Learn L2TP IPsec - Mobile Client Support

#Introduction

One of the reasons L2TP/IPsec has survived for more than two decades is its native support on all operating systems. iPhone, Android, Windows, and macOS users all have a built-in L2TP/IPsec client — no app installation needed. Episode 18 discusses how to use it correctly and manage it centrally.

This advantage is also a challenge: every platform has its own terminology and pitfalls. We will dissect the per-platform configuration, create centralized profiles, and close with troubleshooting connections from devices.

#Native Support on Each OS

#iOS and macOS

iOS and macOS use the L2TP/IPsec client with PSK and username-password. The settings are located in Settings and System Settings. The values you fill in must be consistent with your server: server address, account, password, secret (PSK), and authentication type.

#Android and Windows

Android provides L2TP/IPsec PSK and L2TP/IPsec MSCHAPv2 as built-in VPN types. Windows also has an L2TP/IPsec client; on Windows 10 and 11, add it via Settings then VPN, choosing the L2TP/IPsec type with PSK. Both platforms sometimes need MTU tuning or special registry settings — covered in the troubleshooting section.

A summary of the terms you must align across platforms:

Server address : 203.0.113.10 atau vpn.example.com
Secret / PSK   : sama dengan nilai di ipsec.secrets
Account        : username di chap-secrets
Password       : password di chap-secrets

#Centralized Profile Management

#Apple Configuration Profile

For iOS and macOS, create a Configuration Profile XML containing the VPN payload. Install it via Safari, email, or MDM. A minimal payload example:

<dict>
    <key>PayloadType</key>
    <string>com.apple.vpn.managed</string>
    <key>VPNType</key>
    <string>L2TP</string>
    <key>AuthenticationMethod</key>
    <string>SharedSecret</string>
    <key>SharedSecret</key>
    <string>rahasia-psk</string>
    <key>RemoteAddress</key>
    <string>vpn.example.com</string>
</dict>

The VPNType part is of type L2TP and SharedSecret contains the PSK. Wrap the whole thing in a plist envelope before signing it.

#Windows XML Profile

Windows accepts VPN profiles in XML format. Save them as a .pbk file or distribute them via group policy:

<VPNProfile>
  <ProfileName>Kantor</ProfileName>
  <ConnectionType>L2TP</ConnectionType>
  <NativeProtocolType>L2TP</NativeProtocolType>
  <Authentication>UserNameAndPassword</Authentication>
  <L2tpPsk>rahasia-psk</L2tpPsk>
</VPNProfile>

Distribute this file together with an MDM such as Intune, or via Add-VpnConnection in PowerShell.

#The Role of MDM

MDM (Mobile Device Management) — such as Jamf, Intune, or Workspace ONE — distributes profiles centrally, forces VPN connections on certain networks, and pulls access when a device is lost. For deployments with hundreds of devices, MDM is a requirement to keep policies consistent.

#Troubleshooting from Devices

#Common Problem Patterns

A few typical mobile client failures:

• IKEv1 mismatch: many mobile clients use IKEv1 Main Mode. Make sure the server uses ikev2=never or ikev1=always.
• Wrong PSK: check that the secret on the device matches ipsec.secrets.
• MS-CHAPv2 rejected: make sure the account is registered in chap-secrets and the password is correct.
• MTU too large: VPN packets from devices can be fragmented; lower the client MTU.

Check from the server side while a client tries to connect:

sudo journalctl -u strongswan -f
sudo tail -f /var/log/syslog | grep pppd

The pppd logs will show whether authentication succeeded and which IP address was given. If the connection drops after a few seconds, it is almost certainly an MTU problem — set mtu 1350 in options.xl2tpd.

#Closing

Episode 18 equipped you with the client side: native L2TP/IPsec support on iOS, Android, Windows, and macOS, XML profile templates, centralized distribution via MDM, and common troubleshooting patterns.

Key takeaways:

• L2TP/IPsec is supported natively on all OSes without extra apps.
• Term consistency: server address, account, secret, and password.
• Apple Configuration Profile wraps the VPN payload in an XML plist.
• Windows uses XML profiles and Add-VpnConnection.
• MDM enforces policy consistency and centralized access.
• Server logs show which layer failed when a device tries to connect.

In the next episode, episode 19, we will discuss high availability and redundancy — HA patterns with multiple LNSes, failover via DPD, and load balancing with DNS round-robin and ECMP.