IPsec dialup wrong order ip allocation

Question

Hi,I'm trying to configure custom configuration for dialup forticlient on windows, in phase1-interface I have configured "mode-cfg : enable" and "ipv4-name : ipsec_range" this ipsec ip range have adresses from 192.168.30.1-192.168.30.2. Now when server connects to fortigate it gets address 192.168.30.1 and gateway is 192.168.30.2 so this is wrong order, also in ip configuration of this forticlient connection I see that dhcp is enabled with dhcp server 192.168.30.2 how to disable this dhcp?All I need is to have server at 192.168.30.2 with gateway 192.168.30.1 Ethernet adapter Ethernet 2:     Connection-specific DNS Suffix  . :    Description . . . . . . . . . . . : Fortinet Virtual Ethernet Adapter (NDIS 6.30)    Physical Address. . . . . . . . . :     DHCP Enabled. . . . . . . . . . . : Yes    Autoconfiguration Enabled . . . . : Yes    Link-local IPv6 Address . . . . . :     IPv4 Address. . . . . . . . . . . : 192.168.30.1(Preferred)    Subnet Mask . . . . . . . . . . . : 255.255.255.0    Lease Obtained. . . . . . . . . . :     Lease Expires . . . . . . . . . . :     Default Gateway . . . . . . . . . : 192.168.30.2    DHCP Server . . . . . . . . . . . : 192.168.30.2    DHCPv6 IAID . . . . . . . . . . . :     DHCPv6 Client DUID. . . . . . . . :     DNS Servers . . . . . . . . . . . : 192.168.100.5                                        0.0.0.0    NetBIOS over Tcpip. . . . . . . . : Enabled

vdralio · Answer

Hi @Tutek ,

There is nothing wrong with the IP address assignment, by design the first IP address from the pool (range of IP address) will be assigned to the client connected. By default, the first-available address assignment method is still used.

As you are using a range of IP addresses for the client connected to the VPN, then a scope is created and will be maintained by FortiGate. It is a must to maintain the scope and determine which IP address has to be assigned and which is already assigned.

Please check the article also is the same:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/785501/forticlient-as-dialup-client

You can use IP address reservation if you want so the client will have the same IP address all the time.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DHCP-IP-address-configuration-with-Dial-up-IPsec/ta-p/190900?externalID=FD48448

On FortiOS 7.0 and the latest, there is an option to change the IP address assigned to the round-robin, check below:

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/4729/ssl-vpn-and-ipsec-vpn-ip-address-assignments-7-0-1

https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/4729/ipsec-vpn-ip-address-assignments

Best Regards,

Vasil Dralio