How to aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset?

[mhaneke]

Hello,

how can one aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset?

I have approx. 80 IPSec dial-in tunnels defined. Each of which would need an own firewall rule to access the IP-Pool "IPSecClient_IP-range" which is dedicated to IKE-Config mode. See sample below:

config firewall policy
edit NN
set name "IPSec Client"
set uuid 3da34a02-nnn-nnn-8f09-f6ef3d7ennnn
set srcintf "IPSec Tunnel Client"
set dstintf "INTRANET"
set action accept
set srcaddr "IPSecClient_IP-range"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end

Is there an opportunity to create such a rule for a number of IPSec clients?

Or do You have an idea to bulk create the necessary rulesets?

best regards

Martin Haneke

[akumar02 · Accepted solution]

Hello Martin,

If you want to add multiple source interfaces in the policy then you can use following:

This feature can be enabled by CLI.

config  system  settings

    set  gui-multiple-interface-policy enable

end

It can also be enabled by the GUI by going to System -> Feature, selecting the page, and toggling 'Multiple Interface Policies'.

 Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-multiple-interfaces-on-a-...

Make sure you add the source and destination IP addresses accordingly.

[CatInHat · Accepted solution]

Hi, Martin!
To combine multiple IKEv1 and IKEv2 peer networks into a single set of firewall policy rules, you can use address or object groups in your firewall. Instead of creating a separate rule for each IPSec remote access tunnel, you can create one general rule and define an address or object group that includes IP pools for all IPSec clients.

[Toshi_Esumi · Accepted solution]

Wouldn't a zone work for this purpose as well?

Toshi

[mhaneke]

@ede_pfauand @Toshi_Esumi 

Thank You for the explanation. Then I have to keep that configuration until we change everyone to FortiClient. Otherwise we would have to change the configuration on every of these 3rd-party software clients.

best regards

Martin Haneke

[Toshi_Esumi]

I didn't know. We put both static and dynamic IPsecs into one zone to have just one set of policies for many tunnels. But the fact is we don't have any dialup among them.

Toshi