DHCP over ipsec not working

[#1]

Hello. I' m a newbie on fortigate (used to ZyWall). I have a Fortigate 80C (os 4 build 5025), connected to the DMZ of my ZyWall. The Zywall routes all incoming vpn calls to the Fortigate. The wan1 interface has ip 10.27.2.3/255.255.255.0 The internal interface has ip 10.27.1.3/255.255.255.0 I created a dhcp server on wan1 interface. config system dhcp server edit " company_dhcp_clients" set dns-server1 10.27.1.50 set domain " company.se" set interface " wan1" set netmask 255.255.255.0 set server-type ipsec set end-ip 10.27.3.50 set ipsec-lease-hold 0 set start-ip 10.27.3.2 next end I created 3 addresses in the firewall edit " Internal net" set associated-interface " internal" set subnet 10.27.1.0 255.255.255.0 next edit " wan1" set associated-interface " wan1" set subnet 10.27.2.3 255.255.255.255 next edit " company_remote_pc_dhcp_range" set associated-interface " wan1" set subnet 10.27.3.0 255.255.255.0 next I authenticate the users through a radius server config user radius edit " jabba" set secret ENC <some funny password> set server " 10.27.1.53" next end that server is then a member of a group config user group edit " FSAE_Guest_Users" set group-type directory-service next edit " iVpn" set member " jabba" next end ipsec P1. config vpn ipsec phase1 edit " company_employee" set type dynamic set interface " wan1" set dpd disable set proposal des-md5 set xauthtype pap set mode aggressive set psksecret ENC <another funny password> set authusrgrp " iVpn" next end ipsec P2. config vpn ipsec phase2 edit " company_remote_pc" set phase1name " company_employee" set proposal des-md5 set dhcp-ipsec enable next end I made 2 policies. One to handle dhcp requests (id 2) and one to handle the traffic (id 3). config firewall policy edit 3 set srcintf " internal" set dstintf " wan1" set srcaddr " Internal net" set dstaddr " iNovacia_remote_pc_dhcp_range" set action ipsec set schedule " always" set service " ANY" set inbound enable set outbound enable set natinbound enable set vpntunnel " iNovacia_employee" next edit 2 set srcintf " wan1" set dstintf " wan1" set srcaddr " wan1" set dstaddr " all" set action ipsec set schedule " always" set service " DHCP" set inbound enable set outbound enable set vpntunnel " iNovacia_employee" next end Default router for internal network is the Zywall, there is a static route for 10.27.3.0/255.255.255.0 -> 10.27.1.3 Now to the problems. 1: To be able to have the vpn tunnel not going down, I cannot use DPD. Anyone knows why ? 2: And this is the biggest problem. On the FortiClient (4.0.2.57), if I specify " Acquire virtual IP address" and in the config I hardcode one address from the subnet I created in the dhcp (10.27.3.0) the tunnel comes up and everything works. But if I configure " DHCP over IPSec" , the client comes up, get one address from the dhcp server and then closes the tunnel. Can anyone shed some light on what I am missing for the DHCP over IPSec to work ? Thanks, Micke

[ede_pfau]

192.168.3

just to clarify...I meant the 10.27.3.x net (" the .3 net" in my last post).

[#3]

why do you assign from the .3 net on an interface in the .2 net? I just cannot see any good reason to do so.

I wanted to be able to have multiple dial-up clients using different VIP pools so I could then easily configure policies to allow different access to different servers and ports on my internal network. I' ll test your suggestions next week and come back with the result. Thanks for the advice.

[ede_pfau]

the way to do that is to define different phase 1' s and to select via the PSK. Users with different priviledges will have different tunnels. If you use interface VPN this will be very easy and self-documenting. Ede

[#5]

True, but using VIP' s gives you easier control if ip address conflicts should happen.