fortigate-ipsec-40-mr3

L2TP and IPsec (Microsoft VPN) Configuring the FortiGate unit
To create a user account - CLI
To create a user account called user1 with the password 123_user, you would enter:
config user local
edit user1
set type password
set passwd "123_user"
set status enable
end
Creating a user group
When clients connect using the L2TP-over-IPsec VPN, the FortiGate unit checks their
credentials against the user group you specify for L2TP authentication. You need to
create a firewall user group to use for this purpose.
To create a user group - web-based manager
1 Go to User > User Group > User Group, select Create New, and enter the following
information:
2 Select OK.
Configuring L2TP
Name Type or edit the user group name (for example, L2TP_group).
Type Select Firewall.
Available
Users/Groups
Members
The list of Local users, RADIUS servers, LDAP servers, TACACS+
servers, or PKI users that can be added to the user group. To add a
member to this list, select the name and then select the right arrow
button.
The list of Local users, RADIUS servers, LDAP servers, TACACS+
servers, or PKI users that belong to the user group. To remove a
member, select the name and then select the left arrow button.
To create a user group - CLI
To create the user group L2TP_group and add members User_1, User_2, and User_3,
you would enter:
config user group
edit L2TP_group
set group-type firewall
set member User_1 User_2 User_3
end
You can only configure L2TP settings in the CLI. As well as enabling L2TP, you set the
range of IP address values that are assigned to L2TP clients and specify the user group
that can access the VPN. For example, to allow access to users in the L2TP_group and
assign them addresses in the range 192.168.0.50 to 192.168.0.59, you would enter
config vpn l2tp
set sip 192.168.0.50
set eip 192.168.0.59
set status enable
set usrgrp "L2TP_group"
end
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 201
http://docs.fortinet.com/