Fortinet black logo

Administration Guide

IPsec VPN IP address assignments

IPsec VPN IP address assignments

When a user disconnects from a VPN tunnel, it is not always desirable for the released IP address to be used immediately. In IPsec VPN, IP addresses can held for the specified delay interval before being released back into the pool for assignment. The first-available address assignment method is still used.

Example

In this example, two PCs connect to the VPN. The IP address reuse delay interval is used to prevent a released address from being reused for at least four minutes. After the interval elapses, the IP address becomes available to clients again. Dual stack address assignment (both IPv4 and IPv6) is used.

To configure IPsec VPN with an IP address reuse delay interval:
  1. Configure the IPsec phase1 interface, setting the IP address reuse delay interval to 240 seconds:

    config vpn ipsec phase1-interface
        edit "FCT"
            set type dynamic
            set interface "port27"
            set mode aggressive
            set peertype any
            set net-device disable
            set mode-cfg enable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set wizard-type dialup-forticlient
            set xauthtype auto
            set authusrgrp "local-group"
            set ipv4-start-ip 10.20.1.1
            set ipv4-end-ip 10.20.1.100
            set dns-mode auto
            set ipv4-split-include "FCT_split"
            set ipv6-start-ip 2001::1
            set ipv6-end-ip 2001::2
            set ip-delay-interval 240
            set save-password enable
            set psksecret **********
        next
    end
  2. Configure the IPsec phase2 interface:

    config vpn ipsec phase2-interface
        edit "FCT"
            set phase1name "FCT"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        next
        edit "FCT6"
            set phase1name "FCT"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set src-addr-type subnet6
            set dst-addr-type subnet6
        next
    end
To test the results:
  1. Connect to the VPN with FortiClient 1 on PC1 then check the assigned IP address:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:60417
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 14s ago
    xauth-user: userc
    2FA: no
    FortiClient UID: 7C0897D80C8E4B6DAC775DD6B0F93BAA
    assigned IPv4 address: 10.20.1.1/255.255.255.255
    assigned IPv6 address: 2001::1/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 100/100/100 ms
    IPsec SA: created 2/2  established 2/2  time 0/5/10 ms
    
      id/spi: 2 66140ba3e38b9b07/b64668f110ca4a48
      direction: responder
      status: established 14-14s ago = 100ms
      proposal: aes256-sha256
      key: 356637ee6e9a9cb5-fade432c09efb8aa-54be307fc1eeeab5-6e4b9ef19f98d5fa
      lifetime/rekey: 86400/86115
      DPD sent/recv: 00000000/00000394
  2. Disconnect FortiClient 1 and connect with FortiClient 2. The IP address assigned to FortiClient 1 is not released to the pool, and a different IP address is assigned to FortiClient 2:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:64916
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 6s ago
    xauth-user: usera
    2FA: no
    FortiClient UID: EAF90E297393456AB546A041066C0720
    assigned IPv4 address: 10.20.1.2/255.255.255.255
    assigned IPv6 address: 2001::2/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 110/110/110 ms
    IPsec SA: created 2/2  established 2/2  time 0/5/10 ms
    
      id/spi: 3 b25141d5a915e67e/b32decdb8cf98318
      direction: responder
      status: established 6-6s ago = 110ms
      proposal: aes256-sha256
      key: 374ab753f3207ea0-83496b5cb24b5a8d-c51da1fd505cf3a4-727884839897808a
      lifetime/rekey: 86400/86123
      DPD sent/recv: 00000000/00000453
  3. Wait for 240 seconds, then disconnect and reconnect FortiClient 2. The IP address previously assigned to FortiClient 1 has been released back to the pool, and is assigned to FortiClient 2:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:64916
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 20s ago
    xauth-user: usera
    2FA: no
    FortiClient UID: EAF90E297393456AB546A041066C0720
    assigned IPv4 address: 10.20.1.1/255.255.255.255
    assigned IPv6 address: 2001::1/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 100/100/100 ms
    IPsec SA: created 2/2  established 2/2  time 0/0/0 ms
    
      id/spi: 4 fb1fbad0c12f5476/aa06a2de76964f63
      direction: responder
      status: established 20-20s ago = 100ms
      proposal: aes256-sha256
      key: af43f1bb876dc79c-16448592fe608dc3-f251746d71b2c35d-c848e8c03bf738e9
      lifetime/rekey: 86400/86109
      DPD sent/recv: 00000000/000000a9
    Tooltip

    Instead of waiting for 240 seconds, you can instead use the diagnose vpn ike gateway flush command to release the previously used IP addresses back into the pool.

IPsec VPN IP address assignments

When a user disconnects from a VPN tunnel, it is not always desirable for the released IP address to be used immediately. In IPsec VPN, IP addresses can held for the specified delay interval before being released back into the pool for assignment. The first-available address assignment method is still used.

Example

In this example, two PCs connect to the VPN. The IP address reuse delay interval is used to prevent a released address from being reused for at least four minutes. After the interval elapses, the IP address becomes available to clients again. Dual stack address assignment (both IPv4 and IPv6) is used.

To configure IPsec VPN with an IP address reuse delay interval:
  1. Configure the IPsec phase1 interface, setting the IP address reuse delay interval to 240 seconds:

    config vpn ipsec phase1-interface
        edit "FCT"
            set type dynamic
            set interface "port27"
            set mode aggressive
            set peertype any
            set net-device disable
            set mode-cfg enable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set wizard-type dialup-forticlient
            set xauthtype auto
            set authusrgrp "local-group"
            set ipv4-start-ip 10.20.1.1
            set ipv4-end-ip 10.20.1.100
            set dns-mode auto
            set ipv4-split-include "FCT_split"
            set ipv6-start-ip 2001::1
            set ipv6-end-ip 2001::2
            set ip-delay-interval 240
            set save-password enable
            set psksecret **********
        next
    end
  2. Configure the IPsec phase2 interface:

    config vpn ipsec phase2-interface
        edit "FCT"
            set phase1name "FCT"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        next
        edit "FCT6"
            set phase1name "FCT"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set src-addr-type subnet6
            set dst-addr-type subnet6
        next
    end
To test the results:
  1. Connect to the VPN with FortiClient 1 on PC1 then check the assigned IP address:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:60417
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 14s ago
    xauth-user: userc
    2FA: no
    FortiClient UID: 7C0897D80C8E4B6DAC775DD6B0F93BAA
    assigned IPv4 address: 10.20.1.1/255.255.255.255
    assigned IPv6 address: 2001::1/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 100/100/100 ms
    IPsec SA: created 2/2  established 2/2  time 0/5/10 ms
    
      id/spi: 2 66140ba3e38b9b07/b64668f110ca4a48
      direction: responder
      status: established 14-14s ago = 100ms
      proposal: aes256-sha256
      key: 356637ee6e9a9cb5-fade432c09efb8aa-54be307fc1eeeab5-6e4b9ef19f98d5fa
      lifetime/rekey: 86400/86115
      DPD sent/recv: 00000000/00000394
  2. Disconnect FortiClient 1 and connect with FortiClient 2. The IP address assigned to FortiClient 1 is not released to the pool, and a different IP address is assigned to FortiClient 2:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:64916
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 6s ago
    xauth-user: usera
    2FA: no
    FortiClient UID: EAF90E297393456AB546A041066C0720
    assigned IPv4 address: 10.20.1.2/255.255.255.255
    assigned IPv6 address: 2001::2/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 110/110/110 ms
    IPsec SA: created 2/2  established 2/2  time 0/5/10 ms
    
      id/spi: 3 b25141d5a915e67e/b32decdb8cf98318
      direction: responder
      status: established 6-6s ago = 110ms
      proposal: aes256-sha256
      key: 374ab753f3207ea0-83496b5cb24b5a8d-c51da1fd505cf3a4-727884839897808a
      lifetime/rekey: 86400/86123
      DPD sent/recv: 00000000/00000453
  3. Wait for 240 seconds, then disconnect and reconnect FortiClient 2. The IP address previously assigned to FortiClient 1 has been released back to the pool, and is assigned to FortiClient 2:

    # diagnose vpn ike gateway list
    
    vd: root/0
    name: FCT_0
    version: 1
    interface: port27 17
    addr: 173.1.1.1:4500 -> 173.1.1.2:64916
    tun_id: 173.1.1.2
    remote_location: 0.0.0.0
    virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
    created: 20s ago
    xauth-user: usera
    2FA: no
    FortiClient UID: EAF90E297393456AB546A041066C0720
    assigned IPv4 address: 10.20.1.1/255.255.255.255
    assigned IPv6 address: 2001::1/128
    nat: peer
    IKE SA: created 1/1  established 1/1  time 100/100/100 ms
    IPsec SA: created 2/2  established 2/2  time 0/0/0 ms
    
      id/spi: 4 fb1fbad0c12f5476/aa06a2de76964f63
      direction: responder
      status: established 20-20s ago = 100ms
      proposal: aes256-sha256
      key: af43f1bb876dc79c-16448592fe608dc3-f251746d71b2c35d-c848e8c03bf738e9
      lifetime/rekey: 86400/86109
      DPD sent/recv: 00000000/000000a9
    Tooltip

    Instead of waiting for 240 seconds, you can instead use the diagnose vpn ike gateway flush command to release the previously used IP addresses back into the pool.