Matching IPsec tunnel gateway based on address parameters 7.4.4

FortiOS supports source IP anchoring in dial-up IPsec tunnel connection. When a dial-up client first makes an IPsec connection to the FortiGate VPN gateway, the FortiGate will use the source IP to match the IPsec tunnel based on the IP subnet, address range or country defined for that IPsec tunnel. IPv4 and IPv6 are supported. This feature requires the dynamic (dial-up) tunnel to be defined in IKEv2.

config vpn ipsec phase1-interface
    edit <name>
        set type dynamic
        set ike-version 2
        set remote-gw-match {any | ipmask | iprange | geography}
    next
end

For more information about this feature, see Matching IPsec tunnel gateway based on address parameters.