--- title: "Securing your Windows L2TP tunnel" slug: "fortigate-securing-your-l2tp-tunnel" updated: 2026-04-28T00:17:18Z published: 2026-04-28T00:17:18Z canonical: "docs.serversaustralia.com.au/fortigate-securing-your-l2tp-tunnel" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.serversaustralia.com.au/llms.txt > Use this file to discover all available pages before exploring further. # Securing your Windows L2TP tunnel This guide covers the process for further increasing the encryption security of a native L2TP connection for Windows. --- ## Changing the Diffie-Hellman (DH) Group **Diffie-Hellman (DH) groups** are used during IPsec “Phase 1” to securely exchange key material between the VPN client and the FortiGate endpoint. In plain English, they determine the mathematical strength of the process used to establish the tunnel. The DH Groups supported by Windows are as follows: - DH Group 1 - DH Group 2 - DH Group 14 - DH Group 19 - DH Group 20 - DH Group 24 In this guide, we’ll be focusing on DH Groups **14** and **19**. - **DH Group 14** uses a **2048-bit MODP** key exchange. It is widely supported and is considered a solid baseline for compatibility and security. - **DH Group 19** uses **256-bit elliptic curve cryptography (ECP256)**. It provides stronger modern cryptography with better efficiency, which can improve performance while maintaining a high security standard. In general, **Group 19 is preferred where supported**, as it is newer and more efficient. **Group 14 remains a viable fallback** when compatibility is more important or when older systems do not support elliptic curve groups. ### FortiGate To modify the DH Group on the FortiGate tunnel, follow the provided steps: 1. Select the relevant tunnel, and click “**Edit**”. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-V3NIIIXJ.png) 2. Locate “**Phase 1 Proposal**”, and click on the attached “**Edit**” button. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-IUZ6LOC7.png) You should see the following menu: ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-T753HWL1.png) We’re going to move away from DH Group 2 (the default), as it is considered very insecure when compared with later Groups. While here, we’ll also change the permitted encryption/authentication types. 3. Change your encryption/authentication types to match the screenshot below. Make sure to also untick the “Diffie-Hellman Group” ‘**2’** checkbox. > [!NOTE] > You can remove additional encryption types by clicking on the associated “**X**” box, as demonstrated below: ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-TJPTFL8Z.png) ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-GIY7TG7B.png) 4. To change the Group in use by the tunnel, tick **EITHER** DH Group 14 or 19. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-QBYEDB1Z.png) **OR** ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-8GP2KPK6.png) 5. Once you have selected ***a single*** DH Group, save the Phase 1 section by clicking on the circled checkmark in the top-right of the menu. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-RPO6TQ01.png) 6. Next, move to the “**Phase 2 Selectors**” section: ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-23E0JJRO.png) 7. With the “**Phase 2 Selectors**” menu open, click on the “**Advanced**” drop-down. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-CW5GXG6K.png) You should be greeted with this expanded menu: ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-4UFQMAQO.png) 8. Action the changes on this page: ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-UTRKL0TC.png) 1. Set the “Local Address” and “Remote Address” to `0.0.0.0/0` 2. Set an encryption/authentication pair to `AES128` and `SHA256`, and remove all other pairs. 9. Afterwards, click the circled checkmark to save and close this section. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-SLBPDV9P.png) 10. Lastly, click “**OK**” to save all changes to the tunnel. ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-ZXOE6XIZ.png) ### Windows Windows does not expose the Diffie-Hellman Group in the normal VPN GUI, so the easiest way to check or change it is with PowerShell. 1. Once the Native L2TP tunnel has been added to Windows, you can view the current DH Group by running the following PowerShell command as administrator. Make sure to replace `<YOUR VPN NAME>` with the real name chosen for the tunnel on Windows: ```powershell Get-VpnConnection -Name "" | Select-Object -ExpandProperty IPSecCustomPolicy ``` If PowerShell outputs nothing (and no errors appear), it means the tunnel is using the default DH Group of 2. 2. To change the Group in use by the tunnel, use **ONE** of the following commands, depending on whether you want DH Group 14 or 19. Once again, make sure to replace `<YOUR VPN NAME>` with the real name chosen for the tunnel. > [!WARNING] > **NOTE:** THIS MUST MATCH THE GROUP CHOSEN ON THE FORTIGATE FIREWALL! - **DH Group 14** ```powershell Set-VpnConnectionIPsecConfiguration `  -ConnectionName "" `  -AuthenticationTransformConstants None `  -CipherTransformConstants AES128 `  -EncryptionMethod AES128 `  -IntegrityCheckMethod SHA256 `  -PfsGroup None `  -DHGroup Group14 `  -PassThru `  -Force ``` - **DH Group 19** ```powershell Set-VpnConnectionIPsecConfiguration `  -ConnectionName "" `  -AuthenticationTransformConstants None `  -CipherTransformConstants AES128 `  -EncryptionMethod AES128 `  -IntegrityCheckMethod SHA256 `  -PfsGroup None `  -DHGroup ECP256 `  -PassThru `  -Force ``` 1. After selecting one of the above options, you can view the changes by running the following command again: ```powershell Get-VpnConnection -Name "" | Select-Object -ExpandProperty IPSecCustomPolicy ```