FortiGate IPSec VPN User Guide - FirewallShop.com

Configuration overview
FortiGate dialup-client configurations
Several different ways to authenticate dialup clients and restrict access to private
networks based on client credentials are available. To authenticate FortiGate
dialup clients and help to distinguish them from FortiClient dialup clients when
multiple clients will be connecting to the VPN through the same tunnel, we
recommend that you assign a unique identifier (local ID) to each FortiGate dialup
client. For more information, see “Authenticating remote peers and clients” on
page 131.
Note: Whenever you add a unique identifier (local ID) to a FortiGate dialup client for
identification purposes, you must select Aggressive mode on the FortiGate dialup server
and also specify the identifier as a peer ID on the FortiGate dialup server. For more
information, see “Enabling VPN access using user accounts and pre-shared keys” on
page 135.
Users behind the FortiGate dialup server cannot initiate the tunnel because the
FortiGate dialup client does not have a static IP address. After the tunnel is
initiated by users behind the FortiGate dialup client, traffic from the private
network behind the FortiGate dialup server can be sent to the private network
behind the FortiGate dialup client.
Encrypted packets from the FortiGate dialup client are addressed to the public
interface of the dialup server. Encrypted packets from the dialup server are
addressed either to the public IP address of the FortiGate dialup client (if the
dialup client connects to the Internet directly), or if the FortiGate dialup client is
behind a NAT device, encrypted packets from the dialup server are addressed to
the public IP address of the NAT device.
Note: If a router with NAT capabilities is in front of the FortiGate dialup client, the router
must be NAT-T compatible for encrypted traffic to pass through the NAT device. For more
information, see “NAT traversal” on page 140.
When the FortiGate dialup server decrypts a packet from the FortiGate dialup
client, the source address in the IP header may be one of the following values,
depending on the configuration of the network at the far end of the tunnel:
• If the FortiGate dialup client connects to the Internet directly, the source
address will be the private IP address of a host or server on the network
behind the FortiGate dialup client.
• If the FortiGate dialup client is behind a NAT device, the source address will be
the public IP address of the NAT device.
In some cases, computers on the private network behind the FortiGate dialup
client may (by co-incidence) have IP addresses that are already used by
computers on the network behind the FortiGate dialup server. In this type of
situation (ambiguous routing), conflicts may occur in one or both of the FortiGate
routing tables and traffic destined for the remote network through the tunnel may
not be sent.
In many cases, computers on the private network behind the FortiGate dialup
client will most likely obtain IP addresses from a local DHCP server behind the
FortiGate dialup client. However, unless the local and remote networks use
different private network address spaces, unintended ambiguous routing and/or
IP-address overlap issues may arise.
FortiGate IPSec VPN Version 3.0 User Guide
72 01-30005-0065-20070716