| When multiple dial-up IPsec IKEv2 IPsec VPN tunnels are configured on FortiGate, a unique Network ID must be defined on each Phase 1 configuration. This allows FortiGate to correctly match incoming IKEv2 initiations with the appropriate tunnel.
If the Network ID is not defined, FortiGate cannot reliably determine which Phase 1 configuration to use when multiple IKEv2 dial‑up tunnels reside on the same interface. This behavior differs from IKEv1, where Peer IDs were used to distinguish between tunnels. Use the following CLI syntax to define the Network ID for each Phase 1 configuration: config vpn ipsec phase1-interface
edit "<phase1-name>"
set ike-version 2 set network-overlay enable
set network-id <integer>
next
end The Network ID must be defined on both the FortiGate Phase1 and the FortiClient configuration to ensure correct tunnel matching. In FortiClient VPN-only (free version), the GUI does not allow setting the Network ID.
Instead, the FortiClient XML configuration file can be manually edited or provisioned via EMS with the Network ID attribute. Locate the <ike_settings> section of the XML, and insert the <networkid> tag as shown below.
Note: Occasionally, this value is not included in the configuration. In that case, manually add the <network-id> section as shown below. <ike_settings> <networkid>2</networkid> <----- Add the entry here. <version>2</version> In this example, '2' represents the Network ID and must match the corresponding Phase 1 configuration on the FortiGate.
Ensure that the <networkid> tag is placed within the correct tunnel definition block in the XML file.
Result: After importing the modified XML configuration into FortiClient, the IKEv2 initiator message will include the Network ID.
This allows FortiGate to correctly match the proper Phase 1 configuration even when multiple IKEv2 dial‑up tunnels share the same interface.
The configured Network ID must be unique for each IKEv2 tunnel, allowing the FortiGate to distinguish and correctly select the intended Phase 1 configuration. The configured Network ID can be seen in the IKE debugs: diagnose debug application ike -1
diagnose debug enable ike V=root:0: comes 192.168.11.100:1012->10.0.0.46:500,ifindex=3,vrf=0,len=529....
ike V=root:0: IKEv2 exchange=SA_INIT id=90914a0a9bfec090/0000000000000000 len=529
ike 0: in 90914AxxxxF05002
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: responder received SA_INIT msg
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: VID Forticlient EAP Extension C1DC4350476B98A429B91781914CA43E
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: received notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: received notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: received notify type VPN_NETWORK_ID
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: NETWORK ID : 2
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: incoming proposal:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: proposal id = 1:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: protocol = IKEv2:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: encapsulation = IKEv2/none
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=ENCR, val=AES_CBC (key_len = 128)
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=INTEGR, val=AUTH_HMAC_SHA_96
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=PRF, val=PRF_HMAC_SHA
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=DH_GROUP, val=MODP2048.
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: proposal id = 2:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: protocol = IKEv2:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: encapsulation = IKEv2/none
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=DH_GROUP, val=MODP2048.
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: matched proposal id 2
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: proposal id = 2:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: protocol = IKEv2:
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: encapsulation = IKEv2/none
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: type=DH_GROUP, val=MODP2048.
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: lifetime=86400
ike V=root:0:90914a0a9bfec090/0000000000000000:1216: SA proposal chosen, matched gateway IPSECDIALUP To disable the debugging, use the following command: diagnose debug disable Note: The <networkid> option is not supported on FortiClient iOS or Android. Refer to the IKE Settings FortiClient document in the related articles below.
Related articles: | 
