Static IP for IPSec vpn remote clients

Yes, it is possible to assign fixed IP addresses from a predefined pool to users connecting via an IPsec IKEv2 tunnel on a FortiGate. The configuration involves using mode-config to define the pool and user attributes to bind specific IP addresses to users.

Here’s how you can configure it:

Step 1: Define the IP Pool
Create a pool of IP addresses that can be assigned to users.

config vpn ipsec phase1-interface
edit "<your_phase1_name>"
set ipv4-start-ip 10.10.100.10
set ipv4-end-ip 10.10.100.50
set mode-cfg enable
set assign-ip enable
next
end

Step 2: Create Users and Bind Fixed IPs
You can assign a specific IP address to each user by using the user local configuration and associating the IP address with a user attribute.

Create or edit local users and assign them IPs:
config user local
edit "user1"
set type password
set passwd <password>
set user-attr "user-ip=10.10.100.10"
next
edit "user2"
set type password
set passwd <password>
set user-attr "user-ip=10.10.100.11"
next
end
Ensure the IPs assigned to users are within the range defined in the IP pool.

Step 3: Configure the IPsec Phase 1 Interface
Enable mode-config and authentication for your phase 1 interface:
config vpn ipsec phase1-interface
edit "<your_phase1_name>"
set mode-cfg enable
set assign-ip enable
set authmethod signature
set usergroup "<your_user_group>"
next
end

Step 4: Bind Users to User Groups
Group the users into a user group for the VPN:
config user group
edit "<your_user_group>"
set member "user1" "user2"
next
end

Step 5: Verify the Configuration
Test the VPN connection with each user to confirm they are assigned the correct fixed IP from the pool.
Use the following command to monitor connected users and their assigned IPs:

diagnose vpn ike gateway list
diagnose vpn ipsec tunnel list

If you continue to face issues with mode-config, ensure the client configuration supports receiving an IP address via mode-config (FortiClient should work).