Skip to main content
journeyman
journeyman
New Member
September 3, 2015
Solved

Fortigate as a dial-up vpn client?

  • September 3, 2015
  • 7 replies
  • 13835 views

Using 60C hardware I've been asked to connect to a vendor VPN gateway. The only details I have been provided are IP address, username and password, and the fact that we "are able to connect just by creating a VPN connection in windows".

Connecting from a Windows box doesn't suit our needs.

I'm familiar with ipsec point to point but not dialup.

All the vpn information I can find is either point to point or where forticlient / iOS / M$ etc are the dial up clients and fortigate is the vpn gateway. I've searched this forum, the kb, the handbook and the cookbook.

I found the Microsoft VPN section of the handbook but the fortigate is the gateway not the client. Even that mentions username, password and psk but we haven't been advised of a psk.

 

Can the fortigate act like as a dialup client similar to a windows VPN client? Is the information provided to us sufficient?

 

edit - we will have a dynamic IP and traverse a NAT.

    Best answer by ede_pfau

    @journeyman:

    I stand corrected (hopefully) - we've had this same subject in the forums just 2 years ago, and we (Selective, emnoc, me) stated that the smaller FGTs could well act as an L2TP client! Read up here https://forum.fortinet.com/tm.aspx?m=98720 for details. There is a setting in the (WAN) interface setup that enables this and opens additional settings.

     

    This should get you going. Keep us posted!

    7 replies

    journeyman
    journeymanAuthor
    New Member
    September 4, 2015

    Anyone? It seems simple enough...

     

    The lazy way would be to use a Windows box and share the connection, but that's a bit ugly and I'd rather not.

    emnoc
    emnoc
    New Member
    September 4, 2015

    As far as I'm aware, the fortigate has no  VPNclient capabilities. The "Cisco EasyVPN"  is not a solution in the fortigate as client.

     

    Could you just ask for a static lan2lan  vpn solution?

     

     

    rwpatterson
    rwpatterson
    New Member
    September 4, 2015

    Is the M$ solution ("able to connect just by creating a VPN connection in Windoze") IPSec or PPTP?

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 5, 2015

    Hi Bob,

     

    nice to hear from you again, it's been a while.

     

    Windows VPN is L2TP with IPsec in phase2, but not in 'tunnel mode' but 'transfer mode'. Sounds convoluted and it is. AFAIK the FGT is capable of being a L2TP server (via CLI only) for historical reasons but I've never heard that it could act as a L2TP client.

     

    IMHO site to site VPN is not what Windows VPN is meant for. The other side should just offer a standard IPsec gateway, and be done with it.

    rwpatterson
    rwpatterson
    New Member
    September 8, 2015

    ede_pfau wrote:

    Hi Bob,

     

    nice to hear from you again, it's been a while.

     

    Thanks Ede. As in the past, I lurk and post when I think I can help. Since my departure from the daily management, my expertise is now centered on the older, more widely placed unit base. The bleeding edge stuff I'll leave to you gurus. (I really should change my signature...)

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    September 5, 2015

    @journeyman:

    I stand corrected (hopefully) - we've had this same subject in the forums just 2 years ago, and we (Selective, emnoc, me) stated that the smaller FGTs could well act as an L2TP client! Read up here https://forum.fortinet.com/tm.aspx?m=98720 for details. There is a setting in the (WAN) interface setup that enables this and opens additional settings.

     

    This should get you going. Keep us posted!

    journeyman
    journeymanAuthor
    New Member
    September 7, 2015

    Thanks all for your replies. And Ede I was very happy to see your second post. But so far no luck.

     

    The working basic Windows VPN connection appears to be pptp on port 1723.

    To check the possibility of using l2tp, I changed the Windows PC vpn configuration from "Automatic" to "l2tp". This did not succeed and continued to use port 1723 not port 1701.

     

    Perhaps their server is also listening on 1701. It seems to be a long shot but I will try to implement using the FGT.

    This tunnel will be temporary.

    I agree with everyone saying a proper tunnel is better. I can ask but I don't like my chances.

    journeyman
    journeymanAuthor
    New Member
    September 8, 2015

    I created a l2tp client per emnoc's example in the linked thread. A packet capture (external, wireshark) shows the server shuts down the connection immediately, prior to any authentication:

    > SCCRQ

     

    < SCCRP

     

    > SCCRN

     

    < ZLB

     

    > ICRQ

     

    < ZLB # OK so far

     

    < CDN "Call failed due to detection of a busy signal"By the way, is there any documentation to describe the integer value of "debug level", for example in the command:

    diagnose debug application [l2tp|l2tpcd] <debug level>
    I already searched the diagnose wiki but did not see it there. More out of curiosity since there's not much to check.

    edit - following on from the above, how to debug the l2tp client within the FGT?

     

    Thanks for your help, back to the vendor I guess..

    echo
    echo
    Explorer II
    September 8, 2015

    Did I miss something? You wanted Fortigate act as client, and also IPSEC is OK? I recently configured one like that and it worked. We couldn't get a certain newer Huawei modem work "bridge-like" so first we got internet working and then created an IPSEC client-tunnel to headquarter's FortiGate and it worked like that. Branch office fortigate wasn't reachable any other way than using TeamViewer in one of the user's machine in the branch office, which wasn't good of course.

    Terms & ConditionsAccessibility statement