IPsec dialup wrong order ip allocation

[Tutek]

Hi,

I'm trying to configure custom configuration for dialup forticlient on windows, in phase1-interface I have configured "mode-cfg : enable" and "ipv4-name : ipsec_range" this ipsec ip range have adresses from 192.168.30.1-192.168.30.2. Now when server connects to fortigate it gets address 192.168.30.1 and gateway is 192.168.30.2 so this is wrong order, also in ip configuration of this forticlient connection I see that dhcp is enabled with dhcp server 192.168.30.2 how to disable this dhcp?

All I need is to have server at 192.168.30.2 with gateway 192.168.30.1

Ethernet adapter Ethernet 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Fortinet Virtual Ethernet Adapter (NDIS 6.30)
   Physical Address. . . . . . . . . : 
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : 
   IPv4 Address. . . . . . . . . . . : 192.168.30.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 
   Lease Expires . . . . . . . . . . : 
   Default Gateway . . . . . . . . . : 192.168.30.2
   DHCP Server . . . . . . . . . . . : 192.168.30.2
   DHCPv6 IAID . . . . . . . . . . . : 
   DHCPv6 Client DUID. . . . . . . . : 
   DNS Servers . . . . . . . . . . . : 192.168.100.5
                                       0.0.0.0
   NetBIOS over Tcpip. . . . . . . . : Enabled

[vdralio]

Hi @Tutek ,

There is nothing wrong with the IP address assignment, by design the first IP address from the pool (range of IP address) will be assigned to the client connected.  By default, the first-available address assignment method is still used.

As you are using a range of IP addresses for the client connected to the VPN, then a scope is created and will be maintained by FortiGate. It is a must to maintain the scope and determine which IP address has to be assigned and which is already assigned.

Please check the article also is the same:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/785501/forticlient-as-dialup-client

You can use IP address reservation if you want so the client will have the same IP address all the time.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DHCP-IP-address-configuration-with-Dial-up...

On FortiOS 7.0 and the latest, there is an option to change the IP address assigned to the round-robin, check below:

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/4729/ssl-vpn-and-ipsec-vpn-ip-addres...

https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/4729/ipsec-vpn-ip-address-as...

Best Regards,

Vasil Dralio

[Tutek]

The problem is that users from Fortigate LAN will be accessing this server that is connecting using Forticlient, so I need to be sure that this server have all the time the same ip address. I read your linked topics about ip reservation, but I have question if there is only one server that is connecting to fortigate can I modify ipsec ip address range on fortigate to 192.168.30.1-192.168.30.1 so server will getting always this one ip?

[vdralio]

Dear @Tutek ,

Yes, dialup VPN works with only one IP address for the range, but anyway, if you will use this VPN only for one machine, by design will get always the first IP address of the scope added to the VPN configuration.

Best Regards,

Vasil