@z0d1ac Would you be able to share your Client to Site settings (minimizing any sensitive information like public IP addresses) so we can try to replicate the issue? 

@NeilR_M sure, thanks for your interest!
Omada settings:
Network Settings -> VPN
Name: Example
Enabled: True
Purpose: Client-to-Site VPN
VPN type: VPN Server - L2TP
IPsec Encryption: Encrypted
Authentication Mode: Local
Local Network Type: Network
Local Networks: LAN
Pre-Shared Key: ••••••••••••••••••
WAN: WAN2
IP Pool Type: IP Address/Mask
IP Pool: 192.168.143.1/24
Primary DNS Server: 192.168.141.20
Secondary DNS Server: 192.168.141.10

Network Settings -> VPN User
Username: example.e
Password: ••••••••••
VPN Type: L2TP/PPTP
VPN Server: L2TP Server-Example
Local IP Address: . . .
Mode: Client
Maximum Connections: 2
(this user won't connect)
 

Username: second
Password: ••••••••••
VPN Type: L2TP/PPTP
VPN Server: L2TP Server-Example
Local IP Address: . . .
Mode: Client
Maximum Connections: 2
(this user works fine)

Windows 10/11 settings
Network & internet -> VPN
Connection name: Example

Server name or address: <WAN IP Address>
VPN type: L2TP/IPsec with pre-shared key
Pre-shared key: ••••••••••••••••••
Type of sign-in info: Username and password
Username: example.e
Password: ••••••••••

Network & internet -> VPN -> More VPN properties
Options: PPP Settings: Enable LCP extensions
Security: Data encryption: Require encryption (disconnect if server declines)
Authentication: Allow these protocols: Unencrypted password (PAP); Microsoft CHAP Version 2 (MS-CHAP v2)

Connection error on client side:
"The PPP link control protocol was terminated"
Omada log entries:
Gateway IPsec Module Information
WAN2: Phase 1 of IKE negotiation succeeded. (Peers=<WAN IP Address><-><Client NAT IP>)
Gateway IPsec Module Information
WAN2: IKE negotiation began in responder mode. (Mode=Main Mode, Peers=<WAN IP Address><-><Client NAT IP>)    
Gateway IPsec Module Information
WAN2: Phase 2 of IKE negotiation succeeded. (Peers=<WAN IP Address><-><Client NAT IP>)
Gateway PPP Module Information
WAN2: Can not get remote ip for peer: terminating link!

  @z0d1ac I tested on an ER7206 with software controller v6.0.0.25 and settings including special characters in the username had no issues. What Gateway are you using? Can you provide the firmware of the gateway as well? 

  @NeilR_M sure!

ER7206 as well, running firmware 2.2.3 build 20250723 rel. 05551.