Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

IPSEC tunnel with dynamic IP address without using dynamic DNS

Hey Guys,


Quick one, does anyone have succeed in creating an IPsec tunnel with dynamic IP address from remote peer.

Please note the remote peer doesn't have dynamic DNS and they are not using Fortigate as well, they are using a standard Cisco router.





Esteemed Contributor III

So the remote-peer cisco is dynamic? Is the fortigate static ip-address? If yes, why not have the cisco router dialup to the fortigate?


Ken Felix





PCNSE NSE StrongSwan
New Contributor II

Hey Ken,


Thanks for pointing out, I will give a try and get back with update.




Does not neccessarily have to be dial up. Should also work as S2S.

Just disable p1 autonegotioation on your FGT (can only be done on cli) so olny the cisco will set up the tunnel.

Otherwise that would create "dead" SAs on the FGT when the dynamic ip changes.

Maybe you have to limit the S2S on the FGT to only accept specific peer id (afair only possible in ike v1 aggressive mode - correct me if I am wrong here) or unique proposal pair(s) in p1 and p2  since on FGT side you cannot nail it to the remote gw in this case but you need to nail it to the right ipsec if you happen to have more then one.

If there is only one you might skip that last step because this is unique then anyways.


"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
New Contributor

so is there any update what the method did you use? please share here mate


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors