fortigate-ipsec-40-mr3

FortiGate dialup-client configuration steps FortiGate dialup-client configurations
Computers on the private network behind the FortiGate dialup client can obtain IP
addresses either from a DHCP server behind the FortiGate dialup client, or a DHCP
server behind the FortiGate dialup server.
If the DHCP server resides on the network behind the dialup client, the DHCP
server must be configured to assign IP addresses that do not match the private
network behind the FortiGate dialup server.
If the DHCP server resides on the network behind the FortiGate dialup server, the
DHCP server must be configured to assign IP addresses that do not match the
private network behind the FortiGate dialup client.
FortiGate dialup-client configuration steps
The procedures in this section assume that computers on the private network behind the
FortiGate dialup client obtain IP addresses from a local DHCP server. The assigned IP
addresses do not match the private network behind the FortiGate dialup server.
In situations where IP-address overlap between the local and remote private networks is
likely to occur, FortiGate DHCP relay can be configured on the FortiGate dialup client to
relay DHCP requests to a DHCP server behind the FortiGate dialup server. For more
information, see “To configure DHCP relay on the FortiGate unit” on page 123.
Configuring dialup client capability for FortiGate dialup clients involves the following
general configuration steps:
Determine which IP addresses to assign to the private network behind the FortiGate
dialup client, and add the IP addresses to the DHCP server behind the FortiGate
dialup client. Refer to the software supplier’s documentation to configure the DHCP
server.
Configure the FortiGate dialup server. See “Configure the server to accept FortiGate
dialup-client connections” on page 136.
Configure the FortiGate dialup client. See “Configure the FortiGate dialup client” on
page 138.
Configure the server to accept FortiGate dialup-client connections
Before you begin, optionally reserve a unique identifier (peer ID) for the FortiGate dialup
client. The dialup client will supply this value to the FortiGate dialup server for
authentication purposes during the IPsec phase 1 exchange. In addition, the value will
enable you to distinguish FortiGate dialup-client connections from FortiClient dialupclient
connections. The same value must be specified on the dialup server and on the
dialup client.
1 At the FortiGate dialup server, define the phase 1 parameters needed to authenticate
the FortiGate dialup client and establish a secure connection. See “Auto Key phase 1
parameters” on page 39. Enter these settings in particular:
Name
Enter a name to identify the VPN tunnel. This name appears in
phase 2 configurations, security policies and the VPN monitor.
Remote Gateway Select Dialup User.
Local Interface
Select the interface through which clients connect to the
FortiGate unit.
IPsec VPNs for FortiOS 4.0 MR3
136 01-434-112804-20120111
http://docs.fortinet.com/