Multiple FortiClientVPN IPsec Connections from same ISP/IP address???

[altanet]

I can' t find any mention (in KB or forums) of how to handle duplicate source IPs from IPsec VPN clients. Multiple users from hotel or other common ISP media are knocking each other off as the subsequent user (from same ISP/IP) creates a tunnel. FortiClientVPN s/w is 4.2.3/build0271 against FG200B @ v4.0MR3 (build0441) Please let me know if this is a known issue and if there is a solution. Thank you

[altanet]

Could someone please lend some feedback ? The Cisco VPN client can do this all day long (mult sessions/same IP). Is this something I should know and is there a configuration to resolve ? Thank you

[Carl_Wallmark]

Hi, In CLI, you will find this on the Phase2-interface: route-overlap {overlap_option} Specify how FortiGate unit handles multiple dialup users with the same IP source address. Set overlap_option to one of the following: • allow — allow overlapping routes • use-new — delete the old route and add the new route • use-old — use the old route and do not add the new route Default is " use-new" , you should change this to " allow"

[altanet]

Many thanks Selective. I' ll hit the CLI manual harder in the future. Again, Thank you

[darrell]

Are you sure about that one? I think the easier fix is to use main mode instead of aggressive mode isn' t it?

[Carl_Wallmark]

Could be, i never had this problem. This is what the CLI manual says.

[ede_pfau]

No Main mode for dial-in clients as their host address is not known in advance. What the phase 2 setting will do is create a route to a subnet instead of a single source address (x.y.z.n/32) to route the tunnel traffic back. Multiple clients are then separated by the tunnel ID (SPI). Never had to deal with such a situation but it could occur anytime if more than one road warrior stays at the same hotel. Please let us know if it works.

[altanet]

Thanks all, Changing the route-overlap to ' allow' worked like a champ for Tunnel-mode/Agressive configuration for multiple FortiClient VPN sessions with the same source address. Also applied the same parameter to an Interface-mode/Main Mode configuration for iPhone VPN, but haven' t tested duplication yet - I am the only/first user. Thanks again

[Carl_Wallmark]

Weehoo !!