fortigate-ipsec-40-mr3

FortiGate dialup-client
configurations
FortiOS Handbook
This section explains how to set up a FortiGate dialup-client IPsec VPN. In a FortiGate
dialup-client configuration, a FortiGate unit with a static IP address acts as a dialup
server and a FortiGate unit having a dynamic IP address initiates a VPN tunnel with the
FortiGate dialup server.
The following topics are included in this section:
Configuration overview
Configuration overview
FortiGate dialup-client configuration steps
Configure the server to accept FortiGate dialup-client connections
Configure the FortiGate dialup client
A dialup client can be a FortiGate unit—the FortiGate dialup client typically obtains a
dynamic IP address from an ISP through the Dynamic Host Configuration Protocol
(DHCP) or Point-to-Point Protocol over Ethernet (PPPoE) before initiating a connection to
a FortiGate dialup server.
Figure 19: Example FortiGate dialup-client configuration
Site_1
FortiGate_1
FortiGate_
FG_Dialup
In a dialup-client configuration, the FortiGate dialup server does not rely on a phase 1
remote gateway address to establish an IPsec VPN connection with dialup clients. As
long as authentication is successful and the IPsec security policy associated with the
tunnel permits access, the tunnel is established.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 133
http://docs.fortinet.com/
Site_2