|
To configure the IPSec dial-up tunnel the following KB articles can be followed:
Technical Tip: IPsec dial-up full tunnel with FortiClient
Technical Tip: How to configure a FortiGate as IPsec VPN Dial-Up client when FortiGate is not behind...
Once configured, it can be checked if the VPN server is assigning the correct client address through the remote access tunnel by the IKE debug
From the debug field the following sample reports will appear for IPv4/IPv6 address and DNS assignment for the remote VPN client according to the client address configuration.
IPv4:
2025-02-27 14:29:44.434149 ike 0:VPN_1:2731: processed INITIAL-CONTACT
2025-02-27 14:29:44.434167 ike 0:VPN_1:2731: mode-cfg assigned (1) IPv4 address 10.144.113.10
2025-02-27 14:29:44.434169 ike 0:VPN_1:2731: mode-cfg assigned (2) IPv4 netmask 255.255.255.255
2025-02-27 14:29:44.434173 ike 0:VPN_1:2731: mode-cfg send (13) 0:10.0.50.6/255.255.255.255:0
2025-02-27 14:29:44.434175 ike 0:VPN_1:2731: mode-cfg send (13) 0:217.173.195.70/255.255.255.255:0
2025-02-27 14:29:44.434177 ike 0:VPN_1:2731: mode-cfg send (13) 0:10.0.50.101/255.255.255.255:0
2025-02-27 14:29:44.434179 ike 0:VPN_1:2731: mode-cfg send (13) 0:10.0.50.102/255.255.255.255:0
2025-02-27 14:29:44.434183 ike 0:VPN_1:2731: mode-cfg send (3) IPv4 DNS(1) 10.0.66.131
2025-02-27 14:29:44.434184 ike 0:VPN_1:2731: mode-cfg send (3) IPv4 DNS(2) 10.0.66.132
IPv6:
2025-02-27 14:29:44.434186 ike 0:VPN_1:2731: mode-cfg assigned (8) IPv6 address
2a03:9330:1:9113::10/128
2025-02-27 14:29:44.434190 ike 0:VPN_1:2731: mode-cfg send INTERNAL_IP6_SUBNET 0:2a03:9330:1:20::70/128:0
2025-02-27 14:29:44.434192 ike 0:VPN_1:2731: mode-cfg send INTERNAL_IP6_SUBNET 0:2a03:9330:1:50::6/128:0
2025-02-27 14:29:44.434194 ike 0:VPN_1:2731: mode-cfg send INTERNAL_IP6_SUBNET 0:2a03:9330:1:50::101/128:0
2025-02-27 14:29:44.434196 ike 0:VPN_1:2731: mode-cfg send INTERNAL_IP6_SUBNET 0:2a03:9330:1:50::102/128:0
2025-02-27 14:29:44.434198 ike 0:VPN_1:2731: mode-cfg send (10) IPv6 DNS(1) 2a03:9330:1:50::121
2025-02-27 14:29:44.434200 ike 0:VPN_1:2731: mode-cfg send (10) IPv6 DNS(2) 2a03:9330:1:50::122
If the tunnel is being configured for the FortiClient and the client does not receive the IPv6, it is requested to follow the below article: Technical Tip: Not receiving an IPv6 address from Dialup IPsec tunnel on FortiClient
Another option to have the user and the IP address assigned to the tunnel is:
get vpn ike gateway | grep "eap-user\|assigned"
|
