fortigate-ipsec-40-mr3

Dynamic DNS over VPN concepts Dynamic DNS configuration
The route is configured on the dynamic address VPN peer trying to access the static
address FortiGate unit.
To configure dynamic gateway routing - CLI
config router static
edit 5
set dst 0.0.0.0 0.0.0.0
set dynamic-gateway enable
set device wan2
next
end
For more information on DDNS, see the System Administration guide.
Dynamic DNS over VPN
IPsec VPN expects an IP address for each end of the VPN tunnel. All configuration and
communication with that tunnel depends on the IP addresses as reference points.
However, when the interface the tunnel is on has DDNS enabled there is no set IP
address. The remote end of the VPN tunnel now needs another way to reference your end
of the VPN tunnel. This is accomplished using Local ID.
A FortiGate unit that has a domain name and a dynamic IP address can initiate VPN
connections anytime—the remote peer can reply to the local FortiGate unit using the
source IP address that was sent in the packet header because it is current. Without doing
a DNS lookup first, the remote peer runs the risk of the dynamic IP changing before it
attempts to connect. To avoid this, the remote peer must perform a DNS lookup for the
domain name of to be sure of the dynamic IP address before initiating the connection.
Remote Gateway
When configuring the Phase 1 entry for a VPN tunnel, the Remote Gateway determines
the addressing method the remote end of the tunnel uses as one of Static IP Address,
Dialup User, or Dynamic DNS. There are different fields for each option.
When you select the Dynamic DNS VPN type there is a related field called Dynamic DNS.
The Dynamic DNS field is asking for the FQDN of the remote end of the tunnel. It uses
this information to look up the IP address of the remote end of the tunnel through the
DDNS server associated with that domain name.
Local ID (peer ID)
The Local ID or peer ID can be used to uniquely identify one end of a VPN tunnel. This
enables a more secure connection. Also if you have multiple VPN tunnels negotiating, this
ensures the proper remote and local ends connect. When you configure it on your end, it
is your Local ID. When the remote end connects to you, they see it as your peer ID.
If you are debugging a VPN connection, the Local ID is part of the VPN negotiations. You
can use it to help troubleshoot connection problems.
To configure your Local ID
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create New Phase 1 or edit an existing Phase 1 entry.
3 Select Advanced.
4 In the P1 Proposal section, enter your Local ID.
5 Select OK.
IPsec VPNs for FortiOS 4.0 MR3
102 01-434-112804-20120111
http://docs.fortinet.com/