Fortigate as a dial-up vpn client?

[journeyman]

Using 60C hardware I've been asked to connect to a vendor VPN gateway. The only details I have been provided are IP address, username and password, and the fact that we "are able to connect just by creating a VPN connection in windows".

Connecting from a Windows box doesn't suit our needs.

I'm familiar with ipsec point to point but not dialup.

All the vpn information I can find is either point to point or where forticlient / iOS / M$ etc are the dial up clients and fortigate is the vpn gateway. I've searched this forum, the kb, the handbook and the cookbook.

I found the Microsoft VPN section of the handbook but the fortigate is the gateway not the client. Even that mentions username, password and psk but we haven't been advised of a psk.

Can the fortigate act like as a dialup client similar to a windows VPN client? Is the information provided to us sufficient?

edit - we will have a dynamic IP and traverse a NAT.

[journeyman]

Anyone? It seems simple enough...

The lazy way would be to use a Windows box and share the connection, but that's a bit ugly and I'd rather not.

[emnoc]

As far as I'm aware, the fortigate has no  VPNclient capabilities. The "Cisco EasyVPN"  is not a solution in the fortigate as client.

Could you just ask for a static lan2lan  vpn solution?

[rwpatterson]

Is the M$ solution ("able to connect just by creating a VPN connection in Windoze") IPSec or PPTP?

[ede_pfau]

Hi Bob,

nice to hear from you again, it's been a while.

Windows VPN is L2TP with IPsec in phase2, but not in 'tunnel mode' but 'transfer mode'. Sounds convoluted and it is. AFAIK the FGT is capable of being a L2TP server (via CLI only) for historical reasons but I've never heard that it could act as a L2TP client.

IMHO site to site VPN is not what Windows VPN is meant for. The other side should just offer a standard IPsec gateway, and be done with it.

[rwpatterson]

ede_pfau wrote:

Hi Bob,

nice to hear from you again, it's been a while.

Thanks Ede. As in the past, I lurk and post when I think I can help. Since my departure from the daily management, my expertise is now centered on the older, more widely placed unit base. The bleeding edge stuff I'll leave to you gurus. (I really should change my signature...)

[ede_pfau · Accepted solution]

@journeyman:

I stand corrected (hopefully) - we've had this same subject in the forums just 2 years ago, and we (Selective, emnoc, me) stated that the smaller FGTs could well act as an L2TP client! Read up here https://forum.fortinet.com/tm.aspx?m=98720 for details. There is a setting in the (WAN) interface setup that enables this and opens additional settings.

This should get you going. Keep us posted!

[journeyman]

Thanks all for your replies. And Ede I was very happy to see your second post. But so far no luck.

The working basic Windows VPN connection appears to be pptp on port 1723.

To check the possibility of using l2tp, I changed the Windows PC vpn configuration from "Automatic" to "l2tp". This did not succeed and continued to use port 1723 not port 1701.

Perhaps their server is also listening on 1701. It seems to be a long shot but I will try to implement using the FGT.

This tunnel will be temporary.

I agree with everyone saying a proper tunnel is better. I can ask but I don't like my chances.

[journeyman]

I created a l2tp client per emnoc's example in the linked thread. A packet capture (external, wireshark) shows the server shuts down the connection immediately, prior to any authentication:

> SCCRQ

< SCCRP

> SCCRN

< ZLB

> ICRQ

< ZLB # OK so far

< CDN "Call failed due to detection of a busy signal"By the way, is there any documentation to describe the integer value of "debug level", for example in the command:

diagnose debug application [l2tp|l2tpcd] <debug level>

I already searched the diagnose wiki but did not see it there. More out of curiosity since there's not much to check.

edit - following on from the above, how to debug the l2tp client within the FGT?

Thanks for your help, back to the vendor I guess..

[echo]

Did I miss something? You wanted Fortigate act as client, and also IPSEC is OK? I recently configured one like that and it worked. We couldn't get a certain newer Huawei modem work "bridge-like" so first we got internet working and then created an IPSEC client-tunnel to headquarter's FortiGate and it worked like that. Branch office fortigate wasn't reachable any other way than using TeamViewer in one of the user's machine in the branch office, which wasn't good of course.