Technical Tip: Configure an IP Address on an IPsec Tunnel Interface
Description
This article describes the reasoning and process for configuring an IP address for an IPsec tunnel interface.
Scope
FortiGate, IPsec.
Solution
- Background.
- FortiGate interfaces typically need an IP address to send and receive traffic.
- IPsec tunnel interfaces are an exception; they can exist without an IP.
- Self-originated traffic (e.g., ping, SFTP backups, SNMP traps, logs) needs a source IP to route correctly.
- Related guide: Technical Tip: How to control/change the FortiGate source IP for self-generated traffic.
-
Default behavior without IP.
- If a tunnel interface has no IP address, the FortiGate uses the IP of the first interface in its list (lowest interface index) as the source for outgoing traffic.
- See more details: Technical Tip: Self-originating traffic over IPSec VPN (For example ping).
-
Potential issues.
- If the chosen source IP is not routable, traffic may fail to reach the remote destination.
- Example: CLI backups using SFTP can fail if the tunnel has no IP.
- See more details: Technical Tip: How to take backup from CLI using secure FTP (SFTP) protocol.
-
Recommended practice.
- Assign an IP address to all IPsec tunnel interfaces to ensure FortiGate self-originated traffic uses a valid and routable source IP. This allows services such as ping, SFTP backups, SNMP, and logging to work properly.
- Configure IP addresses on both ends of the VPN using the same subnet. A /30 subnet is commonly used for site-to-site tunnels, while a /24 subnet may be used for larger deployments such as hub-and-spoke.
- Configure the Remote IP/Netmask field to define the remote tunnel address. This also automatically adds a static route in the FortiGate routing table.
- The local tunnel interface IP is typically configured with a /32 subnet mask, while the remote side may use a larger subnet, such as /24 or /16, depending on the network design.
Summary.
In the following example, the IPsec tunnel interface has a local IP address of 172.16.1.101 and a Remote IP/Netmask of 172.16.1.1/24 (255.255.255.0). To set the interface address, go to Network -> Interfaces and edit the IPsec tunnel interface:
The equivalent CLI configuration would be as follows:
config system interface
edit "advpn1"
set vdom "root"
set ip 172.16.1.101 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 172.16.1.1 255.255.255.0
set snmp-index 9
set interface "VLAN201"
end
Note:
By default, FortiGate self-originating traffic relies on routing table lookups to select the egress interface; SD-WAN rule policy routes do not apply unless the specific feature supports interface-select-method (sdwan/specify).
Related article: