Can't create VPN Policy-Based Mode in FortiOS 5.4

[ellebibr1]

I have a new FG 200D with v5.4.0,build1011.

I need to create a Policy-Based Mode VPN to create to an old site.

My problem is I can't find the option in the phase 1 IPsec to specify the type of VPN although I turned od the Feature "Policy-based IPsec VPN".

Other problem is that if I use the "Create" button on VPN > IPsec Tunnel it always open the VPN creation wizard.

And if try to change the VPN created by the wizard I can't see any option to change the VPN mode.

Could you help me or give me some doc link.

Thanks in advance

[mac]

Please into "Feture Select" enable Policy-base IPsec vpn

[ellebibr1]

Thank you very much Mac!

I have already set the Policy-base IPsec vpn feature (now it is on) but when I use the wizard to create the VPN I have no option to define the Policy Mode.

Could you send me a snapshot to show me where is the option (flag or menu) to set the mode.

Thank you again

[ellebibr1]

Solved:

I have the VPN Policy-Based Mode option if I create the new policy and at the beginning of the wizard I choose custom.

[fortinetuser2020]

hi

i need the same solution

how did you find the policy based option? can you snapshot the location? thank you

[ede_pfau]

This needs to be done in the exact sequence:

1. enable the "Policy-based VPN" feature (System > Feature Select)

2. start the VPN wizard, choose "Custom"

in the top rows, there is an option "Interface Based", already checked. Uncheck it.

In the CLI you will find the phase1 in "config vpn ipsec phase1" instead of "config vpn ipsec phase1-interface".

[fortinetuser2020]

thank you

i see that

but how do i setup a rule for it to control what's allowed and so on

[ede_pfau]

You just create a policy, with action = "IPSEC" instead of "ACCEPT". Source and destination address objects define the phase2 Quick Mode selectors. You can probably check "allow inbound" and "allow outbound" in the policy as well.

Heck, who's using policy-mode VPN anymore? There are very very rare cases like VPN in Transparent mode which justify it. The remote VPN gateway should never have anything to do with it.

[Alby23]

You have to enable "Policy Based VPN" in the "Feature Select" part of the System Configuration.