fortigate-ipsec-40-mr3

Configure the FortiGate unit FortiClient dialup-client configurations
4 Select Enable.
5 Enter the following information and select OK:
Type IPsec
IP Range
Network Mask
Default Gateway
Enter the range of VIP addresses that the DHCP server can
dynamically assign to dialup clients when they connect. As a
precaution, do not assign VIP addresses that match the private
network behind the FortiGate unit.
If you need to exclude specific IP addresses from the range,
you can define an exclusion range (see Advanced... below).
Note: If you will use a RADIUS server to assign VIP addresses,
these fields are not needed.
Enter the network mask of the IP addresses that you specified
in the IP Range fields (for example, 255.255.255.0 for a
class C network).
Enter the IP address of the default gateway that the DHCP
server assigns to DHCP clients.
Select Use System DNS Setting.
DNS Service If you want to use a different DNS server for VPN clients, select
Specify and enter an IP address in DNS Server 0.
Advanced... Select Advanced to configure any of the following options.
Domain
Lease Time
IP Assignment
Mode
WINS Server 0
WINS Server 1
Options
Exclude Ranges
If you want the FortiGate unit to assign a domain name to
dialup clients when they connect, enter the registered domain
name.
Specify a lease time:
Select Unlimited to allow the dialup client to use the
assigned IP address for an unlimited amount of time (that
is, until the client disconnects).
Enter the amount of time (in days, hours, and minutes) that
the dialup client may use the assigned IP address, after
which the dialup client must request new settings from the
DHCP server. The range is from 5 minutes to 100 days.
Server IP Range — assign addresses from IP Range (default)
User-group defined method — assign addresses from user’s
record on RADIUS server. See “Assigning VIPs by RADIUS
user group” on page 119.
Optionally, enter the IP addresses of one or two Windows
Internet Service (WINS) servers that dialup clients can access
after the tunnel has been established.
Optionally, you can send up to three DHCP options to the
dialup client. Select Options and enter the option code in the
Code field, and if applicable, type any associated data in the
Options field. For more information, see RFC 2132.
To specify any VIP addresses that must be excluded from the
VIP address range, select Exclude Ranges, select the + button
and then type the starting and ending IP addresses. You can
add multiple ranges to exclude.
IPsec VPNs for FortiOS 4.0 MR3
124 01-434-112804-20120111
http://docs.fortinet.com/