Is there a way to make the Fortigate 60D act as a VPN client connecting to an ASA IPSec VPN without setting up a site-to-site VPN? In other words, have the Fortinet act as a typical PC would connecting to a VPN?

If so, could anyone provide guidance?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 4:03

Yes, one of the ways to set up an IPsec VPN is to create a "dial-up VPN". This is exactly the same as what a (software) VPN client does.
The exact configuration steps depend on the version of FortiOS you're using (v4.3, v5.0, v5.2). If v5.2, you could use the VPN assistant which guides you through the steps necessary (phase1, phase2, policy - no routes). But even doing it manually in the CLI is not difficult. Get the "FortiOS Cookbook" from docs.fortinet.com where you find lots of real world example setups.

Hopefully you have a good reason to try to do it this way. Cisco VPN usually uses a self-configuration mode for VPN clients (modconfig). FortiOS supports this but probably only by enabling it in the CLI.

  • Thank you, I'm at 5.2 but at least I know it is possible. This is for getting my home Fortinet 60D connected our colo, so not all my work devices need to have the VPN on. I'll update with how it goes. Tried a couple things, but deleting VPN configs the GUI is pain in the butt (maybe not possible, had to use CLI to kill some refs - the phase-interfaces) so wanted more direction since iterating was slow. – Kyle Brandt Aug 1 '15 at 23:35
  • If you've used CLI before then I'd recommend doing the setup in CLI only. Be sure to use "set modconfig ena" in phase1. And I'd try site-2-site to Cisco via assistant as well - you can always restrict access via the policy. – user1016274 Aug 1 '15 at 23:40
  • Thanks I'll go the CLI route. My background is Cisco, but part of getting this particular device was to get comfortable with foritinet since we are moving from some of our asas to foritinet. – Kyle Brandt Aug 1 '15 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.