iOS device as dialup client

When FortiGate is configured as a dialup VPN server, Apple devices, such as iPhones or iPads, with dynamic or unknown IP addresses can establish secure connections over the Internet to access private resources protected by FortiGate.

In this example, the FortiGate protects a local network (10.10.111.0/24) that a remote user on an iOS device needs to securely access over the Internet using a VPN connection. The FortiGate is configured as a dialup VPN server on wan1, and the iOS device is the dial-up IPsec VPN client.

You can configure dialup IPsec VPN with an iOS device as the dialup client using the VPN Wizard in the GUI or the CLI.

This example shows VPN configurations in IKEv1. Starting with FortiClient 7.4.4, IKEv1 is no longer supported on the client. Therefore, plan accordingly when choosing your IKE version. Use IKEv2 if you plan on deploying FortiClient 7.4.4 and later.

To configure IPsec VPN with an iOS device as the dialup client in the GUI:

1. Configure a local user:

   1. Go to User & Authentication > User Definition and click Create New.

   2. Set the User Type to Local User, then click Next.

   3. Set the Login Credentials, then click Next:

      • Username: vpnuser1

      • Password: Enter a suitable password

   4. Disable Two-factor Authentication, then click Next.

   5. Set User Account Status to Enabled and disable User Group, then click Submit.

2. Configure a local user group:

   1. Go to User & Authentication > User Groups and click Create New.

   2. Configure the following:

      Field	Value
      Name	vpngroup
      Type	Firewall
      Members	vpnuser1

   3. Click OK.

   For other types of authentication, such as LDAP, PKI, or SAML, see User & Authentication.

3. Go to VPN > VPN Wizard.

4. Enter a name for the VPN in the Tunnel name field. In this example, ios_client

5. Set Select a template to Remote Access.

6. Click Begin.

7. Configure the VPN tunnel settings:

   Field	Value
   VPN client type	iOS
   Authentication method	Pre-shared key
   Pre-shared key	Enter a suitable key. The same pre-shared key is used by the remote user on the iOS device to connect to the dialup VPN.
   IKE	Version 1
   NAT traversal	Enable Set Keepalive frequency to 10.
   User group	vpngroup
   Require 'Group Name' on VPN client	Disable
   DNS Server	Use System DNS
   Enable IPv4 Split Tunnel	Enable

8. Click Next.

9. Configure the Remote Endpoint settings:

   Field	Value
   Addresses to assign to connected endpoints	10.10.2.1-10.10.2.200
   Subnet for connected endpoints	255.255.255.255

10. Click Next.

11. Configure the Local FortiGate settings:

    Field	Value
    Incoming interface that binds to tunnel	wan1 Disable Create and add interface to zone.
    Local interface	lan
    Local address	local_network Click + to create a new address object with Type set to Subnet and IP/Netmask set to 10.10.111.0/24, if not already configured.

12. Click Next.

13. Review the configuration and, if everything is correct, click Submit.

    The IPsec VPN is configured and is visible on the VPN > VPN Tunnels page.

To configure IPsec VPN with an iOS device as the dialup client in the CLI:

1. Configure a local user:

   config user local
       edit "vpnuser1" 
           set type password
           set passwd ******
       next 
   end

2. Configure a local user group:

   config user group
       edit "vpngroup" 
           set member "vpnuser1"
       next 
   end

3. Configure the internal interface.

   The LAN interface connects to the corporate internal network. Traffic from this interface routes out the IPsec VPN tunnel. Creating an address group for the protected network behind this FortiGate causes traffic to this network group to go through the IPsec tunnel.

   config system interface 
       edit "lan"
           set vdom "root"
           set ip 10.10.111.1 255.255.255.0
       next
   end

   config firewall address
       edit "local_subnet_1" 
           set subnet 10.10.111.0 255.255.255.0 
       next 
   end

   config firewall addrgrp
       edit "local_network" 
           set member "local_subnet_1"
       next 
   end

4. Configure the WAN interface.

   The WAN interface is the interface connected to the ISP. It can be configured in static mode (as shown here), DHCP, or PPPoE mode. It is recommended to configure it with a static IP address to ensure that the IPsec VPN configuration on the on the iOS device stays unchanged if the WAN IP changes on the FortiGate. The IPsec tunnel is established over the WAN interface.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 203.0.113.249 255.255.255.0
       next
   end

5. Configure the client address pool.

   You must create a firewall address to assign an IP address to a client from the address pool.

   config firewall address
       edit "client_range"
           set type iprange
           set comment "VPN client range"
           set start-ip 10.10.2.1
           set end-ip 10.10.2.200
       next
   end

6. Configure the IPsec phase1-interface.

   PSK is used as the authentication method in this example. Signature authentication is also an option.

   config vpn ipsec phase1-interface
       edit "ios_client"
           set type dynamic
           set interface "wan1"
           set mode main
           set peertype any
           set net-device disable
           set mode-cfg enable
           set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
           set dpd on-demand
           set dpd-retryinterval 20
           set xauthtype auto
           set authusrgrp "vpngroup"
           set assign-ip-from name
           set ipv4-name "client_range"
           set dns-mode auto
           set ipv4-split-include "local_network"  
           set save-password enable
           set psksecret *****
       next
   end

7. Configure the IPsec phase2-interface:

   config vpn ipsec phase2-interface 
       edit "ios_client" 
           set phase1name "ios_client" 
           set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305 
           set pfs disable
       next
   end

8. Configure a firewall policy to allow client traffic flow over the IPsec VPN tunnel to the FortiGate’s lan interface:

   config firewall policy 
       edit 1 
           set name "inbound" 
           set srcintf "ios_client" 
           set dstintf "lan" 
           set srcaddr "client_range" 
           set dstaddr "local_network" 
           set action accept 
           set schedule "always" 
           set service "ALL" 
       next 
   end

To configure the iOS device:

1. On the iOS device, go to Settings > General > VPN & Device Management > VPN and select Add VPN Configuration.

2. Configure the following details:

   Field	Value
   Type	IPsec
   Description	Enter a suitable description.
   Server	203.0.113.249 (the wan1 IP address of the FortiGate the is configured as the IPsec VPN dialup server)
   Account	vpnuser1 (the local user configured on the FortiGate)
   Password	Enter the password configured for the user.
   Secret	Enter the pre-shared key that is configured on the FortiGate.

3. Leave the remaining settings as their default values and press Done.

4. Go to Settings > General > VPN & Device Management > VPN

5. Highlight the IPsec VPN configuration (indicated by a checkmark) and press the Not Connected toggle to enable the VPN.

6. If prompted, enter your user credentials.

7. The VPN Status changes to Connected and a VPN icon appears at the top of the screen.

To verify the tunnel status in the GUI:

1. On the FortiGate, go to Dashboard > Network and expand the IPsec widget.

2. Find the new tunnel, ios_client_0 in this example, and check the statuses of the Phase 1 and Phase 2 selectors.

   Successfully established dialup IPsec VPN tunnels are displayed using a parent name followed by an index, creating a structured and organized association with the parent tunnel. For example, the parent name ios_client results in tunnel names such as ios_client_0, ios_client_1, and so on.

3. Hover the cursor over the tunnel name to see additional details.

To verify the tunnel status in the CLI:

1. Verify the IPsec Phase 1 tunnel status on the FortiGate:

   FortiGate # diagnose vpn ike gateway list name ios_client_0
   
   vd: root/0
   name: ios_client_0
   version: 1
   interface: wan1 3
   addr: 203.0.113.249:4500 -> 198.51.100.171:40398
   tun_id: 198.51.100.171/::10.0.0.8
   remote_location: 0.0.0.0
   network-id: 0
   transport: UDP
   created: 22s ago
   xauth-user: vpnuser1
   2FA: no
   peer-id: 0.0.0.0
   peer-id-auth: no
   assigned IPv4 address: 10.10.2.1/255.255.255.255
   nat: me peer
   pending-queue: 0
   IKE SA: created 1/1  established 1/1  time 330/330/330 ms
   IPsec SA: created 1/1  established 1/1  time 280/280/280 ms
   
     id/spi: 5 456ee87e1ccab0d5/a2d3d3f43d7c1147
     direction: responder
     status: established 22-22s ago = 330ms
     proposal: aes256-sha256
     key: c5b56bf00a715ad4-7332f707363766b5-9d7fc85b5003227c-18ab12ec2a8c4823
     QKD: no
     PQC-KEM (IKE): no
     PQC-KEM (all IPsec): no
     lifetime/rekey: 3600/3307
     DPD sent/recv: 00000000/00000000
     peer-id: 0.0.0.0
   

   Note that FortiGate acts as the responder, establishes the IPsec tunnel with remote iOS device with IP 198.51.100.171 over UDP NAT-T port 4500 on its wan1 interface, and dynamically assigns a VPN IP of 10.10.2.1 to the iOS device. The authenticated username is also displayed in xauth-user field.

2. Verify the IPsec Phase 2 tunnel status on either the Branch or HQ:

   FortiGate # diagnose vpn tunnel list name ios_client_0
   list ipsec tunnel by names in vd 0
   ------------------------------------------------------
   name=ios_client_0 ver=1 serial=a 203.0.113.249:4500->198.51.100.171:40398 nexthop=203.0.113.250 tun_id=198.51.100.171 tun_id6=::10.0.0.8 status=up dst_mtu=1200 weight=1
   bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74664 options[123a8]=npu rgwy-chg rport-chg frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
   
   parent=ios_client index=0
   proxyid_num=1 child_num=0 refcnt=7 ilast=42956699 olast=42956699 ad=/0
   stat: rxp=0 txp=0 rxb=0 txb=0
   dpd: mode=on-demand on=1 status=ok idle=20000ms retry=3 count=0 seqno=0
   natt: mode=keepalive draft=32 interval=10 remote_port=40398
   fec: egress=0 ingress=0
   proxyid=ios_client proto=0 sa=1 ref=2 serial=1 add-route
     src: 0:10.10.111.0-10.10.111.255:0
     dst: 0:10.10.2.1-10.10.2.1:0
     SA:  ref=3 options=20083 type=00 soft=0 mtu=1118 expire=3032/0B replaywin=2048
          seqno=1 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
     life: type=01 bytes=0/0 timeout=3588/3600
     dec: spi=1bddf144 esp=aes key=32 7b869ab5470bcd36ea84772b526081067fedbfb3c82347d67da27624d757750c
          ah=sha256 key=32 e25c84a309cdb0ab1dd2b1fd2953e5c74a4b0b9a8ad20cbcf046edf5edd3174e
     enc: spi=01e1446e esp=aes key=32 030d2fd16ce78591ccc87ff28e8bc74b7a4a11acaab7fe54f5abea9609f02cd1
          ah=sha256 key=32 45a02f1476faa30afcf55fdb4a058464702983076bf7877ef27201e75e9ba786
     dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
     npu_flag=00 npu_rgwy=198.51.100.171 npu_lgwy=203.0.113.249 npu_selid=4 dec_npuid=0 enc_npuid=0
   

   Note the decryption, encryption, and authentication keys negotiated in Phase 2 to protect subnets under the src and dst fields. FortiOS also automatically adds the dynamically assigned VPN IP of 10.10.2.1 to its traffic selectors for dialup tunnel for_client_0.

To verify traffic through the IPsec tunnel:

1. On the iOS device with public IP 198.51.100.171 open an app that has the ping utility and initiate ICMP requests the a machine in the 10.10.111.0/24 network, then verify that traffic goes through:

   # ping 10.10.111.3
   PING 10.10.111.3 (10.10.111.3) 56(84) bytes of data.
   64 bytes from 10.10.111.3: icmp_seq=1 ttl=62 time=9.82 ms
   64 bytes from 10.10.111.3: icmp_seq=2 ttl=62 time=0.809 ms

2. On FortiGate, run a sniffer trace for ICMP packets destined to 10.10.111.3:

   # diagnose sniffer packet any 'host 10.10.111.3’ 4 0 l
   Using Original Sniffing Mode
   interfaces=[any]
   filters=[host 10.10.111.3]
   2024-11-05 12:06:05.509711 ios_client_0 in 10.10.2.1 -> 10.10.111.3: icmp: echo request
   2024-11-05 12:06:05.509791 lan out 10.10.2.1 -> 10.10.111.3: icmp: echo request
   2024-11-05 12:06:05.518809 lan in 10.10.111.3 -> 10.10.2.1: icmp: echo reply
   2024-11-05 12:06:05.518899 ios_client_0 out 10.10.111.3 -> 10.10.2.1: icmp: echo reply

   The ICMP request packets are received on ios_client_0 tunnel interface and routed to the lan interface. ICMP reply packets are received on the lan interface and routed back out on ios_client_0 tunnel interface.

   For more information, see Performing a sniffer trace or packet capture.

3. Optionally, run real time IKE debug using appropriate filters for troubleshooting if the IPsec tunnel does not come up:

   FortiGate # diagnose vpn ike log filter rem-addr4 198.51.100.171
   FortiGate # diagnose debug application ike -1
   FortiGate # diagnose debug enable
   

   For more information, see VPN IPsec troubleshooting.