Technical Tip: How to use local-ID type IP address other than the IP addresses configured in the interface for IPsec VPN

[lestopace]

Description	This article describes how to use local-ID type IP addresses other than the IP addresses configured in the interface for IPsec VPN.
Scope	FortiGate v7.0 and above.
Solution	Starting FortiGate v7.0, it is now possible to set the local ID IP address that is not configured in the selected interface. Local ID can be used in aggressive mode.  It may have up to 63 characters that are used in regular expressions. Local ID is an extra piece of data delivered during phase 1 of negotiation; the remote side may be set up to check for a particular ID to permit connection. From CLI: config vpn ipsec phase1-interface     edit <phase1_name>          set localid-type address          set localid <IP address> end Note: The 'localid-type' is only configurable via CLI. This option is not available in the GUI. It mentions an IP address instead of the reference x.x.x.x.  This solution is commonly used with FortiGate-to-3rd-party vendor IPsec tunnels. One possible indication that it is necessary to configure the Local ID in FortiGate under phase1-interface settings is when the IPsec phase-1 remains down with an error in the IKE debug stating 'received notify type AUTHENTICATION_FAILED.'. Related articles: Troubleshooting Tip: FortiGate sends 'local id' in FQDN type when negotiating an IPsec tunnel with C... Technical Tip: Use of PeerID and LocalID in IPsec VPN between two FortiGates Troubleshooting Tip: IPsec VPN with Sophos is not working