Skip to main content
Sinichi_Kudo
Sinichi_Kudo
Explorer
June 25, 2026
Question

IPsec VPN Access Control for Different Users on the Same Tunnel and Troubleshooting Multiple Tunnels Issue

  • June 25, 2026
  • 2 replies
  • 60 views

Hi Fortinet Community,

Could you please provide some guidance on the following scenario?

I currently have a single IPsec VPN tunnel configured, and the accessible networks include Servers 1, 2, 3, 4, 5, and 6.

I have different users who need access to specific servers only:

  • UserA should be able to access Servers 1, 2, 3, and 4.
  • UserB should be able to access Servers 5 and 6 only.

Should I create separate firewall policies for each user while using the same IPsec tunnel, or should I create additional IPsec tunnels?

I have noticed that when I create another IPsec tunnel, one of the tunnels sometimes goes down. What could be the possible causes of this issue, and what troubleshooting steps should I take?

Any advice or best practices would be greatly appreciated.

Thank you!

2 replies

funkylicious
SuperUser
funkylicious
SuperUser
June 25, 2026

i personally prefer to create separate tunnels w/ different psk, peerid’s when it comes to segmenting traffic/users/roles.

you could also achieve this with a single tunnel ( no group reference in the vpn config - inherit from policy ) and then just create the firewall rules w/ having the users in separate groups, then reference the groups to the rules to where they should have access.

"jack of all trades, master of none"
Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 25, 2026

If split-tunneling, you have to separate the phase1-interfaces between groups because it has to be configured in the phase1 config with “set  ipv4-split-include [address/group_object]”. 
To separate phase1s, you can use “local ID/peer ID”, which is similar to SSL VPN’s realm.
 

Toshi

Terms & ConditionsAccessibility statement