How to set up FortiClient Peer ID?

[echo]

Hello! I want to configure FortiClients to connect to a FortiGate 100D using IPSEC VPN, but so that different users authenticate against different AD-servers. Which means I can' t use " Accept any peer ID" in Phase1 configuration, otherwise all dialup clients will fall into the first policy and/or VPN. If I use Shrewsoft VPN Client, then it has been OK, some clients already authenticate and use the VPN, because in Shrew client there is a special place where to enter that common peer ID. The manual says (fortigate-ipsec-50.pdf, page 45): ------- To configure FortiClient - pre-shared key and peer ID 1. Start the FortiClient Endpoint Security application. 2. Go to VPN > Connections, select the existing configuration. 3. Select Advanced > Edit. Auto Key phase 1 parameters Page 45 IPsec VPN for FortiOS 5.0 4. In the Preshared Key field, type the FortiGate password that belongs to the dialup client (for example, 1234546). The user account password will be used as the preshared key. 5. Select Advanced. 6. Under Policy, select Config. 7. In the Local ID field, type the FortiGate user name that you assigned previously to the dialup client (for example, FortiC1ient1). 8. Select OK to close all dialog boxes. Configure all FortiClient dialup clients this way using unique preshared keys and local IDs. ------- But there is no " Advanced" , nor " Advanced\Edit" , nor " Advanced\Policy" as suggested by this instruction. I just upgraded to FortiClient 5.2 but that menu didn' t appear (and Register to FortiGate button doesn' t work anymore). I would gladly use these if they were there. FortiClient is currently not registered to a FortiGate so it doesn' t have any policy set. My goal was to use one and the same peer ID for all people belonging to one and the same company and use Xauth+LDAP to authenticate them based on their AD credentials against their own AD-server. I also thought, maybe I shall use " Accept per ID in dialup group" and select that Xauth group, but that group is not in the list for some unknown reason. If there is somebody having faced this and solved it, it would be nice to know.

[ShrewLWD]

Hi Echo, I can' t speak for 5.2, but 4.3 and 5.0, set the peerID in phase1 of the VPN tunnel on the Fortinet, then add that same ID into the config file of the client (look for a <localid /> line, then edit it to read <localid>MyPeerID</localid>

[echo]

Thank you very much for this information! I had no idea of this configuration file before, but I could export it, change it, import it, and could get the VPN connected. Also, the router' s software was upgraded to 5.2 in the meantime and that also helped because LDAP authentication over another permanent IPSEC tunnel didn' t work before. Still, it would be easier to get rid of modifying the connection file, but even though I could choose the appropriate group for peer-id in the router, this change was not applied because of a nonsense red error " -1: value out of range" or something like that.

[echo]

Just for information that, as my college found out, FortiClient 5.2 latest version has peer id setting for the new ipsec vpn also in the GUI part. That makes it all easier.

[kcerb]

echo wrote:
Just for information that, as my college found out, FortiClient 5.2 latest version has peer id setting for the new ipsec vpn also in the GUI part. That makes it all easier.

in MAC version (5.2.2.364) there is no "Advanced" option in GUI.

[ede_pfau]

There used to be an " Advanced" section where you could set all parameters manually. Last version that I' ve checked that had this is 4.3.5. Forticlients after that and before v5.2 come with a VPNEditor.exe (in the archive " VPNtools" ). This works as well. v5.2 has the editor integrated.

[emnoc · Accepted solution]

Yeah just backup up the config, edit the cfg and add the localpeer & restore it.

[kcerb]

emnoc wrote:

Yeah just backup up the config, edit the cfg and add the localpeer & restore it.

Great workaround.

Thanks!