Changes

[[File:Configuration examples l2tp over ipsec scheme.png]]

[[File:Configuration examples l2tp over ipsec scheme.png]]

The figure above depicts the L2TP/IPsec scheme. It is fairly similar to the [[L2TP_configuration_examples#Configuration_overview_and_prerequisites|L2TP]] and [[IPsec_configuration_examples#Configuration_overview_and_prerequisites|IPsec]] configuration schemes - the router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the other router (''RUT'') acts a client.  L2TP connects the networks of ''RUT1'' and ''RUT2'' and IPsec provides the encryption for the L2TP tunnel.

The figure above depicts the L2TP/IPsec scheme. It is fairly similar to the [[L2TP configuration examples RutOS#Configuration overview and prerequisites|L2TP]] and [[IPsec RUTOS configuration example#Configuration overview and prerequisites|IPsec]] configuration schemes - the router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the other router (''RUT'') acts a client.  L2TP connects the networks of ''RUT1'' and ''RUT2'' and IPsec provides the encryption for the L2TP tunnel.

When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet.

When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet.

* Login to the router's WebUI and navigate to '''Services → VPN → IPsec'''. Enter a custom name for your IPsec instance and click the "Add" button. Then click the "Edit" button located next to the newly created instance after which you will redirected to that instance's configuration window. Adhere to the configurations presented in the figure below:

* Login to the router's WebUI and navigate to '''Services → VPN → IPsec'''. Enter a custom name for your IPsec instance and click the "Add" button. Then click the "Edit" button located next to the newly created instance after which you will redirected to that instance's configuration window. Adhere to the configurations presented in the figure below:

[[File:L2tp over ipsec ipsec server.png]]

[[File:Networking rutxxx configuration examples ipsec server configuration v1.jpg|border|class=tlt-border]]

* '''Enable''' - if checked, enables the IPsec instance

* '''Enable''' - if checked, enables the IPsec instance

* '''Type''' - the type of the connection. '''Transport''' encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets. NAT traversal is not supported with the transport mode

* '''Type''' - the type of the connection. '''Transport''' encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets. NAT traversal is not supported with the transport mode

* '''Pre shared key''' - a shared password used for authentication between the peers. The value of this field must match the other instance

* '''IKE liftime''' - 8h, make sure you've inserted the same liftime in '''Phase 1''' and '''Phase 2'''

* '''Remote VPN endpoint''' - IP address or hostname of the remote IPsec instance. '''Leave empty''' for the server configuration

====Client (RUT2)====

====Client (RUT2)====

* Create another instance on the second router the same way you created the server (login, add new instance, click "Edit"). Adhere to the configurations presented in the figure below:

* Create another instance on the second router the same way you created the server (login, add new instance, click "Edit"). Adhere to the configurations presented in the figure below:

[[File:L2tp over ipsec ipsec client.png]]

[[File:Networking rutxxx configuration examples ipsec client configuration v1.jpg|border|class=tlt-border]]

* '''Enable''' - if checked, enables the IPsec instance

* '''Enable''' - if checked, enables the IPsec instance

* '''Type''' - the type of the connection. '''Transport''' encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets. NAT traversal is not supported with the transport mode

* '''Type''' - the type of the connection. '''Transport''' encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets. NAT traversal is not supported with the transport mode

* '''Pre shared key''' - a shared password used for authentication between the peers. The value of this field must match the other instance

* '''IKE liftime''' - 8h, make sure you've inserted the same liftime in '''Phase 1''' and '''Phase 2'''

* '''Remote VPN endpoint''' - IP address or hostname of the remote IPsec instance. Enter the '''IPsec server's Public IP address''' in the client's configuration

====Testing the connection====

====Testing the connection====

When you're done with the configuration, you should test whether it works before you move on. The simplest way to test an IPsec connection is using the '''ipsec status''' command. You can execute this command via a command line interface (CLI). A CLI is present in all RUTxxx routers' WebUIs. To access it, login to one of the routers' WebUI (doesn't matter which one) and navigate to '''Services → CLI'''. Login to CLI with the user name '''root''' and the router's admin password. Then simply the ''ipsec status'' and press the "Enter" key:

When you're done with the configuration, you should test whether it works before you move on. The simplest way to test an IPsec connection is using the '''ipsec status''' command. You can execute this command via a command line interface (CLI). A CLI is present in all RUTxxx routers' WebUIs. To access it, login to one of the routers' WebUI (doesn't matter which one) and navigate to '''Services → CLI'''. Login to CLI with the user name '''root''' and the router's admin password. Then simply the ''ipsec status'' and press the "Enter" key:

[[File:Testing ipsec transport example.png]]

[[File:Networking rutxxx configuration examples ipsec status v1.jpg|border|class=tlt-border]]

As you can see, executing ''ipsec status'' displays the number of active/inactive IPsec connections. If the connection you just configured is the only IPsec connection that you're using, you should a '''1 up''' indication next to Security Associations.

As you can see, executing ''ipsec status'' displays the number of active/inactive IPsec connections. If the connection you just configured is the only IPsec connection that you're using, you should a '''1 up''' indication next to Security Associations.

* '''Server configuration''':

* '''Server configuration''':

[[File:L2tp over ipsec l2tp server configuration.png]]

[[File:Networking rutxxx configuration examples l2tp server configuration.jpg|border|class=tlt-border|1100px]]

* '''Enable''' - when checked, enables the instance

* '''Enable''' - when checked, enables the instance

* '''Client configuration''':

* '''Client configuration''':

[[File:L2tp over ipsec l2tp client configuration.png]]

[[File:Networking rutxxx configuration l2tp client configuration v1.jpg|border|class=tlt-border|1100px]]

* '''Enable''' - when checked, enables the instance

* '''Enable''' - when checked, enables the instance

If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. We already tested the IPsec connection in the '''[[L2TP_over_IPsec#Testing_the_connection|3.1.3]]''' section of this article. To test an L2TP connection, login to one of the routers' WebUIs and go to '''Services → CLI'''. Login with user name: '''root''' and the router's admin password. You should then be able to '''ping''' the opposite instance, i.e., if you logged in to the server's CLI, you should be able to ping the client's virtual IP address, and vice versa. To use a ping command, type '''ping <ip_address>''' and press the "Enter" key on your keyboard:

If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. We already tested the IPsec connection in the '''[[L2TP_over_IPsec#Testing_the_connection|3.1.3]]''' section of this article. To test an L2TP connection, login to one of the routers' WebUIs and go to '''Services → CLI'''. Login with user name: '''root''' and the router's admin password. You should then be able to '''ping''' the opposite instance, i.e., if you logged in to the server's CLI, you should be able to ping the client's virtual IP address, and vice versa. To use a ping command, type '''ping <ip_address>''' and press the "Enter" key on your keyboard:

[[File:Configuration example l2tp pptp testing.png]]

[[File:Networking rutxxx configuration examples l2tp over ipsec ping v1.jpg|border|class=tlt-border]]

If the ping requests are successful, congratulations, your setup works! If not, we suggest that you review all steps once more.

If the ping requests are successful, congratulations, your setup works! If not, we suggest that you review all steps once more.