VPN PPTP and L2TP using secondary ip address?

[Alder]

Hi everybody! I' ve a FortiGate 110C with firmware v4.0,build0496,111108 (MR3 Patch 3) and I' ve configured both l2tp and pptp vpn for our mac client. Everything works fine, but now I want to change the ip address to which vpn clients connect. My WAN interface is on port 2 and has a static ip address like x.x.x.226 / 255.255.255.224. I added a secondary ip address x.x.x.227 on port2. Now my clients connect to .226 ip and I want them to connect on .227 but I can' t understand how to do this and I can' t find info on the documentation. Can you help me? tnx Alder

[emnoc]

Not sure of what your trying to do, but for starters you can' t create a secondary in the the same subnet as the primary address Under the VPN interface configuration you can try the ; set local-gw with the secondary ip_address

[Alder]

Tried, but nothing change. When I try to connect it says that the server did not responded. Btw when I try to access to the firewall using ssh on ip .227 everything works, so the ip is correctly configured. Below there is my configuration, if it can help.

config vpn ipsec phase1
     edit " l2tp_vpn" 
         set type dynamic
         set interface " port2" 
         set local-gw x.x.x.227
         set dhgrp 2
         set proposal aes256-md5 3des-sha1 aes192-sha1
         set psksecret blablabla
     next
 end
 
 config vpn ipsec phase2
     edit " l2tp-p2" 
         set encapsulation transport-mode
         set pfs disable
         set phase1name " l2tp_vpn" 
         set proposal aes256-md5 3des-sha1 aes192-sha1
         set keylifeseconds 3600
     next
 end
 
 config system interface
     edit " port2" 
         set vdom " root" 
         set ip x.x.x.226 255.255.255.224
         set allowaccess ping https ssh
         set type physical
         set alias " WAN" 
         set secondary-IP enable
             config secondaryip
                 edit 1
                     set ip x.x.x.227 255.255.255.255
                     set allowaccess ping
                 next
             end
     next
 end
 
 config vpn l2tp
     set eip 172.26.110.127
     set sip 172.26.110.1
     set status enable
     set usrgrp " vpn_l2tp_usr_grp" 
 end
 
 config firewall policy
     edit 49
         set srcintf " wan1"  --> (user interface)
         set dstintf " port2"  --> (wan interface)
             set srcaddr " all"              
             set dstaddr " all"              
         set action ipsec
         set schedule " always" 
             set service " ANY"              
         set inbound enable
         set outbound enable
         set vpntunnel " l2tp_vpn" 
     next
     edit 51
         set srcintf " port2" 
         set dstintf " port2" 
             set srcaddr " l2tp-pool"              
             set dstaddr " all"              
         set action accept
         set schedule " always" 
             set service " ANY"              
         set nat enable
     next
 end

[emnoc]

Why don' t you just unconfigu and flip the primary and secondary address on port2? Ken

[Alder]

Because I have other services using that ip address, so I can' t flip them :(

[emnoc]

Qs: Are the primary and secondary ip_address in the same subnet ? .226 & .227 ? can' t you just craft a subinterface and trunk this to your switch ( i hope you have a 802.1q aware switch ) get off the secondary?

[Alder]

Yes, this is my last hope :) But in nearly future I will have to setup other ip addresses for other services, so I' m looking for a solution using the same interface...even if this solution exists! :)