ipsec for dialup IP binding ?

[Andre_Backs]

Hi all,

I'm testing different setups wit IPsec Tunnels on a Fortigate 200D.

The first tunnel I made is:

    edit "p1-edam"         set type dynamic         set interface "wan1"         set peertype one         set proposal aes256-md5         set dpd disable         set dhgrp 2         set nattraversal disable         set peerid "2ch1133f0002d"         set psksecret ENC /y+aGk   

next

I succesfully connected to that from IP 85.a.b.c

Then I made a second tunnel:

    edit "p1-TEST"         set type dynamic         set interface "wan1"         set peertype one         set proposal aes256-md5         set dpd disable         set comments "TEST ipsec"         set dhgrp 5         set nattraversal disable         set peerid "routerProBiblio"         set psksecret ENC PECH     next As you can see, completely different setup.

Now when i try to connect with the second setup from the same address IP 85.a.b.c I can't get the tunnel up.

When i check the log in "Log & Report / VPN Events" filtered on the Remote IP 85.a.b.c I see that it gets associated with the first tunnel i created as p1-edam_1.

Therefore I assume that the external IP 85.a.b.c is somehow tied to the first tunnel that succesfully connects and that subsequent requests with a different setup will always fail.

The questions i have are:

1 - is the assumption true that a dialup IPsec is tied to the first external IP that succesfully connects?

2 - if it is true, how can I untie this (or prevent that it happens)

Thanks for your help

[ede_pfau]

hi,

in my experience this is not the case.

Imagine you have "peertype: usergroup". Usually, dialup tunnels support more than just one client, differentiated only by the peerID used (peerid=username, PSK=user_password in Local Users). So, to match a dialup VPN the FGT has to look at the peerID only.

What I can imagine is that you've tested this without completely destroying the phase1 SA. Then of course you'll end up on the same phase1 every time. Check 'diag vpn tunnel down' or the like (I don't remember the exact command now) to tear down the tunnel SA before trying the other phase1.

[Andre_Backs]

Ede,

it looks you might be right here.

But I also learned that the IKE mode should be set to Aggressive in order to get the authentication right.

In any case, I switched back to IKE mode Main and use Static IP Address for the tunnels I needed to set up. This works perfectly for me.

André