fortigate-ipsec-40-mr3

Supporting IKE Mode config clients Configuring IKE Mode Config
Variable Description
interface
proposal
After you have enabled the basic configuration, you can configure:
IP address assignment for clients
DNS and WINS server assignment
IP address assignment
Usually you will want to assign IP addresses to clients. The simplest method is to assign
addresses from a specific range, similar to a DHCP server.
If your clients are authenticated by a RADIUS server, you can obtain the user’s IP address
assignment from the Framed-IP-Address attribute. The user must be authenticated using
XAuth.
To assign IP addresses from an address range
If your VPN uses IPv4 addresses,
config vpn ipsec phase1-interface
edit vpn1
set mode-cfg-ipversion 4
set assign-ip enable
set assign-ip-type ip
set assign-ip-from range
set ipv4-start-ip
set ipv4-end-ip
set ipv4-netmask
end
If your VPN uses IPv6 addresses,
config vpn ipsec phase1-interface
edit vpn1
set mode-cfg-ipversion 6
set assign-ip enable
set assign-ip-type ip
set assign-ip-from range
set ipv6-start-ip
set ipv6-end-ip
end
This is a regular IPsec VPN field. Specify the physical,
aggregate, or VLAN interface to which the IPsec tunnel
will be bound.
This is a regular IPsec VPN field that determines the
encryption and authentication settings that the server
will accept. For more information, see “Defining IKE
negotiation parameters” on page 49.
ip-version This is a regular IPsec VPN field. By default, IPsec
VPNs use IPv4 addressing. You can set ip-version
to 6 to create a VPN with IPv6 addressing.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 143
http://docs.fortinet.com/