Configure a PPP-over-L2TP tunnel

Your Connect EZ 2 device supports PPP-over-L2TP (Layer 2 Tunneling Protocol). The tunnel endpoints are known as L2TP Access Concentrators (LAC) and L2TP Network Servers (LNS). Each endpoint terminates the PPP session.

Required configuration items

Additional configuration items


  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click VPN > L2TP.
  4. (Optional) Type the UDP listening port that L2TP servers will listen on, if other than the default of 1701.
    • To limit access to specified IPv4 addresses and networks:
      1. Click IPv4 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv4 address or network that can access the device's service-type. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 192.168.1.0/24.
        • any: No limit to IPv4 addresses that can access the service-type.
      4. Click again to list additional IP addresses or networks.
    • To limit access to specified IPv6 addresses and networks:
      1. Click IPv6 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv6 address or network that can access the device's service-type. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 2001:db8::/48.
        • any: No limit to IPv6 addresses that can access the service-type.
      4. Click again to list additional IP addresses or networks.
    • To limit access to hosts connected through a specified interface on the device:
      1. Click Interfaces.
      2. For Add Interface, click .
      3. For Interface, select the appropriate interface from the dropdown.
      4. Click again to allow access through additional interfaces.
    • To limit access based on firewall zones:
      1. Click Zones. By default, there are three firewall zones already configured: Internal, Edge, and IPsec.
      2. For Add Zone, click .
      3. For Zone, select the appropriate firewall zone from the dropdown.

        See Firewall configuration for information about firewall zones.

      4. Click again to allow access through additional firewall zones.
  6. To add an L2TP access concentrator:
    1. Click to expand L2TP access concentrators.
    2. For Add L2TP access concentrator, type a name for the LAC and click .
    3. LACs are enabled by default. To disable, toggle off Enable.
    4. For L2TP network server, type the hostname or IP address of the L2TP network server.
    5. (Optional) Type the L2TP network server port to use to connect to the server, if other than the default of 1701.
    6. (Optional) Type the Username to use to log into the server.
    7. (Optional) Type the Password to use to log into the server.
    8. (Optional) Type the Metric for the tunnel, if other than the default of 1.
    9. Select a firewall Zone for the tunnel. This is used by packet filtering rules and access control lists to restrict network traffic on the tunnel.
      1. Enable custom PPP configuration.
      2. Enable Override if the custom configuration should override the default configuration and only use the custom options.
      3. For Configuration file, paste or type the configuration data in the format of a pppd options file.
  7. To add an L2TP network server:
    1. Click to expand L2TP network servers.
    2. For Add L2TP network server, type a name for the LNS and click .
    3. LNSs are enabled by default. To disable, toggle off Enable.
    4. For L2TP access concentrator, type the IP addressof the L2TP access concentrator that this server will allow connections from. This can also be:
      • A range of IP addresses, using the format x.x.x.x-y.y.y.y, for example 192.168.188.1-192.168.188.254.
      • The keyword any, which means that the server will accept connections from any IP address.
    5. For Local IP address, type the IP address of the L2TP virtual network interface.
    6. For Remote IP address, type the IP address to assign to the remote peer.
      • None: No authentication is required.
      • Automatic: The device will attempt to connect using CHAP first, and then PAP.
      • CHAP: Uses the Challenge Handshake Authentication Profile (CHAP) to authenticate.
      • PAP: Uses the Password Authentication Profile (PAP) to authenticate.

      If Automatic, CHAP, or PAP is selected, enter the Username and Password required to authenticate.

      The default is None.

    8. (Optional) For Authentication method, select the authentication method, one of:
      • None: No authentication is required.
      • Automatic: The device will attempt to connect using CHAP first, and then PAP.
      • CHAP: Uses the Challenge Handshake Authentication Profile (CHAP) to authenticate.
      • PAP: Uses the Password Authentication Profile (PAP) to authenticate.
      • MS-CHAPv2: Uses the Microsoft version of the Challenge Handshake Authentication Profile (CHAP) to authenticate.

      • If Automatic, CHAP, PAP, or MS-CHAPv2 is selected, enter the Username and Password required to authenticate.

      • The default is None.
    9. (Optional) Type the Metric for the tunnel, if other than the default of 1.
    10. Select a firewall Zone for the tunnel. This is used by packet filtering rules and access control lists to restrict network traffic on the tunnel.
      1. Enable custom PPP configuration.
      2. Enable Override if the custom configuration should override the default configuration and only use the custom options.
      3. For Configuration file, paste or type the configuration data in the format of a pppd options file.
  8. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the Connect EZ 2 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. (Optional) Set the UDP listening port that L2TP servers will listen on:
    (config)> vpn l2tp port value
(config)>

    where value is an integer between 1 and 65535. The default is 1701.

    • To limit access to specified IPv4 addresses and networks:
      (config)> add vpn l2tp acl address end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 192.168.1.0/24.
      • any: No limit to IPv4 addresses that can access the service-type.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to specified IPv6 addresses and networks:
      (config)> add vpn l2tp acl address6 end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 2001:db8::/48.
      • any: No limit to IPv6 addresses that can access the service-type.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to hosts connected through a specified interface on the Connect EZ 2 device:
      (config)> add vpn l2tp acl interface end value
(config)>

      Where value is an interface defined on your device.

      Use ... network interface ? to display interface information:

      Repeat this step to list additional interfaces.

    • To limit access based on firewall zones:
      (config)> add vpn l2tp acl zone end value
(config)>

      Where value is a firewall zone defined on your device, or the any keyword.

      Type ... firewall zone ? at the config prompt:

      (config)> ... firewall zone ?

Zones: A list of groups of network interfaces that can be referred to by packet
filtering rules and access control lists.

 Additional Configuration
 -------------------------------------------------------------------------------
  any
  dynamic_routes
  edge
  external
  internal
  ipsec
  loopback
  setup

(config)>

      Repeat this step to include additional firewall zones.

  5. To add an L2TP access concentrator:
    1. Add an LAC:
      (config)> add vpn l2tp lac name
(config add vpn l2tp lac name)>

      where name is the name of the LAC. For example, to add an LAC named lac_tunnel:

      (config)> add vpn l2tp lac lac_tunnel
(config vpn l2tp lac lac_tunnel)>

      LACs are enabled by default. To disable:

      (config vpn l2tp lac lac_tunnel)> enable false
(config vpn l2tp lac lac_tunnel)>
    2. Set the hostname or IP address of the L2TP network server:
      (config vpn l2tp lac lac_tunnel)> lns hostname
(config vpn l2tp lac lac_tunnel)>
    3. (Optional) Set the UDP port to use to connect to the L2TP network server:
      (config vpn l2tp lac lac_tunnel)> port int
(config vpn l2tp lac lac_tunnel)>

      where int is an integer between 1 and 65535. The default is 1701.

    4. (Optional) Set the username to use to log into the server:
      (config vpn l2tp lac lac_tunnel)> username username
(config vpn l2tp lac lac_tunnel)>
    5. (Optional) Set the password to use to log into the server:
      (config vpn l2tp lac lac_tunnel)> password password
(config vpn l2tp lac lac_tunnel)>
    6. (Optional) Set the metric for the tunnel:
      (config vpn l2tp lac lac_tunnel)> metric int
(config vpn l2tp lac lac_tunnel)>

      where int is an integer between 0 and 65535. The default is 1.

    7. Set the firewall zone for the tunnel. This is used by packet filtering rules and access control lists to restrict network traffic on the tunnel.
      1. Use the ? to determine available zones:
        (config vpn l2tp lac lac_tunnel)> zone ?

Zone: The firewall zone assigned to this tunnel. This can be used by packet
filtering rules and access control lists to restrict network traffic on this
tunnel.
Format:
  any
  dynamic_routes
  edge
  external
  internal
  ipsec
  loopback
  setup
Current value:

(config vpn l2tp lac lac_tunnel)>
      2. Set the zone:
        (config vpn l2tp lac lac_tunnel)> zone zone
(config vpn l2tp lac lac_tunnel)>
      1. Enable custom PPP configuration:
        (config vpn l2tp lac lac_tunnel)> custom enable true
(config vpn l2tp lac lac_tunnel)>
      2. Enable overriding, if the custom configuration should override the default configuration and only use the custom options:
        (config vpn l2tp lac lac_tunnel)> custom override true
(config vpn l2tp lac lac_tunnel)>
      3. Paste or type the configuration data in the format of a pppd options file:
        (config vpn l2tp lac lac_tunnel)> custom config_file data
(config vpn l2tp lac lac_tunnel)>
  6. To add an L2TP network server:
    1. Add an LNS:
      (config)> add vpn l2tp lns name
(config add vpn l2tp lac name)>

      where name is the name of the LNS. For example, to add an LNS named lns_server:

      (config)> add vpn l2tp lns lns_server
(config vpn l2tp lns lns_server)>

      LACs are enabled by default. To disable:

      (config vpn l2tp lns lns_server)> enable false
(config vpn l2tp lns lns_server)>
    2. Set the IP address of the L2TP access concentrator that this server will allow connections from:
      (config vpn l2tp lns lns_server)> lac IP_address
(config vpn l2tp lns lns_server)>

      This can also be:

      • A range of IP addresses, using the format x.x.x.x-y.y.y.y, for example 192.168.188.1-192.168.188.254.
      • The keyword any, which means that the server will accept connections from any IP address.

    3. Set the IP address of the L2TP virtual network interface:
      (config vpn l2tp lns lns_server)> local_address IP_address
(config vpn l2tp lns lns_server)>
    4. Set the IP address to assign to the remote peer:
      (config vpn l2tp lns lns_server)> remote_address IP_address
(config vpn l2tp lns lns_server)> 
    5. (config vpn l2tp lns lns_server)> auth method
(config)>

      where method is one of the following:

      • none: No authentication is required.
      • auto: The device will attempt to connect using CHAP first, and then PAP.
      • chap: Uses the Challenge Handshake Authentication Profile (CHAP) to authenticate.
      • pap: Uses the Password Authentication Profile (PAP) to authenticate.
      • mschapv2: Uses the Microsoft version of the Challenge Handshake Authentication Profile (CHAP) to authenticate.

      If auto, chap, pap or mschapv2 is selected, enter the Username and Password required to authenticate:

      (config vpn l2tp lns lns_server)> username username
(config vpn l2tp lns lns_server)> password password
(config vpn l2tp lns lns_server)>

      The default is none.

    6. (Optional) Set the metric for the tunnel:
      (config vpn l2tp lns lns_server)> metric int
(config vpn l2tp lns lns_server)>

      where int is an integer between 0 and 65535. The default is 1.

    7. Set the firewall zone for the tunnel. This is used by packet filtering rules and access control lists to restrict network traffic on the tunnel.
      1. Use the ? to determine available zones:
        (config vpn l2tp lns lns_server)> zone ?

Zone: The firewall zone assigned to this tunnel. This can be used by packet
filtering rules and access control lists to restrict network traffic on this
tunnel.
Format:
  any
  dynamic_routes
  edge
  external
  internal
  ipsec
  loopback
  setup
Current value:

(config vpn l2tp lns lns_server)>
      2. Set the zone:
        (config vpn l2tp lns lns_server)> zone zone
(config vpn l2tp lns lns_server)>
      1. Enable custom PPP configuration:
        (config vpn l2tp lac lns lns_server)> custom enable true
(config vpn l2tp lns lns_server)>
      2. Enable overriding, if the custom configuration should override the default configuration and only use the custom options:
        (config vpn l2tp lns lns_server)> custom override true
(config vpn l2tp lns lns_server)>
      3. Paste or type the configuration data in the format of a pppd options file:
        (config vpn l2tp lns lns_server)> custom config_file data
(config vpn l2tp lns lns_server)>
  7. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  8. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.