VPN tunnel and interface mode

Forum|Forum|9 years ago
April 24, 2017
1 reply
25645 views

Hi everybody,

The VPN section is divided in to two groups: tunnel mode and interface mode.

Which is the difference between to the two?

Thank you.

Best answer by rwpatterson

From a remote end, there will be no difference in how the IPSec tunnel is presented. From the Fortigate end, there is a world of difference. Early in the Fortigate firmware releases, the tunnel mode was the default. It was easy to set up and the routing was handled behind the scenes by the Fortigate itself. There was a major limitation though: you could only route traffic to the subnet directly behind the remote unit. If there was a subnet outside of the remote unit's direct access, it would be unreachable.

With interface mode IPSec tunnels, the definition is a physical interface that can be treated like any local Fortigate interface. You can now create a static route to that interface for networks beyond the remote device's reach. Using NAT on an interface based IPSec tunnel is more straightforward as well. This is now the default configuration when creating tunnels. The older route based (type=ENCRYPT in the policies) is now considered legacy and is more or less not being used. It does still work and can be used, but I would suggest against it, mostly for debug purposes.

rwpattersonAnswer

New Member

From a remote end, there will be no difference in how the IPSec tunnel is presented. From the Fortigate end, there is a world of difference. Early in the Fortigate firmware releases, the tunnel mode was the default. It was easy to set up and the routing was handled behind the scenes by the Fortigate itself. There was a major limitation though: you could only route traffic to the subnet directly behind the remote unit. If there was a subnet outside of the remote unit's direct access, it would be unreachable.

With interface mode IPSec tunnels, the definition is a physical interface that can be treated like any local Fortigate interface. You can now create a static route to that interface for networks beyond the remote device's reach. Using NAT on an interface based IPSec tunnel is more straightforward as well. This is now the default configuration when creating tunnels. The older route based (type=ENCRYPT in the policies) is now considered legacy and is more or less not being used. It does still work and can be used, but I would suggest against it, mostly for debug purposes.