Configuring Google Android L2TP VPN Client Access

This section provides a configuration example for enabling L2TP client access to WAN GroupVPN SA using the built-in L2TP Server and Google Android’s L2TP VPN Client.

To enable Google Android L2TP VPN Client access to WAN GroupVPN SA, perform the following steps:
1
Navigate to the VPN > Settings page.
2
For the WAN GroupVPN policy, click the Configure icon. The VPN Policy dialog displays.

3
Select IKE using Preshared Secret (default) from the Authentication Method drop-down menu.
4
Enter a shared secret passphrase in the Shared Secret field to complete the client policy configuration.
5
Click the Proposals tab.

6
Provide the following settings for IKE (Phase 1) Proposal:
•
DH Group: Group 2
•
Encryption: 3DES
•
Authentication: SHA1
•
Life Time (seconds): 28800
7
Provide the following settings for IPsec (Phase 2) Proposal:
•
Protocol: ESP
•
Encryption: DES
•
Authentication: SHA1
•
Enable Perfect Forward Secrecy: Enabled
•
Life Time (seconds): 28800
8
Click the Advanced tab.

9
Provide the following settings:
•
Enable Windows Networking (NetBIOS) Broadcast: Enabled
•
Enable Multicast: Disabled
•
Management via this SA: Disabled all
•
Default Gateway: 0.0.0.0
•
Require authentication of VPN clients by XAUTH: Enabled
•
User group for XAUTH users: Trusted Users
10
In the Client tab, provide the following settings:
•
Cache XAUTH User Name and Password on Client: Single Session or Always
•
Virtual Adapter setting: DHCP Lease
•
Allow Connections to: Split Tunnels
•
Set Default Route as this Gateway: Disabled
•
Use Default Key for Simple Client Provisioning: Enabled
11
Navigate to the VPN > L2TP Server page. In the L2TP Server Settings section, click the Enable the L2TP Server checkbox. And click the Configure button. The L2TP Server Settings configuration page displays.
12
Provide the following L2TP server settings:
•
Keep alive time (secs): 60
•
DNS Server 1: 199.2.252.10 (or use your ISPs DNS)
•
DNS Server 2: 4.2.2.2 (or use your ISPs DNS)
•
DNS Server 3: 0.0.0.0 (or use your ISPs DNS)
•
WINS Server 1: 0.0.0.0 (or use your WINS IP)
•
WINS Server 2: 0.0.0.0 (or use your WINS IP)
13
Provide the IP address settings:
•
IP address provided by RADIUS/LDAP Server: Disabled
•
Use the Local L2TP IP Pool: Enabled
•
Start IP: 10.20.0.1 (example)
•
End IP: 10.20.0.20 (example)
* 
NOTE: Use any unique private range.
14
In the L2TP Users section, select Trusted Users from the User Group for L2TP Users drop-down menu.
15
Navigate to the Users > Local Users page. Click the Add User button.
16
In the Settings tab, specify a user name and password.
17
In the VPN Access tab, add the desired network address object(s) that the L2TP clients to the access list networks.
* 
NOTE: At the minimum add the LAN Subnets, LAN Primary Subnet, and L2TP IP Pool address objects to the access list.
* 
NOTE: You have now completed the SonicOS configuration.
18
On your Google Android device, complete the following L2TP VPN Client configuration to enable secure access:
•
Navigate to the APP page, and select the Settings icon. From the Settings menu, select Wireless & networks.
•
Select VPN Settings, and click Add VPN.
•
Select Add L2TP/IPSec PSK VPN.
•
VPN Name: enter a VPN friendly name
•
Set VPN Server: enter the public IP address of firewall
•
Set IPSec pre-shared key: enter the passphrase for your WAN GroupVPN policy
•
L2TP secret: leave blank
•
LAN domain: optional setting
•
Enter your XAUTH username and password. Click Connect.
19
Verify your Google Android device is connected by navigating to the VPN > Settings page. The VPN client is displayed in the Currently Active VPN Tunnels section.