Skip to main content
todfra
todfra
Explorer
December 3, 2021
Question

Reusing PHASE1 for multiple dynnamic IP dialups on FortiOS 7.0.2

  • December 3, 2021
  • 1 reply
  • 1980 views

With FortiOS 7.0.2, is it possible to have more than one dialup client to the same PHASE1?

it seems that when the remote dialup IPSec peer has a dynamic IP one has to set a dyndns gw in the PHASE1 config setting in order to use static routes.

In previous version (6.0.12,) when you created a Static Route to PHASE1 just by picking the destination and the interface PHASE1 but without typing an explicit gatway (0.0.0.0), FortiOS was correctly routing traffic through the proper tun_id associated with the dialup user for PHASE2-A and PHASE2-B (which are different public dynamic IP). Can't we no longer reuse the same PHASE1 for two dyndns with dynamic IP in version 7.0.2?

Version 7.0.2 is not capable of sending traffic through the proper tun_id with the very same route setting that was working before.

I tried to follow this guide => https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/790613/phase-1-configuration but the issue is still there.
Thank you for your help.

Have a nice day!

1 reply

Kangming
Staff
Kangming
Staff
January 6, 2022

It’s should be no problem. Choose dial-up VPN on the HUB side. Spoke config the accurate network Interested VPN traffic in phase2, this will automatically generate a static route on the HUB side, and there is no need to manually config in the static route on the HUB.

    Terms & ConditionsAccessibility statement