FortiGate IPSec VPN User Guide - FirewallShop.com

FortiClient dialup-client configurations
Configuration overview
Using virtual IP addresses
Finally, the FortiGate unit searches the implicated IPSec firewall policies to
determine which private network(s) the dialup clients may access. The rest of the
VPN policy information is retrieved from the existing IPSec phase 1 and phase 2
parameters in the dialup-client configuration.
When the FortiClient host PC is located behind a NAT device, unintended IP
address overlap issues may arise between the private networks at the two ends of
the tunnel. For example, the client’s host might receive a private IP address from
a DHCP server on its network that by co-incidence is the same as a private IP
address on the network behind the FortiGate unit. A conflict will occur in the host’s
routing table and the FortiClient Host Security application will be unable to send
traffic through the tunnel. Configuring virtual IP (VIP) addresses for FortiClient
applications prevents this problem.
Using VIPs ensures that client IP addresses are in a predictable range. You can
then define firewall policies that allow access only to that source address range. If
you do not use VIP, the firewall policies must allow all source addresses because
you cannot predict the IP address for a remote mobile user.
The FortiClient application must not have the same IP address as any host on the
private network behind the FortiGate unit or any other connected FortiClient
application. You can ensure this by reserving a range of IP addresses on the
private network for FortiClient users. Or, you can assign FortiClient VIPs from an
uncommonly used subnet such as 10.254.254.0/24 or 192.168.254.0/24.
You can reserve a VIP address for a particular client according to its device MAC
address and type of connection. The DHCP server then always assigns the
reserved VIP address to the client. For more information about this feature, see
the “dhcp reserved-address” section in the “system” chapter of the FortiGate CLI
Reference.
Note: To determine the VIP address that the FortiClient Host Security application is using,
type ipconfig /all at the Windows Command Prompt on the FortiClient host. The
output will also show the IP address that has been assigned to the host Network Interface
Card (NIC).
It is best to assign VIPs using DHCP over IPSec. The FortiGate dialup server can
act as a DHCP server or relay requests to an external DHCP server. You can also
configure VIPs manually on FortiClient applications, but it is more difficult to
ensure that all clients use unique addresses.
Note: If you assign a VIP on the private network behind the FortiGate unit and enable
DHCP-IPsec (a phase 2 advanced option), the FortiGate unit acts as a proxy on the local
private network for the FortiClient dialup client. Whenever a host on the network behind the
dialup server issues an ARP request for the device MAC address of the FortiClient host, the
FortiGate unit answers the ARP request on behalf of the FortiClient host and forwards the
associated traffic to the FortiClient host through the tunnel. For more information, see
“DHCP-IPSec” on page 145.
Note: FortiGate units fully support RFC 3456, Dynamic Host Configuration Protocol
(DHCPv4) Configuration of IPsec Tunnel Mode. The FortiGate DHCP over IPSec feature
can be enabled to allocate VIP addresses to FortiClient dialup clients using a FortiGate
DHCP server if a policy-based VPN is configured. DHCP over IPSec is not compatible with
FortiGate route-based VPNs.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 57