Skip to main content
btey
Staff & Editor
btey
Staff & Editor
July 5, 2021

Technical Tip: Enable 'Policy-Based IPsec VPN' configuration

  • July 5, 2021
  • 0 replies
  • 36402 views

Description

 

This article describes how to enable 'Policy-Based IPsec VPN' configuration from GUI and CLI.

 

Scope

 

FortiGate.

Solution

 

By default, 'Policy-Based IPsec VPN' configuration is disabled in the GUI.

Refer to the following:
Go to VPN -> IPsec Tunnels, select 'Create new' and 'Custom'.

 
To enable the 'Policy-Based IPsec VPN':
Go to System -> Feature Visibility, enable 'Policy-based IPsec VPN', and select 'Apply'.
 
 
To enable the 'Policy-Based IPsec VPN' from the CLI use the following commands:
 

config system settings

set gui-policy-based-ipsec enable

end

 

Screenshot_5-9-2024_155443_10.5.61.186.jpeg

 

Once applied, go to VPN -> IPsec Tunnels, select 'Create new', 'Custom', and unselect 'Enable IPsec Interface Mode'.
 
policybased.jpg
 
Create a Policy from the LAN interface to the remote lan subnet of the Policy-based VPN using the external interface as the outgoing interface. The IPsec Action in the policy allows the tunnel to be selected.
 
PolicyBasedVPN-Policy.png
 
Related documents:
    Terms & ConditionsAccessibility statement