Dialup VPN with multiple fortigates

[Unknown-User]

Hi everyone,

I am attempting to set up a seemingly simple configuration, but I'm facing some challenges. Here's what I have so far:

I have a headquarters (HQ) Fortigate 60F with software version 7.2.4. I've set up an IPsec tunnel as a Dialup User using IKEv1 and Main mode. I've configured multiple proposals, and the Phase 2 selectors are set to local 0/0 and remote 0/0.

The branch locations are both behind NAT and those devices or connections are not under our management so we can not do any port forwarding etc. Thats why I opted for a dial-up VPN. Or are there better solutions?

Next, I set up another site, which we'll call Branch A. The IPsec tunnel is configured as a Static connection using the external IP of the Dialup User. Once again, I used IKEv1 and Main mode, and set up multiple proposals. The Phase 2 selectors are also set to local 0/0 and remote 0/0.

This setup works as intended after I add a static route on the HQ device for the /16 subnet of Branch A pointing to the Dialup tunnel.

Now I need to set up Branch B, which has the same configuration but different IP addresses and a separate connection. The tunnel comes up, and I can see two Dialup connections on the HQ device. However, there is no traffic flowing to Branch B at all. When I debug the connection, I can see the traffic going to the Dialup VPN (from HQ to Branch) just like in Branch A, but it never arrives at Branch B.

I have searched extensively for a solution and it seems that I need to use peer IDs. However, I am unable to specify peer IDs with Main mode.

I am looking for a clear example on how to configure this correctly. The administration guide hasn't been helpful, and I don't want to use VPN users to log in. I am willing to rebuild the configuration if necessary, but it shouldn't be this difficult to achieve such a simple setup, right?

I am considering the following configuration:

HQ:
- Enable Dialup user and device creation
- Use IKE version 2 (can I still use peer IDs?)
- Keep it simple with one set of proposals
- Set key lifetime to 3600s
- No local ID, since this is HQ
- Phase 2 selectors set to 0/0 and 0/0
- Enable replay detection
- Enable Perfect Forward Secrecy (PFS)
- Enable Auto keep Alive
- Set key lifetime to 3600s

Branch A and B:
- Use IKE version 2 (can I still use peer IDs?)
- Keep it simple with one set of proposals
- Set key lifetime to 3600s
- Set local ID to "Branch_1" for Branch A and "Branch_2" for Branch B
- Phase 2 selectors set to 0/0 and 0/0
- Enable replay detection
- Enable PFS
- Enable Auto keep Alive
- Set key lifetime to 3600s

Will this configuration work? How does the HQ firewall know where to send the traffic? Or should I also specify the Phase 2 selectors on the branches, such as Local: 10.x.x.x/16 and remote 0/0?

I hope someone can shed some light on what I might be doing wrong, and if the suggested configuration seems appropriate.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[pminarik]

Given that static routes cannot be configured to point to a specific dialup tunnel (as they are dynamic, after all!), this naturally leads to your question: How does a hub know which spoke owns subnet x.x.x.x/y?
There is two ways for it to figure it out:

Phase2 selectors: Each spoke will use specific source-subnets for its phase2 selector(s) instead of wildcard 0.0.0.0/0 (Hub will stay unchanged, wildcards for both sides). If hub has "set add-route enable" (enabled by default with a basic dialup tunnel) configured in phase1, the spoke's selectors will be automatically injected into the hub's routing table (with the distance and priority values as configured in the same phase1's CLI).

Dynamic routing: If you keep "add-route disable" and use wildcard selectors, you will have to use dynamic routing (BGP, OSPF, RIP) to have your spokes announce which subnets are available through them.

The selector-approach is nicely described in this KB article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-add-automatic-route-towards-the-rem...

Dynamic routing has had many documents written about it, one example would be: https://community.fortinet.com/t5/FortiGate/Technical-Note-Dynamic-routing-BGP-over-IPsec-tunnel/ta-... (note, this example shows static tunnels, so the "set add-route disable" isn't mentioned; this will be needed on your dialup hub)