Fortinet black logo

FortiGate-6000 Handbook

Configuring the FortiGate-6000 as a dialup IPsec VPN server

Configuring the FortiGate-6000 as a dialup IPsec VPN server

FortiGate-6000s can be configured as dialup IPsec VPN servers.

Example dialup IPsec VPN configuration

The following shows how to setup a dialup IPsec VPN configuration where the FortiGate-6000 acts as a dialup IPsec VPN server.

To configure the FortiGate-6000 as a dialup IPsec VPN server
  1. Configure the phase1, set type to dynamic.

    config vpn ipsec phase1-interface

    edit dialup-server

    set type dynamic

    set interface "v0020"

    set peertype any

    set psksecret <password>

    end

  2. Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0.

    config vpn ipsec phase2-interface

    edit dialup-server

    set phase1name dialup-server

    set src-subnet 4.2.0.0 255.255.0.0

    set dst-subnet 0.0.0.0 0.0.0.0

    end

To configure the remote FortiGate as a dialup IPsec VPN client

The dialup IPsec VPN client should advertise its local subnet(s) using the phase 2 src-subnet option.

Note If there are multiple local subnets, create a phase 2 for each one. Each phase 2 only advertises one local subnet to the dialup IPsec VPN server. If more than one local subnet is added to the phase 2, only the first one is advertised to the server.
  1. Dialup client Phase 1 configuration.

    config vpn ipsec phase1-interface

    edit "to-fgt6k"

    set interface "v0020"

    set peertype any

    set remote-gw 1.2.0.1

    set psksecret <password>

    end

  2. Dialup client Phase 2 configuration.

    config vpn ipsec phase2-interface

    edit "to-fgt6k"

    set phase1name "to-fgt6k"

    set src-subnet 4.2.6.0 255.255.255.0

    set dst-subnet 4.2.0.0 255.255.0.0

    next

    edit "to-fgt6k-2"

    set phase1name "to-fgt6k"

    set src-subnet 4.2.7.0 255.255.255.0

    set dst-subnet 4.2.0.0 255.255.0.0

    end

Configuring the FortiGate-6000 as a dialup IPsec VPN server

FortiGate-6000s can be configured as dialup IPsec VPN servers.

Example dialup IPsec VPN configuration

The following shows how to setup a dialup IPsec VPN configuration where the FortiGate-6000 acts as a dialup IPsec VPN server.

To configure the FortiGate-6000 as a dialup IPsec VPN server
  1. Configure the phase1, set type to dynamic.

    config vpn ipsec phase1-interface

    edit dialup-server

    set type dynamic

    set interface "v0020"

    set peertype any

    set psksecret <password>

    end

  2. Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0.

    config vpn ipsec phase2-interface

    edit dialup-server

    set phase1name dialup-server

    set src-subnet 4.2.0.0 255.255.0.0

    set dst-subnet 0.0.0.0 0.0.0.0

    end

To configure the remote FortiGate as a dialup IPsec VPN client

The dialup IPsec VPN client should advertise its local subnet(s) using the phase 2 src-subnet option.

Note If there are multiple local subnets, create a phase 2 for each one. Each phase 2 only advertises one local subnet to the dialup IPsec VPN server. If more than one local subnet is added to the phase 2, only the first one is advertised to the server.
  1. Dialup client Phase 1 configuration.

    config vpn ipsec phase1-interface

    edit "to-fgt6k"

    set interface "v0020"

    set peertype any

    set remote-gw 1.2.0.1

    set psksecret <password>

    end

  2. Dialup client Phase 2 configuration.

    config vpn ipsec phase2-interface

    edit "to-fgt6k"

    set phase1name "to-fgt6k"

    set src-subnet 4.2.6.0 255.255.255.0

    set dst-subnet 4.2.0.0 255.255.0.0

    next

    edit "to-fgt6k-2"

    set phase1name "to-fgt6k"

    set src-subnet 4.2.7.0 255.255.255.0

    set dst-subnet 4.2.0.0 255.255.0.0

    end