Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Andre_Backs
New Contributor

ipsec for dialup IP binding ?

Hi all,

I'm testing different setups wit IPsec Tunnels on a Fortigate 200D.

The first tunnel I made is:

    edit "p1-edam"         set type dynamic         set interface "wan1"         set peertype one         set proposal aes256-md5         set dpd disable         set dhgrp 2         set nattraversal disable         set peerid "2ch1133f0002d"         set psksecret ENC /y+aGk   

next

I succesfully connected to that from IP 85.a.b.c

Then I made a second tunnel:

    edit "p1-TEST"         set type dynamic         set interface "wan1"         set peertype one         set proposal aes256-md5         set dpd disable         set comments "TEST ipsec"         set dhgrp 5         set nattraversal disable         set peerid "routerProBiblio"         set psksecret ENC PECH     next As you can see, completely different setup.

Now when i try to connect with the second setup from the same address IP 85.a.b.c I can't get the tunnel up.

When i check the log in "Log & Report / VPN Events" filtered on the Remote IP 85.a.b.c I see that it gets associated with the first tunnel i created as p1-edam_1.

Therefore I assume that the external IP 85.a.b.c is somehow tied to the first tunnel that succesfully connects and that subsequent requests with a different setup will always fail.

The questions i have are:

1 - is the assumption true that a dialup IPsec is tied to the first external IP that succesfully connects?

2 - if it is true, how can I untie this (or prevent that it happens)

 

Thanks for your help

ABB@ProBiblio Fortigate 200D (slave master)

ABB@ProBiblio Fortigate 200D (slave master)
2 REPLIES 2
ede_pfau
SuperUser
SuperUser

hi,

 

in my experience this is not the case.

Imagine you have "peertype: usergroup". Usually, dialup tunnels support more than just one client, differentiated only by the peerID used (peerid=username, PSK=user_password in Local Users). So, to match a dialup VPN the FGT has to look at the peerID only.

What I can imagine is that you've tested this without completely destroying the phase1 SA. Then of course you'll end up on the same phase1 every time. Check 'diag vpn tunnel down' or the like (I don't remember the exact command now) to tear down the tunnel SA before trying the other phase1.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Andre_Backs

Ede,

it looks you might be right here.

But I also learned that the IKE mode should be set to Aggressive in order to get the authentication right.

In any case, I switched back to IKE mode Main and use Static IP Address for the tunnels I needed to set up. This works perfectly for me.

 

André

ABB@ProBiblio Fortigate 200D (slave master)

ABB@ProBiblio Fortigate 200D (slave master)
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors