Address groups and quick mode selectors

[TimothyG]

Fortigate 100D running v5.0,build0271 (GA Patch 6). I' ve created IPSec tunnels for three internal addresses that need to be able to reach 15 addresses (not a range) on the remote side. I initially did this by creating address objects, putting those objects into an address group, and using those groups in my P2 quick mode selectors. After the configuration, the tunnel came up and traffic initially appeared to be passing. After further testing it was found that the internal addresses could reach some of the remote addresses, but not all. Researching the issue, I found the following text in the IPSec guide ( http://docs.fortinet.com/uploaded/files/1086/fortigate-ipsec.pdf in the ' quick mode selectors' section): " While the drop down menus for specifying an address also show address groups, the use of address groups is not supported. To made it easy to determine if one of the choices in the drop down menu is an address or an address group the two types of objects have been broken into sections with the address groups at the bottom of the list." This seems a bit crazy to me. This means I have to create 45 Phase 2s in order to get this tunnel functioning (3 internal IPs X 15 Remote IPs)? Am I overlooking something? Thanks for any suggestions!

[rwpatterson]

Although laborious to start, it' s far easier to manage in the future. I had to do the same: 5 networks on my side and 7 on the remote... Once done, it' s all good. I was able to supernet a couple.

[TimothyG]

Thanks for the reply. From where I' m sitting the address groups would be much easier since I' m dealing with individual addresses and not entire subnets. Kind of frustrating that the option is even there if it doesn' t work properly.