Technical Tip: How to use local-ID type IP address other than the IP addresses configured in the interface for IPsec VPN

[lestopace]

Description	This article describes how to use local-ID type IP addresses other than the IP addresses configured in the interface for IPsec VPN.
Scope	FortiGate 7.0 and above.
Solution	Starting FortiGate 7.0, it is possible now to set the local ID IP address that is not configured in the interface selected. Local ID can be used in aggressive mode.  It may have up to 63 characters that are used in regular expressions. Local ID is an extra piece of data delivered during phase 1 of negotiation; the remote side may be set up to check for a particular ID to permit connection. From CLI: config vpn ipsec phase1     edit <phase1_name>          set localid-type address          set localid <IP address> end It mentions an IP address instead of reference x.x.x.x.  Common application of this solution will be with FortiGate-to-3rd party vendor IPsec tunnels. One possible indication that it is necessary to configure the Local ID in FortiGate under phase1-interface settings is when the IPsec phase-1 remains down with an error in the IKE debug, stating 'received notify type AUTHENTICATION_FAILED.' Related articles: FortiGate sends 'local id' in FQDN type when negotiating an IPsec tunnel with Cisco Use of PeerID and LocalID in IPsec VPN between two FortiGates