fortigate-ipsec-40-mr3

Configuring IKE Mode Config Supporting IKE Mode config clients
Configuring IKE Mode Config
IKE Mode Config is configured with the CLI command vpn ipsec phase1interface.
The mode-cfg variable enables IKE Mode Config. The type field
determines whether you are creating an IKE Mode Config server or a client. Setting type
to dynamic creates a server configuration, otherwise the configuration is a client.
Configuring an IKE Mode Config client
If the FortiGate unit will connect as a dialup client to a remote gateway that supports IKE
Mode Config, the relevant vpn ipsec phase1-interface variables are as follows:
Variable Description
ike-version 1 IKE v1 is the default for FortiGate IPsec VPNs.
IKE Mode Config is not compatible with IKE v2.
mode-cfg enable Enable IKE Mode Config.
type {ddns | static} If you set type to dynamic, an IKE Mode Config
server is created.
assign-ip
{enable | disable}
Enable to request an IP address from the server.
interface
This is a regular IPsec VPN field. Specify the physical,
aggregate, or VLAN interface to which the IPsec tunnel
will be bound.
proposal
This is a regular IPsec VPN field that determines the
will accept. For more information, see “Defining IKE
negotiation parameters” on page 49.
mode-cfg-ip-version Select if the Method client receives an IPv4 or IPv6 IP
{4|6}
address. The default is 4. the ip-version setting
matches this variable’s value.
ip-version This is a regular IPsec VPN field. By default, IPsec
VPNs use IPv4 addressing. You can set ip-version
to 6 to create a VPN with IPv6 addressing.
Configuring an IKE Mode Config server
If the FortiGate unit will accept connection requests from dialup clients that support IKE
Mode Config, the following vpn ipsec phase1-interface settings are required
before any other configuration is attempted:
Variable Description
ike-version 1 IKE v1 is the default for FortiGate IPsec VPNs.
IKE Mode Config is not compatible with IKE v2.
mode-cfg enable Enable IKE Mode Config.
type dynamic Any other setting creates an IKE Mode Config client.
IPsec VPNs for FortiOS 4.0 MR3
142 01-434-112804-20120111
http://docs.fortinet.com/