Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
echo
Contributor II

How to set up FortiClient Peer ID?

Hello! I want to configure FortiClients to connect to a FortiGate 100D using IPSEC VPN, but so that different users authenticate against different AD-servers. Which means I can' t use " Accept any peer ID" in Phase1 configuration, otherwise all dialup clients will fall into the first policy and/or VPN. If I use Shrewsoft VPN Client, then it has been OK, some clients already authenticate and use the VPN, because in Shrew client there is a special place where to enter that common peer ID. The manual says (fortigate-ipsec-50.pdf, page 45): ------- To configure FortiClient - pre-shared key and peer ID 1. Start the FortiClient Endpoint Security application. 2. Go to VPN > Connections, select the existing configuration. 3. Select Advanced > Edit. Auto Key phase 1 parameters Page 45 IPsec VPN for FortiOS 5.0 4. In the Preshared Key field, type the FortiGate password that belongs to the dialup client (for example, 1234546). The user account password will be used as the preshared key. 5. Select Advanced. 6. Under Policy, select Config. 7. In the Local ID field, type the FortiGate user name that you assigned previously to the dialup client (for example, FortiC1ient1). 8. Select OK to close all dialog boxes. Configure all FortiClient dialup clients this way using unique preshared keys and local IDs. ------- But there is no " Advanced" , nor " Advanced\Edit" , nor " Advanced\Policy" as suggested by this instruction. I just upgraded to FortiClient 5.2 but that menu didn' t appear (and Register to FortiGate button doesn' t work anymore). I would gladly use these if they were there. FortiClient is currently not registered to a FortiGate so it doesn' t have any policy set. My goal was to use one and the same peer ID for all people belonging to one and the same company and use Xauth+LDAP to authenticate them based on their AD credentials against their own AD-server. I also thought, maybe I shall use " Accept per ID in dialup group" and select that Xauth group, but that group is not in the list for some unknown reason. If there is somebody having faced this and solved it, it would be nice to know.
1 Solution
emnoc
Esteemed Contributor III

Yeah just backup up the config, edit the cfg and add the localpeer & restore it.

 

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
7 REPLIES 7
ShrewLWD
Contributor

Hi Echo, I can' t speak for 5.2, but 4.3 and 5.0, set the peerID in phase1 of the VPN tunnel on the Fortinet, then add that same ID into the config file of the client (look for a <localid /> line, then edit it to read <localid>MyPeerID</localid>
echo
Contributor II

Thank you very much for this information! I had no idea of this configuration file before, but I could export it, change it, import it, and could get the VPN connected. Also, the router' s software was upgraded to 5.2 in the meantime and that also helped because LDAP authentication over another permanent IPSEC tunnel didn' t work before. Still, it would be easier to get rid of modifying the connection file, but even though I could choose the appropriate group for peer-id in the router, this change was not applied because of a nonsense red error " -1: value out of range" or something like that.
echo
Contributor II

Just for information that, as my college found out, FortiClient 5.2 latest version has peer id setting for the new ipsec vpn also in the GUI part. That makes it all easier.
kcerb
New Contributor III

echo wrote:
Just for information that, as my college found out, FortiClient 5.2 latest version has peer id setting for the new ipsec vpn also in the GUI part. That makes it all easier.
in MAC version (5.2.2.364) there is no "Advanced" option in GUI.

FGT60B, FGT100A, FGT100D

FGT60B, FGT100A, FGT100D
ede_pfau
SuperUser
SuperUser

There used to be an " Advanced" section where you could set all parameters manually. Last version that I' ve checked that had this is 4.3.5. Forticlients after that and before v5.2 come with a VPNEditor.exe (in the archive " VPNtools" ). This works as well. v5.2 has the editor integrated.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
emnoc
Esteemed Contributor III

Yeah just backup up the config, edit the cfg and add the localpeer & restore it.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
kcerb
New Contributor III

emnoc wrote:

Yeah just backup up the config, edit the cfg and add the localpeer & restore it.

Great workaround.

Thanks!

FGT60B, FGT100A, FGT100D

FGT60B, FGT100A, FGT100D
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors