FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mribbans_FTNT
Article
This article describes how to use Peer IDs to select an IPSec dialup tunnel on a FortiGate unit configured with multiple dialup tunnels.

Dialup VPN tunnels are used when the remote VPN gateway or remote VPN client IP address is dynamic and therefore unknown.

Many customers use a single dialup tunnel (Phase 1 and Phase 2) for all remote dialup VPN gateways and clients.
In some cases, multiple dialup tunnels are required.

For example:
To grant different remote VPN client users access to different networks and services
To grant remote VPN gateways access to different networks and services

FortiGate units use Peer IDs as the unique identifier to select a dialup tunnel. When multiple dialup tunnels are added, give each tunnel a different Peer ID.
Assign corresponding Peer IDs to remote VPN gateways and remote VPN clients.

Aggressive mode configuration:


Second dialup tunnel:


FortiClient Configuration:


Debug verification for each tunnel:

Using below commands enables IKE debug logs:
#diag debug reset
#diag debug application ike -1
#diag debug enable

tau-kvm68 # ike 0: comes 10.5.22.160:1011->10.5.22.168:500,ifindex=3....
ike 0: IKEv1 exchange=Aggressive id=df23d7be2de17010/0000000000000000 len=511ike 0:df23d7be2de17010/0000000000000000:0: responder: aggressive mode get 1st message...
......
ike 0::0: received peer identifier FQDN 'dialup1'
From FortiGate IPSec Monitor tab:


For the second peer id (dialup2):
tau-kvm68 # ike 0: comes 10.5.22.160:1011->10.5.22.168:500,ifindex=3....
ike 0: IKEv1 exchange=Aggressive id=d74d09b92f8f1cbd/0000000000000000 len=511
......
ike 0::1: received peer identifier FQDN 'dialup2'



Contributors