Skip to main content
Antoine
Antoine
New Member
November 2, 2020
Question

Sharing site-2-site with dialup server on same interface?

  • November 2, 2020
  • 2 replies
  • 3662 views

I am very short on public IPs, and I would like to have my Fortigate to service IPsec clients (using a variety of clients) while at the same time using the same public IPv4 to keep running the site-2-site tunnel with a remote branch office (with a 2nd Fortigate there).

Is it even possible, or am I asking too much? 

    2 replies

    emnoc
    emnoc
    New Member
    November 2, 2020

    No that is doable. You can bound multuiple ipsec tunnels to the same wan interface and address. You might have to use peerid to distinguish peers for s2s tunnels.

     

    e.g

    fqdn

    string

    email

    certificate DN

     

     

    Ken Felix

    Antoine
    AntoineAuthor
    New Member
    November 3, 2020

    Thanks for your answer.

    I understand the idea of using peerid to multiplex an IPsec service; although I am under the impression it restricts to IKE v1 and aggressive mode (please, please correct me where I am wrong).

     

    However, I would like to confirm you can mix on the same interface, s2s tunnels (using "set type static" in phase1-interface) with dialup answering services ("set type dynamic"); your post seems to mean the former can be multiplexed, but I am interested to use the latter as well.

    sw2090
    SuperUser
    sw2090
    SuperUser
    November 3, 2020

    I have dial up ipsec tunnels (mostly ike1, aggressive mode, split tunneling) and also s2s tunnels on the same interface without any problems.

    Like emnoc wrote you might have to use peerids or unique pairs of proposals to have the FGT assign the correct tunnels. It won't mix up dial up and s2s anyways because s2s does not support dial up so you cannot want to dial into a s2s ;)

    emnoc
    emnoc
    New Member
    November 3, 2020

    No Aggression mode does not need peerid (aka  groups ) but yes you can mix and match static and dialup to the same interface. So you do not have any worries in that area. You can also run IKEv1 v2 versions on the same interfaces.

     

    Your only limit on how many tunnels on one interface is outline in the fortios max values . Outside of that, your good to go.

     

    You can reference max value via your fortios version

     

    https://docs.fortinet.com/document/fortigate/6.2.0/fortios-maximum-values-table

     

    Ken Felix

     

    Terms & ConditionsAccessibility statement