IPSEC Remote access Vpn and Framed-IP (static ip assignment by Radius)
Hello Folks,
i need to deploy 2 ipsec vpn for remote access.
the ip address of each client is associated in the radius server (NPS) as radius attribute, how can i replicate this configuration for ipsec?
i read i need to enable the "set mode-cfg enable" and "set assign-ip " commands, unfortunately as per the configuration below, i'm unable to change the latter commad (in gui i'm returned "-1: Invalid length of value" as i set the group, and in cli i can't edit nor delete it).
furthermore i need 2 vpn, the first allowing user to use split tunnel and the other denying it, how can i achieve this scope?
is it possibile?
For the ip assignment i don't have fortiauthenticator so i'm forced to use the NPS.
FORTIGATE (phase1-interface) # show
config vpn ipsec phase1-interface
edit "VpnRaNoSplit"
set type dynamic
set interface "Wan_vpn"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 10.2.22.18
set proposal aes256-sha256
set dpd disable
set dhgrp 18
set assign-ip disable
set psksecret ENC Sg5hE6mdy+XAVlpvtJWQWXTpcRHEq6HeZ5r0jVh9yS3O3RqGXPzwaff2AyFXOV8J1pBMoDlhL1PhteED31gG4FXda6vipxYCX8aQhiZdCQ0tdlTXiJBTuFoa4QgHzROsATsZIPMwNX0tNV5o4visz0RQEQZvtbS248KnP5nmxkRqdeTUN5+2ndZukZexDmECoOXP9FlmMjY3dkVA
next
end
FORTIGATE ((Vpn) # config vpn ipsec phase2-interface
FORTIGATE ((phase2-interface) # show
config vpn ipsec phase2-interface
edit "VpnRaNoSplit"
set phase1name "VpnRaNoSplit"
set proposal aes256-sha512
set dhgrp 18
next
end
can anyone help me?
fortigate version is 7.4.7
i've added the error when trying to change or add a specific group instead of using "any peer ID" in the authetication section
 
thank you
regards