Certain settings not available in ipsec dialup, why?

Hi all

I am trying to setup a ipsec dialup (to replace SSL VPN) on a FGT200G running 7.4.8, and I am using FortiClient (VPN-Only, free version) with 7.4.3.

As for authentication, I want to start out with local user (without MFA). Once this works I am going to try with Radius (users on FAC with and without FTM) and from there to SAML.

I would like to use a specific interface and a specific (public) IP on said interface (to distinguish that dialup from other dialups).
Preferably, I would like to use peerid's (if possible, but I guess that depends?).
Additionally, I would like to use a PSK. So that the client needs that before connection and getting to any kind of user authentication with username/password (and potential MFA), if that is possible.
(As for split-tunneling and full tunnel, I will try and play around with this, once the first configuration snippet works)

The internet is full of examples (officially from Fortinet as well as from all you experts). Unfortunately, I am hitting issues I can't wrap my head around.

I set the ike-tcp-port to 443 in the system global settings.

Then I tried to add the following phase1-interface config:

config vpn ipsec phase1-interface     edit "du_ras1"         set type dynamic         set interface "x1"         set ike-version 2         set local-gw <one of my public IPs on the interface>         set mode-cfg enable         set proposal aes256-sha256         #set peertype one         set dhgrp 21         set dpd on-idle         set dpd-retryinterval 10         set authmethod psk         #set psksecret "testtest"         set eap enable         #set usrgrp "du_ras_local-group"         set ipv4-start-ip 10.206.0.240         set ipv4-end-ip 10.206.0.250         set ipv4-netmask 255.255.255.0         #set peerid "rasuser1"     next end

The hash-tagged parts are not available all the time and with all combinations:

• If I choose "peertype one" (to set a specific peerid), then I can add "peerid" and "psksecret", however, I can't add "usrgrp" (which to my knowledge is needed for user auth). There seems to be no "xauthtype" and no "authusrgrp" available.
• If I choose "peertype dialup", then I can add "usrgrp", I cannot add "peerid" or "psksecret".

(Refering to the example of https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/785501).

1. Is it possible that using "peertype one" (with peerid and psksecret) only makes sense when using SAML and RADIUS authentication?
2. While using "peertype dialup" (without peerid and without psksecret) only makes sense when authentication is done locally on the FGT?

Thank you for all your assistance.