IPSec VPN- Layer 2

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPSec VPN- Layer 2

L1 Bithead


i'm using this ressource to configure Site-to-Site IPSec VPN in Layer 2 with a PA-200.

Of course, it's not working this is why i'm here with a lot a questions.

edit: it's working now


1/ i'm assuming the left part of the diagram is considering as the client and the right part as the IPSEC server.

so in Network Profiles/IKE Gateways, L2side object, i checked "Enable NAT Traversal"

edit: it seem i didn't need this checked, so let take the default


2/ is there a public web site i can check to make sure the client router is VPN passthrought ?

There is no option in it to enable or disable this.


3/ on the client router, should i forward ports UDP/500 and UDP/4500 ?

I don't have option to forward ESP or AH.

edit: i didn't forward any ports


4/ i suppose devices on the client LAN must have a route to join pointing to

edit: correct


5/ i'm trying to ping but it's not working, either from L2trust or L2untrust.

When i'm connected to the PA-200 in SSH, i can ping it.

edit: I added a management profile with ping permitted on interface vlan.1 and now it's OK.


6/ let's talk about the rules i have to setup :

currently i have these :

From L2trust/Any to L2untrust/Any : ACCEPT

From L2untrust/Any to L2trust/Any : ACCEPT

From untrust/ to VPN/ : ACCEPT

From VPN/ to untrust/ : ACCEPT

No NAT rules.


7/ i don't understand the tunnel.1 IP address

What is it and how is it related to the IPSEC server ?

edit: there is an error in the document, i used


8/ my IPSEC server is a Fortigate.

It currently have another IPSEC tunnel which is working.

I made a static route for

I have rules to permit all.

On Fortigate, IPSec tunnel is down and on PA-200, L2sideipsec is in red state.

I can provide screenshots of Fortigate configuration, i tried main and aggressive configuration, IKE 1 and 2.

edit: i used aggressive mode

had to use Peer Identification on L2side


9/ when i do a "show network vlan test", i don't have l3-forwading enabled.

How could i do that from GUI or CLI ?

edit: didn't use this part


10/ it seems that these 2 zones : vlan and trust have no use so i deleted theses.


I'm currently still searching but could take any help and answer any question.


edit: usefull commands :


close tunnel :

clear vpn ike-sa gateway L2side
clear vpn ipsec-sa tunnel L2sideipsec


test phase 1 : test vpn ike-sa gateway L2side
test phase 2 : test vpn ipsec-sa tunnel L2sideipsec


in monitor/logs/system, make a filter for vpn errors : (subtype eq vpn)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!