I can't access the internal network from L2TP over IPsec VPN

ok - in your firewall rule make sure you have both the internal network and the vpn pool (l2tp) as both the source AND destination - see if that helps.

HA!  Eureka! That did it. Thank you so much.

Why is that the case? Why does it need to be this way to function? 

It's because the firewall locks down all access EXCEPT what you allow.  Your first rule only allowed traffic one way - the modifcation suggested allows traffic both ways.

Glad it's working!

I spoke too soon. This fix is not working anymore and it didn't work on my other UTM's.

Thank you for trying to help.

I even tried making two separate rules instead of adding both to the source and destination. No joy.

Just a thought - make sure you're using the right interfaces in the rules.  They should be "Internal (Network)" and "VPN Pool (L2TP)".

Also make sure they map to the IP ranges that you expect.

Remember that for any traffic to flow from your internal network to your VPN clients, your internal network machines must be using the UTM as their gateway. 

How are you determing traffic -PING? 

Jason, if you're still having this issue, show a picture of the 'Main Settings' for 'L2TP over IPsec' and a picture of your firewall rule open in Edit.

Cheers - Bob

Jason, if you're still having this issue, show a picture of the 'Main Settings' for 'L2TP over IPsec' and a picture of your firewall rule open in Edit.

Cheers - Bob

Hi Bob,

Thanks for reaching out. Yes I am still hitting a wall.  Here are the images you requested.  I'm hoping it's something stupid that I'm missing.

The thing that jumps out at me is that the wrong pool is being used in the rules - it should be VPN Pool (L2TP).  I would also put the Pool network and the internal network on BOTH sides of the firewall rule so traffic flows both ways.

Shaun, since the UTM is a stateful firewall, Jason doesn't need to allow response traffic from "Internal (Network)."

Jason, you didn't answer Shaun's question about ping.  Pinging is regulated on the 'ICMP' tab of 'Firewall'.  If you haven't selected to allow the firewall to forward pings on that tab, your "Any" allow rule won't forward pings - "Any" only includes TCP and UDP, not any other IP Protocols.

If that doesn't get you there, what does #1 in Rulz tell you?

Cheers - Bob