Description
This article describes why it is not possible to configure multiple user groups for L2TP over IPSEC VPN on a FortiGate in order to use granular access in firewall policies.
Solution
Due to the limitation of L2TP on the FortiGate, the group which was configured in "config vpn l2tp" is only used for the VPN authentication, and it is not possible to retrieve any other groups that would be usable for granular access in policies.
As a workaround, it is recommended to use IPSEC VPN or SSLVPN with the FortiClient.
