Multiple IPSec tunnels on single interface

7 replies
32758 views

Hello,

We currently use a single VPN to get into our office, this VPN is using a software switch as the interface.

However, I need to create another VPN for a separate purpose (because I need to provide another subnet range to these special VPN clients). I have tried creating another VPN and I have added the same software switch as the interface, but I am unable to connect to this VPN.

This software interface has 1 main gateway IP and 4 secondary external IP addresses.

How can I implement this second VPN?

Thanks

IPsec

sw2090Answer

SuperUser

you need to make your tunnels identifyabl. If they are not the FGt uses the first tunnel that matches proposals and that may be the wrong one. If they have the same remote gw on one side you need to set peer-ids to make them unique.

engAuthor

New Member

Nevermind - I found the solution here: https://kb.fortinet.com/kb/documentLink.do?externalID=FD38084

Cheers!

sw2090Answer

SuperUser

you need to make your tunnels identifyabl. If they are not the FGt uses the first tunnel that matches proposals and that may be the wrong one. If they have the same remote gw on one side you need to set peer-ids to make them unique.

engAuthor

New Member

sw2090 wrote:
you need to make your tunnels identifyabl. If they are not the FGt uses the first tunnel that matches proposals and that may be the wrong one. If they have the same remote gw on one side you need to set peer-ids to make them unique.

Hey,

Thanks for the response. I got this working when using Forticlient, but I need to connect using Strongswan - how do I specify this Local ID in my /etc/ipsec.conf ?

Cheers

engAuthor

New Member

ahh got it:

leftid = %<MY_ID>

Sign up

Login with SSO

Login to the community

Login with SSO