fortigate-ipsec-40-mr3

Configuration overview FortiClient dialup-client configurations
Using virtual IP addresses
When the FortiClient host PC is located behind a NAT device, unintended IP address
overlap issues may arise between the private networks at the two ends of the tunnel. For
example, the client’s host might receive a private IP address from a DHCP server on its
network that by co-incidence is the same as a private IP address on the network behind
the FortiGate unit. A conflict will occur in the host’s routing table and the FortiClient
Endpoint Security application will be unable to send traffic through the tunnel.
Configuring virtual IP (VIP) addresses for FortiClient applications prevents this problem.
Using VIPs ensures that client IP addresses are in a predictable range. You can then
define security policies that allow access only to that source address range. If you do not
use VIPs, the security policies must allow all source addresses because you cannot
predict the IP address for a remote mobile user.
The FortiClient application must not have the same IP address as any host on the private
network behind the FortiGate unit or any other connected FortiClient application. You can
ensure this by reserving a range of IP addresses on the private network for FortiClient
users. Or, you can assign FortiClient VIPs from an uncommonly used subnet such as
10.254.254.0/24 or 192.168.254.0/24.
You can reserve a VIP address for a particular client according to its device MAC address
and type of connection. The DHCP server then always assigns the reserved VIP address
to the client. For more information about this feature, see the “dhcp reserved-address”
section in the “system” chapter of the FortiGate CLI Reference.
On the host computer, you can find out the VIP address that the FortiClient Endpoint
Security application is using. For example,
On Windows, type ipconfig /all at the Windows Command Prompt.
On Linux or Mac OS X, type ifconfig in a terminal window.
The output will also show the IP address that has been assigned to the host Network
Interface Card (NIC).
It is best to assign VIPs using DHCP over IPsec. The FortiGate dialup server can act as a
DHCP server or relay requests to an external DHCP server. You can also configure VIPs
manually on FortiClient applications, but it is more difficult to ensure that all clients use
unique addresses.
If you assign a VIP on the private network behind the FortiGate unit and enable DHCP-
IPsec (a phase 2 advanced option), the FortiGate unit acts as a proxy on the local private
network for the FortiClient dialup client. Whenever a host on the network behind the
dialup server issues an ARP request for the device MAC address of the FortiClient host,
the FortiGate unit answers the ARP request on behalf of the FortiClient host and forwards
the associated traffic to the FortiClient host through the tunnel. For more information, see
“DHCP-IPsec” on page 59.
FortiGate units fully support RFC 3456. The FortiGate DHCP over IPsec feature can be
enabled to allocate VIP addresses to FortiClient dialup clients using a FortiGate DHCP
server.
Figure 17 shows an example of a FortiClient-to-FortiGate VPN where the FortiClient
application is assigned a VIP on an uncommonly used subnet. The diagram also shows
that while the destination for the information in the encrypted packets is the private
network behind the FortiGate unit, the destination of the IPsec packets themselves is the
public interface of the FortiGate unit that acts as the end of the VPN tunnel.
IPsec VPNs for FortiOS 4.0 MR3
118 01-434-112804-20120111
http://docs.fortinet.com/