Skip to main content
jomfra
jomfra
New Member
October 20, 2022
Solved

where to input the remote identier in FortiGate.

  • October 20, 2022
  • 2 replies
  • 5264 views

Hello Expert,

 

I have configure  a "vpn"  tunnel between FortiGate 80F a Palto Alto device.

The wan interface of the Palto Alto device is using private ip address for the wan interface because the another device on the network is use for full internet access

 

The public ip address is 81.135.253.181

        private ip addess 192.168.190.2           (remote identier)

 

 I do not know where in fortigate I must input this ip address

 

Best answer by pminarik

Assuming you're setting it up as a site-to-site tunnel (type=static; not a dialup/dynamic hub), and are using PSK authentication (based on the screenshots you posted).

 

1, If you want to set which ID the FortiGate should accept:

This is not configurable. With PSK authentication and site-to-site tunnel, the FortiGate does not check the other side's ID. Anything is accepted. You merely need to ensure that the remote-gw IP is the actual public IP from which the other side's packets will come.

 

2, If you want ot set which ID the FortiGate should send to the other side:

config vpn ipsec phase1-interface
    edit "<your-tunnel-name>"
        set localid-type address #IP address format; or any other as desired
        set localid <IP address>
end

 

 

2 replies

FortiMax_it
FortiMax_it
Explorer III
October 21, 2022

Hi, here:

FortiMax_it_0-1666336786857.png


For more details edit the VPN via CLI: config vpn ipsec phase1-interface

jomfra
jomfraAuthor
New Member
October 23, 2022

Hello Expert,

 

Sorry for the tardy response but I am vacation hence will test your proposal when I return.

Will revert with an update later

 

Regards

pminarik
Staff
pminarikAnswer
Staff
November 7, 2022

Assuming you're setting it up as a site-to-site tunnel (type=static; not a dialup/dynamic hub), and are using PSK authentication (based on the screenshots you posted).

 

1, If you want to set which ID the FortiGate should accept:

This is not configurable. With PSK authentication and site-to-site tunnel, the FortiGate does not check the other side's ID. Anything is accepted. You merely need to ensure that the remote-gw IP is the actual public IP from which the other side's packets will come.

 

2, If you want ot set which ID the FortiGate should send to the other side:

config vpn ipsec phase1-interface
    edit "<your-tunnel-name>"
        set localid-type address #IP address format; or any other as desired
        set localid <IP address>
end

 

 

jomfra
jomfraAuthor
New Member
November 8, 2022

Hello Pminarik,

 

Thanks for the clarification.

 

Regards

Terms & ConditionsAccessibility statement