PPTP configuration on 4.0.3 firmware

[#1]

Hello everyone, how/where to configure the PPTP vpn with the new 4.0.3 firmware (fortigate 50b) ? I was used to do this with the old firmware..it was clearly under the " VPN" menu, but now, no way to find it :p if someone could point me to the right direction it would be nice thanks ! Andreas

[abelio]

Hello and welcome, pptp was moved from standard gui; you can configure with CLI if your want or if your prefer do that using GUI, you' ll need to learn how customize GUI (4.0 new feature) everything is explained in detail in Admin Guide for 4.0 at http://docs.fortinet.com/fgt.html

[#3]

I´ve got a problem with PPTP configuration, too. As soon as I type " set sip 192.168.33.220" (for example) on the CLI - I get the following error message:

FGT80C3909637XXX # config vpn pptp FGT80C3909637XXX (pptp) # set sip 192.168.33.220 command parse error before ' sip' Command fail. Return code -61 FGT80C390963XXX (pptp) #

FortiOS version 4.0000 By the way - I tried to configure L2TP, too - but as soon as I type the CLI command " set encapsulation transport-mode" - the same error appears. What am I doing wrong? Thanks in advance!

[abelio]

FGT80C3909637XXX (pptp) # set sip 192.168.33.220 command parse error before ' sip' Command fail. Return code -61 FGT80C390963XXX (pptp) #

As described in documentation http://docs.fortinet.com/fgt/html/fortigate-admin/wwhelp/wwhimpl/js/html/wwhelp.htm you need to define ' ip-mode' parameter before. If you want to define a range there, set that parameter to ' range' ; otherwise ip-mode defined to usrgrpp will obtain IPs from pptp-users group definition.

By the way - I tried to configure L2TP, too - but as soon as I type the CLI command " set encapsulation transport-mode" - the same error appears. What am I doing wrong?

this is a different thing; that command it' s not available to configure under l2tp. by the book:

 config vpn l2tp
   set eip <address_ipv4>
   set sip <address_ipv4>
   set status {disable | enable}
   set usrgrp <group_name>
 end
 

[#5]

Thank you very much for your answer - but its not that easy. Same error message:

FGT80C3909637XXX # config vpn pptp FGT80C3909637XXX (pptp) # set ip-mode range command parse error before ' ip-mode' Command fail. Return code -61 FGT80C3909637XXX (pptp) #

[laf]

Weird. Let s do it again: Define a firewall a local user and then a firewall group: PPTP-GR. Then: configure vpn pptp set status enable set sip 172.16.10.1 set eip 172.16.10.25 set usrgrp PPTP-GR set ip-mode range end Good luck!

[#7]

Thank you very much! The trick was to change the order - first " set status enable" and then the ip-ranges. Anyway, I don´t get it to work. The connection seems to work fine and my client has got an IP from the defined range. But I can´t reach any servers at the connected private network. What could be wrong? Do I have to assign special firewall policies?

[rwpatterson]

On the client side, retrieve the remote gateway.

[#9]

thank you very much guys after reading u, i finally got it.. the computer man becomes lazy with all those guy' s xD

[#10]

@abello: Regarding my L2TP configuration question what may be wrong with the " set encapsulation transport-mode" ....you wrote:

this is a different thing; that command it' s not available to configure under l2tp. by the book: config vpn l2tp set eip <address_ipv4> set sip <address_ipv4> set status {disable | enable} set usrgrp <group_name> end

I found this syntax in the IPSEC guide FortiOS 4.0 MR1 book on page 143:

Make this a transport-mode VPN. You must use the CLI to do this. If your phase 2 name is dialup_p2, you would enter: config vpn ipsec phase2 edit dialup_p2 set encapsulation transport-mode end

It seems as if there are a lot of misunderstandable sentences and declarations in the PDF files provided by Fortinet?!I So far, I am really happy with the product, but I would not have been able to set ip up correctly without the help of this great forum. I understand that Fortinet wants to sell their certification trainings but...