Hi @CEEJAY ,
That screenshot is really useful — it narrows this down a lot. Two details stand out:
- The log carries an IKE phase2 message ID, so Phase 1 completed and the failure is at/after Phase 2.
- Interface direction: inbound means the Delete IKE-SA is coming from the peer — i.e. your Windows client is tearing the SA down, not the appliance rejecting it.
"Client deletes the SA right after Phase 2 completes" is a well-documented L2TP behaviour, and there's an SK that matches it exactly.
Most likely cause: NAT-T (sk98656)
sk98656 describes precisely this: "When NAT-T is used, the L2TP client sends a 'delete' packet after every successful Phase 2 completion." The cause is that Windows by default does not support IPsec NAT-T when the VPN server is behind a NAT device (also shows as error 809 on the client).
Fix, on the Windows client:
- Open regedit as Administrator
- Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
- Create a new DWORD (32-bit) value named AssumeUDPEncapsulationContextOnSendRule
- Set the value to 2
- Reboot the machine, then retry the connection
(Microsoft reference: kb926179.) If your 2550 sits behind any NAT — or the laptop is behind NAT — this is very likely your issue.
Second thing to check: Phase 2 encryption (sk87523)
sk87523 (the official L2TP-on-Spark guide) has an important note: "Starting from the R81.10.10 Jumbo Hotfix and higher versions, the Remote Access Encryption algorithm for phase 2 was changed from 3DES to AES-256. As a result, selecting the Data encryption setting as 'Require encryption (disconnect if server declines)' in the Windows OS Client will result in L2TP connection failure."
You're on R82.00.10, so you're on AES-256 for Phase 2. So on the Windows client make sure:
- Data encryption → "Optional encryption (connect even if no encryption)" (not Require encryption)
- Authentication → only "Unencrypted password (PAP)", clear all other options
Alternatively, if the client can't do AES-256, you can change the appliance advanced setting "Remote Access VPN - Encryption algorithm used for phase 2" to AES-128.
To answer your actual question — where to check the L2TP settings on the firewall
In the Spark WebUI:
- Left panel → VPN
- Remote Access section → Blade Control
- VPN Remote Access Control must be On
- Under VPN Remote Access users can connect via, the Windows VPN Client checkbox must be selected
- On the Windows VPN Client line, the L2TP Pre-Shared Key link shows/sets the PSK — this must match exactly what's configured on the Windows client
- On that same line there's a "How to connect" link — it opens an L2TP VPN Client Usage popup with the exact server IP, PSK and settings to use on the Windows side. That's the fastest way to confirm the firewall side matches the client side.
One more thing worth ruling out
If anyone has applied the CVE-2026-50751 mitigations (sk185033) on this appliance, be aware they can break L2TP by design:
- Option 1 ("remove support for legacy Remote Access clients") is explicitly documented to prevent StrongSWAN, L2TP and legacy clients from connecting.
- Option 2 for Spark sets Device > Advanced Settings > Remote Access VPN - Encryption Method to IKEv2 — and L2TP/IPsec is IKEv1-based, so it would stop working.
Worth a quick check of that advanced setting if the mitigations were applied recently.
Suggested order: apply the sk98656 registry fix + reboot → set Data encryption to Optional and PAP-only → retest. If it still fails, check the Encryption Method advanced setting for the IKEv2 mitigation.
References: sk98656, sk87523, sk185033.
Hope this helps!
Best regards,
Jorge Dias Junior
