove it from the group.
Select OK to add the address group.
Adding a destination address
Add an address to which L2TP users can connect.
1Go to Firewall > Address.
2Select the internal interface or the DMZ interface. (Methods will differ slightly between
FortiGate models.)
3Select New to add an address.
4Enter the Address Name, IP Address, and NetMask for a single computer or for an
entire subnetwork on an internal interface of the local VPN peer.
5Select OK to save the source address.
Adding a firewall policy
Add a policy which specifies the source and destination addresses and sets the
service for the policy to the traffic type inside the L2TP VPN tunnel.
1Go to Firewall > Policy.
2Use the policy grid to choose the policy list to which to add the policy.
3Select New to add a new policy.
4Set Source to the group that matches the L2TP address range.
5Set Destination to the address to which L2TP users can connect.
6Set Service to match the traffic type inside the L2TP VPN tunnel.
For example, if L2TP users can access a web server, select HTTP.
7Set Action to ACCEPT.
8Select NAT if address translation is required.
You can also configure traffic shaping, logging, and antivirus and web filter settings for
L2TP policies.
9Select OK to save the firewall policy.