L2TP option missing from the network dialog: what to install

You add a VPN connection, look for L2TP/IPsec in the list, and it is not there. Or it is there, the profile saves, and the connection dies with a message about a plugin. Both symptoms point at a stack of packages that install independently, and the dialog only shows you the end of it. Map the pieces before installing anything.

Start at the stack, not the menu

The option appears when the manager can find a plugin advertising that VPN type. That plugin in turn needs an L2TP daemon and an IPsec implementation at run time, plus a PPP module for the link itself. Each of those is a separate package with its own dependency chain, and a distribution can ship them in combinations that are only partly complete. Installing an IPsec daemon on its own adds nothing to the list, because the manager is not looking for it. Read the installed plugins first, then work downward.

A missing menu item is a packaging question. It is almost never a configuration question, however much it feels like one.

Editing and running are separate packages

The service plugin establishes connections, and an editor component is what lets a desktop settings window display and save the protocol options. They are packaged separately, and some distributions ship one without the other. The result is a connection that exists, can be started from the command line, and cannot be edited in the graphical tool.

Look at the running desktop environment before choosing a package name. GNOME's editing component is not the same package as a KDE front end, and a distribution may rename either of them. Take the name from that release's own package list.

The PPP plugin lives at a versioned path

L2TP runs over PPP, and the plugin the service loads is built against a specific PPP version, so it lives under a directory named after that version. A recipe that hard-codes an older path describes the machine it was written on. If the version here differs, the plugin will not be found however carefully the command was copied.

That is the strongest argument for the distribution's package over a copied build. Package maintainers track this path; a copied configure line does not.

A negotiation failure is not an installation failure

Once the option exists and the profile saves, the next failure is a different class of problem. A peer rejecting authentication is the IPsec backend telling you something specific.

Read the backend's own log before reinstalling anything. The manager's journal shows the plugin handing off and the IPsec daemon reporting why it stopped, and those two lines together identify which side refused. Reinstalling an editor cannot fix a rejected pre-shared key, and reinstalling a plugin cannot fix a server expecting different proposals. Separate the layers in your notes before touching a package.

Two secrets, two fields

IPsec authentication and the user's PPP login are unrelated secrets that happen to sit on the same dialog. One authenticates the machines, the other authenticates a person to the L2TP service, and a server can accept one while rejecting the other.

Put the account password in the PPP field and the shared secret in the IPsec field, then check which one the log complained about. Copying a password into a shared-secret box because both inputs are masked is a common and completely silent mistake. Record the package versions you ended up with, since the next machine needs the same combination and the dialog will not tell anyone what it is.