fortigate-ipsec-40-mr3

FortiGate dialup-client configurations Configuration overview
To avoid these issues, you can configure FortiGate DHCP relay on the dialup client
instead of using a DHCP server on the network behind the dialup client. The FortiGate
dialup client can be configured to relay DHCP requests from the local private network to
a DHCP server that resides on the network behind the FortiGate dialup server (see
Figure 20 on page 135). You configure the FortiGate dialup client to pass traffic from the
local private network to the remote network by enabling FortiGate DHCP relay on the
FortiGate dialup client interface that is connected to the local private network.
Afterward, when a computer on the network behind the dialup client broadcasts a DHCP
request, the dialup client relays the message through the tunnel to the remote DHCP
server. The remote DHCP server responds with a private IP address for the computer. To
avoid ambiguous routing and network overlap issues, the IP addresses assigned to
computers behind the dialup client cannot match the network address space used by the
private network behind the FortiGate dialup server.
Figure 20: Preventing network overlap in a FortiGate dialup-client configuration
Site_1
FortiGate_1
FortiGate_
DHCP
server
DHCP discovery
message initiates
tunnel
When the DHCP server resides on the private network behind the FortiGate dialup server,
the IP destination address specified in the IPsec security policy on the FortiGate dialup
client must refer to that network.
FortiGate dialup-client infrastructure requirements
FG_Dialup
The requirements are:
The FortiGate dialup server must have a static public IP address.
NAT mode is required if you want to create a route-based VPN.
The FortiGate dialup server may operate in either NAT mode or transparent mode to
support a policy-based VPN.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 135
http://docs.fortinet.com/
Site_2
You must add a static route to the DHCP server FortiGate unit if it is not directly
connected to the private network behind the FortiGate dialup server—its IP address does
not match the IP address of the private network. Also, the destination address in the
IPsec security policy on the FortiGate dialup client must refer to the DHCP server
address. The DHCP server must be configured to assign a range of IP addresses different
from the DHCP server's local network, and also different from the private network
addresses behind the FortiGate dialup server. See “Routing” on page 101.