![background image](/i/zyxel/144611/zyxel-zywall-usg-1000/h/zyxel-zywall-usg-1000-079.png)
Chapter 4 Create Secure Connections Across the Internet
ZyWALL USG 20-2000 User’s Guide
79
4.6 L2TP VPN with Android, iOS, and Windows
L2TP VPN uses the L2TP and IPSec client software included in remote users’ Android, iOS, or
Windows operating systems for secure connections to the network behind the ZyWALL.
1
L2TP VPN uses one of the ZyWALL’s IPSec VPN connections. Edit
Default_L2TP_VPN_GW
as
follows:
• Set
My Address
to the WAN interface domain name or IP address you want to use.
• Replace the default
Pre-Shared Key
.
2
Create a host-type address object containing the
My Address
IP address configured in the
Default_L2TP_VPN_GW
and set the
Default_L2TP_VPN_Connection
’s
Local Policy
to use it.
3
In
Configuration > VPN > L2TP VPN
enable the connection and set the VPN connection L2TP
VPN uses, the L2TP client IP address pool, the authentication method, and the allowed users.
4
Configure a policy route to let remote users access resources on the network behind the ZyWALL.
• Set the policy route’s
Source Address
to the address object that you want to allow the remote
users to access (
LAN1_SUBNET
in the following example).
• Set the
Destination Address
to the IP address pool that the ZyWALL assigns to the remote
users (
L2TP_POOL
in the following example).
• Set the next hop to be the VPN tunnel you are using for L2TP.
4.6.1 L2TP VPN Example
Here a sales representative uses a laptop to securely connect to the ZyWALL’s network.
Figure 34
L2TP VPN Example
• The ZyWALL has a WAN interface with a static IP address of 172.16.1.2.
• The remote user has a dynamic public IP address and connects through the Internet.
• You configure an IP address pool object named
L2TP_POOL
to assign the remote users IP
addresses from 192.168.10.10 to 192.168.10.20 for use in the L2TP VPN tunnel.
• The VPN rule allows the remote user to access the
LAN1_SUBNET
(the 192.168.1.x subnet).
Do the following to configure the L2TP VPN example:
172.16.1.2
L2TP_POOL:
192.168.10.10~192.168.10.20
LAN1_SUBNET:
192.168.1.x