Dialup IPsec on Fortigate vs SCADA / M2M / Industrial Control / cellular clients

[journeyman]

Hi All,

Looking for wisdom, tips or links (in this forum, tech tips, KB articles, or more general as appropriate).

Please forgive my lack of knowledge on this topic.I do know other things.

We use Fortigate firewalls heavily in our field network with quite a few site to site IPsec tunnels, typically used to encrypt the link and/or tunnel OSPF.

We also have many field devices connected via a cellular network with a private APN. In the olden days the mobile endpoint could only port forward onto the local LAN. For convenience every local LAN is the same subnet. There is typically only a single device on the LAN, but some sites have a small number of devices which each get their relevant port forward (industrial protocols and ports).

We have upgraded the mobile endpoint hardware and now have dramatically expanded and improved functionality, including IPsec, much improved ACLs, OSPF etc etc. This toy can do nearly anything it seems.
We already have a working site-to-site IPsec configuration we can use between the new mobile hardware and our Fortigates where needed.

I am investigating a scalable IPsec deployment using Fortigate as the head end and the mobile hardware as the client with a view to encrypting all our traffic in flight. I have not yet set up a lab.
Due to the number of endpoints and scalability (laziness) I believe dialup IPsec is the way to go.

As I understand, the cellular device can be the client (and not FortiClient running eg on a PC). 

My understanding is that once we create the dialin IPsec interface we create policies as required*, and then as devices connect they get an "instance" of the tunnel interface.

*I have also seen in a tech tip or KB that we can set up multiple tunnels each with differing policies on the same Fortigate and differentiate which clients connect using peer-id, this will likely be useful.
My understanding is that a dialup tunnel assigns a single IP to each client as it connects. The examples I have seen appear to assign this IP address from a pool first come first served (more on that below). Hence in a simple configuration only a single remote device is supported, but this configuration could support our existing multiple devices using port forwarding similar to current, via configuration at the remote device. Is this correct?
I assume the remote (local) LAN subnet is irrelevant to the tunnel, is this correct? Specifically, our re-use of a common remote subnet is no problem.
On the basis that each client is assigned a single IP address, it is absolutely critical that this is a fixed IP address that we can control and that never changes. Can this be done in a scalable way and if so, how? Can it be driven from the client end?
For future use, is it possible to run OSPF over a dialup tunnel? Or is this possible but impractical or not really scalable?

What is the difference between site-to-site and dialup IPsec, particularly on the client side, where the client is a network device and not FortiClient. For instance if I used a Fortigate as a remote client (as a proof of concept, for example), what would that look like? I think I have a handle on the gateway / head end side.

Are there other barriers to implementing a scalable, industrial device friendly IPsec solution? What is recommended?

All comments and clarifications are most welcome.
I have done some research but not really found what I'm looking for. Any links to references are also welcome.

Thanks in advance

edit: added cellular ref to thread subject

[AEK]

Hi JourneyMan

Regarding IP reservation for IPsec clients, you need DHCP over IPsec.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DHCP-IP-address-reservation-with-Dial-up-I...

Regarding OSPF over Dial-up IPsec, yes it is possible.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-OSPF-over-dial-up-IPsec-VPN/ta-p/203973

Regarding FortiGate as dial-up client, I had some experience with it and I found that the result was the same as with site to site VPN.

Hope it helps.

[journeyman]

Hi AEK,

Thank you for your reply.

What are the options to manage DHCP reservations at scale? In our case we have several thousand reservations required. I am interested to find out if the endpoint presents a MAC, being a cellular connected device; we'll find out I guess.

Thanks for the OSPF link, will digest. One query, the example assigns IP addresses to the tunnel, is this scaleable with multiple dialup clients?

And great to know your experience with FGT as a client, this is very good to know, it gives me confidence how to proceed.

Many thanks,

journeyman

[AEK]

Hi

For thousands of clients I guess external DHCP server is better, in which you can reserve the IP addresses in an easier way. In this case you should configure the interface DHCP as relay, not as server.

As far as I know all cellular devices that can connect IPsec have MAC address.

For large scale OSPF over dial-up IPsec I prefer to let more experienced members to give their advice.

[onyxelias95]

Dial up IPsec lets many devices securely connect to one Fortigate with fixed IPs. It works well for industrial and cellular setups. You can set rules per device. Routing like OSPF is possible but harder. It’s a flexible and safe solution.