Dialup IPSEC Add second interface

[AndreasMaier]

Hi everybody,

here´s my setup:

Internal LAN and DMZ Ports are used on the unit and there is a policy based dialup ipsec set up for remote users to access Internal LAN

The Question is if I can add access to DMZ to the existing dialup IPSEC VPN and how?

Thanks

[ede_pfau]

Hi,

you would need another policy with action IPSEC, from WAN to DMZ. But...

These policy based VPNs not only allow encryption but do the routing, traffic direction and Quick Mode selectors all at once. There is a reason why Fortinet has dropped this concept years ago.

I'd think now is a good time to recreate the existing VPN to route-based/interface-based, and add just a simple policy from VPN to DMZ to achieve your goal. The first time you have to debug a policy-based VPN will be an eye-opener for you.