1

Is there a way to make the Fortigate 60D act as a VPN client connecting to an ASA IPSec VPN without setting up a site-to-site VPN? In other words, have the Fortinet act as a typical PC would connecting to a VPN?

If so, could anyone provide guidance?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 12, 2017 at 4:03

1 Answer 1

Reset to default
2

Yes, one of the ways to set up an IPsec VPN is to create a "dial-up VPN". This is exactly the same as what a (software) VPN client does.
The exact configuration steps depend on the version of FortiOS you're using (v4.3, v5.0, v5.2). If v5.2, you could use the VPN assistant which guides you through the steps necessary (phase1, phase2, policy - no routes). But even doing it manually in the CLI is not difficult. Get the "FortiOS Cookbook" from docs.fortinet.com where you find lots of real world example setups.

Hopefully you have a good reason to try to do it this way. Cisco VPN usually uses a self-configuration mode for VPN clients (modconfig). FortiOS supports this but probably only by enabling it in the CLI.

Improve this answer
3
  • Thank you, I'm at 5.2 but at least I know it is possible. This is for getting my home Fortinet 60D connected our colo, so not all my work devices need to have the VPN on. I'll update with how it goes. Tried a couple things, but deleting VPN configs the GUI is pain in the butt (maybe not possible, had to use CLI to kill some refs - the phase-interfaces) so wanted more direction since iterating was slow.
    – Kyle Brandt
    Commented Aug 1, 2015 at 23:35
  • If you've used CLI before then I'd recommend doing the setup in CLI only. Be sure to use "set modconfig ena" in phase1. And I'd try site-2-site to Cisco via assistant as well - you can always restrict access via the policy.
    – user1016274
    Commented Aug 1, 2015 at 23:40
  • Thanks I'll go the CLI route. My background is Cisco, but part of getting this particular device was to get comfortable with foritinet since we are moving from some of our asas to foritinet.
    – Kyle Brandt
    Commented Aug 1, 2015 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.