Fortinet FortiGate 100 Installation & Configuration Manual page 216

Configuring the FortiGate unit as a L2TP gateway
216
3 Enter a Group Name to identify the address group.
The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and
the special characters - and _. Other special characters and spaces are not allowed.
4 To add addresses to the address group, select an address from the Available
Addresses list and select the right arrow to add it to the Members list.
5 To remove addresses from the address group, select an address from the Members
list and select the left arrow to remove it from the group.
Select OK to add the address group.
Adding a destination address
Add an address to which L2TP users can connect.
1 Go to Firewall > Address.
2 Select the internal interface or the DMZ interface. (Methods will differ slightly between
FortiGate models.)
3 Select New to add an address.
4 Enter the Address Name, IP Address, and NetMask for a single computer or for an
entire subnetwork on an internal interface of the local VPN peer.
5 Select OK to save the source address.
Adding a firewall policy
Add a policy which specifies the source and destination addresses and sets the
service for the policy to the traffic type inside the L2TP VPN tunnel.
1 Go to Firewall > Policy.
2 Select the policy list to which you want to add the policy.
3 Select New to add a new policy.
4 Set Source to the group that matches the L2TP address range.
5 Set Destination to the address to which L2TP users can connect.
6 Set Service to match the traffic type inside the L2TP VPN tunnel.
For example, if L2TP users can access a web server, select HTTP.
7 Set Action to ACCEPT.
8 Select NAT if address translation is required.
You can also configure traffic shaping, logging, and antivirus and web filter settings for
L2TP policies.
9 Select OK to save the firewall policy.
PPTP and L2TP VPN
Fortinet Inc.