This question is a bit old but I decided to share my experiences with L2TP/IPSec using PSK in Windows 10, somebody might find it useful.
I was experimenting with L2TP/IPsec connections between a Windows 10 PC and a Mikrotik router on the other day. Analyzing the debug level log of the Mikrotik I figured out that Windows 10 (version 1511) is offering the following authentication and encryption settings during the key exchange (in this priority order):
- SHA1 + AES-CBC-256 + ECP384
- SHA1 + AES-CBC-128 + ECP256
- SHA1 + AES-CBC-256 + MODP2048
- SHA1 + 3DES-CBC + MODP2048
- SHA1 + 3DES-CBC + MODP1024
For Phase2 negotiation Windows 10 has the following proposal only:
It seems all of these settings are hardcoded in the system as the L2TP/IPsec client ignored any changes I made in "IPSec Settings" in the Advanced Windows Firewall MMC.
I even tried this registry hack but I didn't manage to force AES256 for phase2: https://superuser.com/questions/1296210/force-windows-ipsec-l2tp-vpn-to-use-aes-in-ipsec-main-mode
I know the 1511 is an outdated version of Win10 but that was available on my work laptop. A newer version might has some improvements (for example the more efficient AES-GCM encryption), but for me the combination of SHA1 and 256bit AES-CBC with Diffie-Hellman Elliptic Curve P-384 offers a reasonably strong and quick security at this time. For traffic SHA1+AES128 is not the most secure option to have but it needs not much resource.
Update: I've checked out Win10 version 1803. Phase 1 proposals are the same but for Phase 2 Windows now proposes SHA1+AES-CBC-256 too (besides SHA1+AES-CBC-128). CTR or GCM suites are still not supported. Neither SHA256 hashing for auth.