We have a first VPN that is working perfectly. I need to create a second VPN on our 100D for another group of users requesting access to a different subnet. My understanding tells me this second VPN should be listening to a different IP or port than our first VPN. If I am right, then how can I create a second VPN listening to either a secondary IP on wan1 or another port?
For the port, I think I would have to change the port on the IP Pools linked to the VPN but on the 100D is seems impossible to have a second IP Pool. And I can't find how to configure a VPN to a second IP of wan1. We do not use VDOMs in case this could change something.
I assume that you are talking about vpn from end users using Forticlient.
There are two ways to achieve it:
a) In the current vpn phase 1 set the option accept this peer id (enter something like group1)
b) Create second vpn and similarly set the phase1 option accept this peer id ( like group2)
Now in Forticlient for user in group 1 set the local id as (group 1) and similary for group 2 user set it as (group2)
You will have to use our vpn editor tool (avialbel in our support download site under forticlient tools)
This way the Fortigate can distinguish between vpn client connections based on the id sent by them and you can accrodingly set the access/pools.
If you really want to use a second ip (or if you can't change the local id in clients) then you have to enter one of the available ip in phase1 under Local Gateway IP (selcet the specify radio button) and enter the public ip which you want to use for second vpn)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.