IPSEC VPN route publishing

[FransUrbo]

I have a FG50 (FortiOS v5.4) as my home firewall/gateway/nat as well as IPSEC VPN endpoint to get access to my home network.

The VPN works fine and all, but on the client (macOS Sierra), I don't get a route "in" to the VPN. I always have to add that manually.

And when I've done that, I have to use IPs to access my resources as home instead of using the DNS zone I've setup in FG.

[Toshi_Esumi]

I might be mistaken since I don't use much IPsec VPN with FortiClient. But I think you need to use SSL VPN with the same FortiClient get the routes automatically inserted into Mac's routing table. You obviously have to config SSL VPN server on your FG50E but shouldn't be too difficult (I'm doing it at home) since only one user you need to set up. There must be some cookbooks you can follow.

Let's wait if someone says I'm wrong and there is a way to do it with IPSec. 

[FransUrbo]

I'm not using FortiClient, but the built-in VPN client in my systems.

I've replaced a home made Linux box for this which used Strongswan and there that could publish both the route and the DNS. So it would be strange if FortiOS couldn't do it...

[ericli_FTNT]

Hi all,

Since you got access to your home network via IPSEC vpn from your mobile device, I assume your IPSEC is dynamic/dial up. Please verify this before next step.

If so, please enable "add route" option so that FGT would push a route to your mobile device.

As for SSL VPN, at tunnel mode, FGT would push a route to mobile device via PPP/IPCP protocol.

 http://help.fortinet.com/...Psec_Route_Control.htm

[FransUrbo]

Yes, a remote/dialup IPSEC VPN setup. Where is that "add route" option you want me to enable?

This is the config (I'm guessing that "add route" is somewhere else, I only configure it from the GUI at the moment):

config vpn ipsec phase1
end
 
config vpn ipsec phase1-interface
    edit "L2TP IPSEC"
        set type dynamic
        set interface "wan1"
        set peertype any
        set mode-cfg enable
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set dpd on-idle
        set comments "VPN: L2TP IPSEC (Created by VPN wizard)"
        set dhgrp 2
        set ipv4-start-ip 192.168.6.1
        set ipv4-end-ip 192.168.6.254
        set dns-mode auto
        set ipv4-split-include "local_network_lan"
        set unity-support disable
        set psksecret ENC <SECRET>
   next
end
 
config vpn ipsec phase2
end
 
config vpn ipsec phase2-interface
    edit "L2TP IPSEC"
        set phase1name "L2TP IPSEC"
        set proposal aes256-md5 3des-sha1 aes192-sha1
        set pfs disable
        set encapsulation transport-mode
        set l2tp enable
        set comments "VPN: L2TP IPSEC (Created by VPN wizard)"
        set keylifeseconds 3600
    next
    edit "cluster"
        set phase1name "L2TP IPSEC"
        set src-subnet 10.0.0.0 255.255.0.0
    next
    edit "lan"
        set phase1name "L2TP IPSEC"
        set src-subnet 192.168.69.0 255.255.255.0
    next
end

[ericli_FTNT]

Hi there, it's in the

config vpn ipsec phase1-interface edit "L2TP IPSEC"

set add-route enable

end

and do the same thing in the phase2-interface.

[FransUrbo]

If you look at the full config at http://bayour.com/misc/fortigate-vpn.txt, that's what seems to be done.

[FransUrbo]

Does anyone have any other ideas on how I can have my FortiGate publish (?) the/a route to my internal networks to my (OSX) client?

I've tried both the "set add-route phase1" and "set add-route enable" in both my phase1-interface and phase2-interface with out any luck.

[FransUrbo]

I managed to find http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ipsecvpn-54/Phase_1/Dynamic_IPsec_Rou... which might be what you're asking (?).

But looking through the config (and using show full-configuration vpn ipsec phase[12]-interface), I see that I already have set add-route enable and set add-route phase1 respectively for phase1-interface and phase2-interface.

[emnoc]

While  this a older post of my on my blog but the steps are about  the same

 http://socpuppet.blogspot.com/2013/02/l2tp-setup-fortigate-200b-mr3p12.html

I think your missing some things in your config.

Ken