Correct documentation of IPsec Tunnel setup form in FortiIO 6.0.4 available?

[nit_mws]

Hi, I'm a Fortinet newbie and want to set up for a DialUp VPN an IPsec Tunnel - using FortiOS 6.0.4.

I've downloaded the FortiOS Handbook for version 6.0.4. Looking into section "FortiClient dialup-client configuration" of the IPsec VPN chapter I see below "Configuring the FortiGate unit" a guide walking the reader through a user interface.

But unfortunately the FortiOS web UI shown by my FortiGate 30E is quite different from what is explained in the Handbook. Example: in step 5 the Handbook tells me I should be able to set DHCP-IPsec - but nothing similar is in my web UI. Where can I set DHCP-IP???

Is there somewhere a documentation which aligns with the web UI?

Thanks,

Michael

[ede_pfau]

That might be a limitation of the 30E. "Real firewalls start at 60E"...

I can assure you DHCP over IPsec does work on lots of Fortigates but I've never tried out a 30E.

Maybe some 30E user can comment on this.

Try to set the DHCP server in Network > Interfaces > myTunnelPhase1Name.

[nit_mws]

Hm, a highly different user interface of 30E is new to me, I assumed that FortiOS UIs are the same or at least very similar across devices, depending only on available features. (The Getting Started section of the Handbook tells: "Before you get started, note that not all FortiGate models have the same features. This is especially true of the desktop or entry-level models: FortiGate / FortiWiFi models 30 to 90. If you are using one of these FortiGate models, you may have some difficulties accessing certain features." So there should not be a big difference between 30E and 60E - and already the sections of a IPsec Tunnel definition are different in the Handbook and the web UI.)

Anyway: I've been searching the 30E UI and it allows only to set DHCP if I select Mode Config in the Network setting of an IPsec Tunnel. And for the related interface I can set the DHCP server: either the FortiGate or one in the local internal network. I hope doing that would provide the same as outlined in the Handbook.

Thanks,

Michael

[ede_pfau]

I've just tested with a dial-in tunnel on my 60E. You can specify an DHCP server on the tunnel interface (not in the VPN setup), assign a gateway IP and a matching DHCP range.

I've converted the tunnel to custom in order to get access to all details. Unfortunately I can't test the setup just now but this is the setup to use. Haven't downloaded the 6.0 handbook yet so I can't check that either, sorry.

[nit_mws]

I had a look at specifying a DHCP server on a tunnel interface: my web GUI shows an Address section as described in the Handbook but contrary to the Handbook I cannot select between manual and DHCP (and PPPoE), it is set to "manual" and this cannot be changed. Further down in the UI a section DHCP Server is included and I can activate a server and set a lot of options there - but the Addressing Mode stays as "manual" and this could mean the DHCP server setting don't become effective.

When testing a dialup VPN I get an error in IPsec phase 2 (without further details) and this undefined addressing of the remote client may be the reason.

Michael

[ede_pfau]

Michael, you're confusing the interface address - which might be assigned via DHCP - and the DHCP server on that interface.

On IPsec VPN interfaces you usually don't assign an address (so called "unnumbered" interface). So just leave the 'address' field at 0.0.0.0/0.

Then create an DHCP server in the section below. It will work as DHCP-over-IPsec and serve the dial-up clients.

If this sounds too complicated, just use static addressing for your clients (put a fixed address into the FortiClient config).

A good advice at last: get the Handbook and work through the chapter on IPsec VPN. FTNT has layed out every option quite clearly IMHO. I think your expectations are different from what you have in FortiOS and that leads to a lot of confusion.