Skip to main content
IT_ZD
IT_ZD
Explorer
January 31, 2024
Question

Creat Dial-up interface on FGT (VPN-Ipsec with remote site_Dynamic_IP)

  • January 31, 2024
  • 3 replies
  • 4250 views

Hello,

I hope you are well,

I need your help "if possible" to configure a dial-up interface on a sub-interface in order to use it for an IPSec VPN link (First Is it possible ?)

I tried to configure it by creating a standard VPN tunnel behind a NAT, then I edited the configuration by replacing the interface (IP Static) with a dial-up interface, the problem is that I can't save it and I get an error code -9999: -9999.

Here's a capture of the error and the topology target, knowing that I'm on migration from an ASA to a Fortigate (Fresh install).vpn.JPG

Fortigate albaraka.JPG

 

ASA configuration :

asa_dialup.JPG

Regards.

    3 replies

    rosatechnocrat
    rosatechnocrat
    Explorer III
    February 1, 2024

    You can use an FQDN address in remote gateway. That FQDN can resolve to dynamic IP. You can use dynamic DNS service.

    Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
    IT_ZD
    IT_ZDAuthor
    Explorer
    February 1, 2024

    Thanks for your return and information.

     

    I'm going to save it as solution B because I want to respect the same configuration I have on the Old_ASA.

    pminarik
    Staff
    pminarik
    Staff
    February 1, 2024

    > "if possible" to configure a dial-up interface on a sub-interface

     

    Yes, this is possible. You can create an IPsec tunnel on top of a LAG, a VLAN, etc.

     

    >  the problem is that I can't save it and I get an error code -9999: -9999.

     

    If you're changing the tunnel type from static site-to-site to dynamic dialup/hub-and-spoke and are getting an error, you're most likely missing some necessary config options. I would suggest to do this via the CLI, which will hopefully give you a more meaningful error.

    IT_ZD
    IT_ZDAuthor
    Explorer
    February 1, 2024

    Thanks for your return and information.

    In CLI, should I apply the configuration to the physical interface or the Vlan interface?

    Regards.

     

     

    pminarik
    Staff
    pminarik
    Staff
    February 1, 2024

    My understanding was that you're trying to change settings of the IPsec tunnel. If that is correct, then you should make the change in the IPsec tunnel's configuration.

      hbac
      Staff
      hbac
      Staff
      February 1, 2024

      Hi @IT_ZD,

       

      You cannot change from dialup to static IP after the creating the tunnel, please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Error-9999-when-changing-remote-gateway-type/ta-p/270240

       

      You can create a custom tunnel without using the wizard. 

       

      Regards, 

      IT_ZD
      IT_ZDAuthor
      Explorer
      February 1, 2024

      so I can't modify the interface after creating the tunnel Okaaayyy

       

      Otherwise, for my scenario above, the interface that I need to create is a Dial-Up interface ? because on the Old_ASA to be I have a Dial-Up interface.

       

      Ok I'll try and get back to you. Thx a lot hbac

      Terms & ConditionsAccessibility statement