Skip to main content
FransUrbo
FransUrbo
New Member
March 7, 2018
Question

IPSEC VPN route publishing

  • March 7, 2018
  • 2 replies
  • 16250 views

I have a FG50 (FortiOS v5.4) as my home firewall/gateway/nat as well as IPSEC VPN endpoint to get access to my home network.

 

The VPN works fine and all, but on the client (macOS Sierra), I don't get a route "in" to the VPN. I always have to add that manually.

 

And when I've done that, I have to use IPs to access my resources as home instead of using the DNS zone I've setup in FG.

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    March 7, 2018

    I might be mistaken since I don't use much IPsec VPN with FortiClient. But I think you need to use SSL VPN with the same FortiClient get the routes automatically inserted into Mac's routing table. You obviously have to config SSL VPN server on your FG50E but shouldn't be too difficult (I'm doing it at home) since only one user you need to set up. There must be some cookbooks you can follow.

    Let's wait if someone says I'm wrong and there is a way to do it with IPSec. 

    FransUrbo
    FransUrboAuthor
    New Member
    March 7, 2018

    I'm not using FortiClient, but the built-in VPN client in my systems.

     

    I've replaced a home made Linux box for this which used Strongswan and there that could publish both the route and the DNS. So it would be strange if FortiOS couldn't do it...

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    March 7, 2018

    Hi all,

    Since you got access to your home network via IPSEC vpn from your mobile device, I assume your IPSEC is dynamic/dial up. Please verify this before next step.

     

    If so, please enable "add route" option so that FGT would push a route to your mobile device.

     

    As for SSL VPN, at tunnel mode, FGT would push a route to mobile device via PPP/IPCP protocol.

     

     http://help.fortinet.com/...Psec_Route_Control.htm

     

    FransUrbo
    FransUrboAuthor
    New Member
    March 7, 2018

    Yes, a remote/dialup IPSEC VPN setup. Where is that "add route" option you want me to enable?

     

    This is the config (I'm guessing that "add route" is somewhere else, I only configure it from the GUI at the moment):

     

    config vpn ipsec phase1
    end
     
    config vpn ipsec phase1-interface
        edit "L2TP IPSEC"
            set type dynamic
            set interface "wan1"
            set peertype any
            set mode-cfg enable
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set dpd on-idle
            set comments "VPN: L2TP IPSEC (Created by VPN wizard)"
            set dhgrp 2
            set ipv4-start-ip 192.168.6.1
            set ipv4-end-ip 192.168.6.254
            set dns-mode auto
            set ipv4-split-include "local_network_lan"
            set unity-support disable
            set psksecret ENC <SECRET>
       next
    end
     
    config vpn ipsec phase2
    end
     
    config vpn ipsec phase2-interface
        edit "L2TP IPSEC"
            set phase1name "L2TP IPSEC"
            set proposal aes256-md5 3des-sha1 aes192-sha1
            set pfs disable
            set encapsulation transport-mode
            set l2tp enable
            set comments "VPN: L2TP IPSEC (Created by VPN wizard)"
            set keylifeseconds 3600
        next
        edit "cluster"
            set phase1name "L2TP IPSEC"
            set src-subnet 10.0.0.0 255.255.0.0
        next
        edit "lan"
            set phase1name "L2TP IPSEC"
            set src-subnet 192.168.69.0 255.255.255.0
        next
    end

     

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    March 7, 2018

    Hi there, it's in the

    config vpn ipsec phase1-interface edit "L2TP IPSEC"

    set add-route enable

    end

     

    and do the same thing in the phase2-interface.

    Terms & ConditionsAccessibility statement