FortiClient Dial-Up IPsec VPN on FortiGate 7.4 and 7.6

Configure a split-tunnel IPsec VPN for FortiClient 7.4.x connecting to FortiGate 7.4.x or 7.6.x. FortiClient initiates the tunnel; FortiGate authenticates users and assigns client addresses, DNS servers and routes through mode-config.

The examples use a preshared key for gateway authentication and a local user group for EAP user authentication. An LDAP- or RADIUS-backed group can replace the local users.

Tunnel settings

Setting	Value
IKE version	IKEv2
Phase 1 proposals	aes128gcm-prfsha256, aes256gcm-prfsha384
Phase 2 proposals	aes128gcm, aes256gcm
DH groups	19 (ECP P-256), 20 (ECP P-384)
PFS	Enabled
Phase 2 lifetime	43200 seconds (12 hours)
Traffic routing	Split tunnel to the selected internal networks

Both peers must share at least one compatible proposal and DH group. Keep FortiClient or EMS-managed profiles aligned with the FortiGate.

Prerequisites

Provide a public IP or FQDN for the FortiGate and allow UDP 500 and 4500 through any upstream firewall or NAT device. Prepare a preshared key, a VPN user group and a client address pool that does not overlap existing networks.

Replace these example values as required:

Item	Example
WAN interface	wan1
Internal interface	lan
LAN subnet	192.168.10.0/24
Server subnet	192.168.20.0/24
Client pool	10.250.10.2–10.250.10.254
Internal DNS servers	192.168.10.10, 192.168.10.11
VPN group	FortiClient-IPsec-Users

FortiGate configuration

User and group

Create a local user and add it to the VPN group. For LDAP or RADIUS, configure the group against the existing identity source instead.

config user local
    edit "vpn.jdoe"
        set type password
        set passwd <STRONG_PASSWORD_HERE>
    next
end

config user group
    edit "FortiClient-IPsec-Users"
        set member "vpn.jdoe"
    next
end

Address objects

The client pool object is used for address assignment and firewall policy. FC_SPLIT_TUNNEL contains the internal networks advertised to clients.

config firewall address
    edit "FC_DIALUP_POOL-10.250.10.0/24"
        set type iprange
        set start-ip 10.250.10.2
        set end-ip 10.250.10.254
    next
    edit "HQ_LAN-192.168.10.0/24"
        set subnet 192.168.10.0 255.255.255.0
    next
    edit "SERVER_LAN-192.168.20.0/24"
        set subnet 192.168.20.0 255.255.255.0
    next
end

config firewall addrgrp
    edit "FC_SPLIT_TUNNEL"
        set member "HQ_LAN-192.168.10.0/24" "SERVER_LAN-192.168.20.0/24"
    next
end

Phase 1

Create the dial-up responder, enable mode-config and bind EAP authentication to the VPN group.

config vpn ipsec phase1-interface
    edit "fc-dialup"
        set type dynamic
        set interface "wan1"
        set ike-version 2
        set peertype any
        set authmethod psk
        set psksecret <YOUR_PSK_HERE>
        set mode-cfg enable
        set eap enable
        set eap-identity send-request
        set authusrgrp "FortiClient-IPsec-Users"
        set assign-ip-from name
        set ipv4-name "FC_DIALUP_POOL-10.250.10.0/24"
        set ipv4-split-include "FC_SPLIT_TUNNEL"
        set ipv4-dns-server1 192.168.10.10
        set ipv4-dns-server2 192.168.10.11
        set proposal aes128gcm-prfsha256 aes256gcm-prfsha384
        set dhgrp 19 20
        set dpd on-idle
    next
end

• type dynamic accepts connections from dial-up clients.
• mode-cfg supplies client addresses, DNS servers and split-tunnel networks.
• assign-ip-from name and ipv4-name select the named pool object.
• eap and authusrgrp require user authentication in addition to the gateway PSK.

Phase 2

Enable PFS. auto-negotiate stays disabled because FortiClient initiates the tunnel.

config vpn ipsec phase2-interface
    edit "fc-dialup-p2"
        set phase1name "fc-dialup"
        set proposal aes128gcm aes256gcm
        set pfs enable
        set dhgrp 19 20
        set keylifeseconds 43200
        set auto-negotiate disable
    next
end

Firewall policy

Allow client traffic from the VPN interface to the internal networks. The example assumes both destination subnets are reachable through lan; adapt the interfaces and policies to the routing layout. Return traffic for permitted sessions is statefully allowed.

config firewall policy
    edit 0
        set name "FortiClient-IPsec-to-LAN"
        set srcintf "fc-dialup"
        set dstintf "lan"
        set srcaddr "FC_DIALUP_POOL-10.250.10.0/24"
        set dstaddr "FC_SPLIT_TUNNEL"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat disable
    next
end

The example permits ALL services. Restrict the service list to the access required by VPN users. NAT is disabled for access to these internal networks.

FortiClient 7.4.x configuration

FortiClient 7.4.4 removes IKEv1, manual address assignment and DHCP over IPsec. It uses IKEv2 and Mode Config, as configured here. Recreate older profiles containing those retired settings when upgrading.

1. Create an IPsec VPN connection.
2. Set the remote gateway to the FortiGate's public FQDN or IP.
3. Select IKEv2 and enter the gateway's preshared key.
4. Enter the VPN user's username and password.
5. Where advanced proposal controls are available, configure the Phase 1, Phase 2 and DH values listed under Tunnel settings. Apply the same settings through EMS for managed clients.

AES-CBC with SHA-256 is an alternative for peer compatibility or NP6 hardware offload; see IPsec hardware and throughput.

FortiOS version considerations

The examples use the same dial-up responder, mode-config, address pool and split-tunnel design on FortiOS 7.4.x and 7.6.x. DH19 and DH20 provide approximately 128-bit and 192-bit classical key exchange strength respectively.

FortiOS 7.6.1 introduced hybrid PQC for IPsec key exchange. The FortiClient 7.4.x settings covered here use standard proposals and DH groups; the client documentation does not expose ADDKE or ML-KEM controls.

Routing and NAT

Split tunnelling sends traffic for FC_SPLIT_TUNNEL networks through the VPN; other traffic uses the client's existing connection.

For full tunnelling, remove the Phase 1 split-include setting and configure the required VPN-to-WAN policy and NAT for internet egress. Check DNS reachability and routing for both internal and internet traffic.

FortiClient handles NAT traversal automatically. If connection attempts fail, confirm that UDP 500 and 4500 reach the FortiGate through upstream devices.

Troubleshooting

Check UDP reachability, matching PSKs, user membership in authusrgrp, and overlapping proposals and DH groups.

Inspect tunnel and gateway state:

get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list

For negotiation failures, enable IKE debug filtered to this tunnel. FortiOS 7.4.1 onwards uses log filter; 7.4.0 uses log-filter:

diagnose vpn ike log filter clear
diagnose vpn ike log filter name "fc-dialup"
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug enable

Stop and reset debugging after capture:

diagnose debug disable
diagnose debug reset

For user authentication failures, inspect fnbamd debug:

diagnose debug application fnbamd -1
diagnose debug enable

Use the same disable and reset commands after capturing authentication debug.